@@ -187,7 +187,8 @@ export function createContainerProfile(options: ProfileOptions): ContainerProfil
     const args = ['create', '--name', name, '--read-only', '--user', '10001:10001', '--cap-drop=ALL',
       '--security-opt=no-new-privileges', '--pids-limit=128', '--memory=512m', '--memory-swap=512m',
       '--cpus=1', '--shm-size=16m', '--ipc=private', '--cgroupns=private',
-      `--network=${options.network.name}`, '--env', 'HOME=/home/codeboost', '--env', `CODEBOOST_PHASE=${invocation.phase}`,
+      `--network=${options.network.name}`, '--dns=127.0.0.1', '--env', 'HOME=/home/codeboost',
+      '--env', `CODEBOOST_PHASE=${invocation.phase}`,
       '--label', `io.codeboost.invocation=${ownershipId}`,
       '--env', `CODEBOOST_VENDOR=${invocation.vendor}`, '--env', 'npm_config_cache=/tmp/npm-cache',
       '--env', `HTTPS_PROXY=${options.network.proxyUrl}`, '--env', `HTTP_PROXY=${options.network.proxyUrl}`,
 
@@ -88,7 +88,7 @@ type Inspect = {
     CpuPercent: number; IOMaximumBandwidth: number; IOMaximumIOps: number; DeviceCgroupRules: unknown[] | null;
     StorageOpt?: Record<string, string> | null; CgroupParent: string;
     Devices: unknown[] | null; DeviceRequests: unknown[] | null; Tmpfs: Record<string, string> | null;
-    Mounts: Array<{ Type: string; Source: string; Target: string; ReadOnly: boolean }> | null };
+    Mounts: Array<{ Type: string; Source: string; Target: string; ReadOnly: boolean }> | null; Dns: string[] };
   Mounts: Array<{ Type: string; Name?: string; Source: string; Destination: string; RW: boolean }>;
   NetworkSettings: { Networks: Record<string, unknown> };
 };
@@ -132,6 +132,8 @@ export function validateContainer(container: string, profile: ContainerProfile,
     || host.CpuCount !== 0 || host.CpuPercent !== 0 || host.IOMaximumBandwidth !== 0 || host.IOMaximumIOps !== 0
     || host.DeviceCgroupRules !== null || host.StorageOpt != null || host.CgroupParent !== '')
     throw new Error('Container daemon configuration is missing required lockdown.');
+  if (JSON.stringify(host.Dns) !== JSON.stringify(['127.0.0.1']))
+    throw new Error('Container DNS configuration changed.');
   if (JSON.stringify(Object.keys(inspect.NetworkSettings.Networks)) !== JSON.stringify([profile.network.name]))
     throw new Error('Container network attachment changed.');
   const tmpfs = host.Tmpfs ?? {};
 
@@ -15,7 +15,7 @@ export interface VendorNetwork {
   readonly vendor: InvocationInput['vendor'];
 }
 interface NetworkIdentity { readonly allocationId: string; readonly imageId: string; readonly invocation: InvocationInput;
-  readonly subnet: string }
+  readonly subnet: string; readonly proxyIp: string }
 const identities = new WeakMap<VendorNetwork, NetworkIdentity>();
 const environment = () => ({ PATH: process.env.PATH, DOCKER_HOST: process.env.DOCKER_HOST });
 const deadline = (timeoutMs: number) => {
@@ -66,13 +66,17 @@ const validateVendorNetwork = (network: VendorNetwork, invocation: InvocationInp
         SecurityOpt?: string[]; Memory?: number; MemorySwap?: number; NanoCpus?: number; PidsLimit?: number;
         NetworkMode?: string; PidMode?: string; IpcMode?: string; UTSMode?: string; UsernsMode?: string;
         CgroupnsMode?: string; Devices?: unknown[] | null; DeviceRequests?: unknown[] | null };
-      NetworkSettings?: { Networks?: Record<string, unknown> }; Mounts?: unknown[] } | undefined;
+      NetworkSettings?: { Networks?: Record<string, { IPAddress?: string }> }; Mounts?: unknown[] } | undefined;
+  const image = JSON.parse(docker(['image', 'inspect', identity.imageId], remaining()))[0] as
+    { Config?: { Env?: string[] } } | undefined;
   const inspectedNetwork = JSON.parse(docker(['network', 'inspect', network.name], remaining()))[0] as
     { Internal?: boolean; Driver?: string; Labels?: Record<string, string>; IPAM?: { Config?: Array<{ Subnet?: string }> };
       Containers?: Record<string, { Name?: string }> } | undefined;
   const networks = Object.keys(inspect?.NetworkSettings?.Networks ?? {}).sort();
   const endpoints = Object.values(inspectedNetwork?.Containers ?? {}).map(value => value.Name).sort();
   const allowedEndpoints = [network.proxyContainer, ...(agentName ? [agentName] : [])];
+  const expectedEnvironment = [...(image?.Config?.Env ?? []),
+    `CODEBOOST_ALLOWED_HOSTS=${VENDOR_HOSTS[network.vendor].join(',')}`].sort();
   if (!inspect?.State?.Running || inspect.Config?.Image !== identity.imageId || inspect.Config?.User !== '10001:10001'
     || inspect.Config?.Labels?.['io.codeboost.egress'] !== identity.allocationId || !inspect.HostConfig?.ReadonlyRootfs
     || inspect.HostConfig.Privileged || !inspect.HostConfig.CapDrop?.map(value => value.toUpperCase()).includes('ALL')
@@ -85,10 +89,10 @@ const validateVendorNetwork = (network: VendorNetwork, invocation: InvocationInp
     || inspect.HostConfig.UsernsMode !== '' || inspect.HostConfig.CgroupnsMode !== 'private'
     || (inspect.HostConfig.Devices?.length ?? 0) !== 0 || (inspect.HostConfig.DeviceRequests?.length ?? 0) !== 0
     || JSON.stringify(networks) !== JSON.stringify(['bridge', network.name].sort()) || inspect.Mounts?.length
-    || inspect.Config?.Entrypoint?.[0] !== 'node'
+    || JSON.stringify(inspect.Config?.Entrypoint) !== JSON.stringify(['node'])
     || JSON.stringify(inspect.Config?.Cmd) !== JSON.stringify(['/usr/local/lib/codeboost-egress-proxy.mjs'])
-    || inspect.Config.Env?.filter(value => value.startsWith('CODEBOOST_ALLOWED_HOSTS=')).length !== 1
-    || !inspect.Config.Env?.includes(`CODEBOOST_ALLOWED_HOSTS=${VENDOR_HOSTS[network.vendor].join(',')}`)
+    || JSON.stringify([...(inspect.Config.Env ?? [])].sort()) !== JSON.stringify(expectedEnvironment)
+    || inspect.NetworkSettings?.Networks?.[network.name]?.IPAddress !== identity.proxyIp
     || !inspectedNetwork?.Internal || inspectedNetwork.Driver !== 'bridge'
     || inspectedNetwork.Labels?.['io.codeboost.egress'] !== identity.allocationId
     || inspectedNetwork.IPAM?.Config?.length !== 1 || inspectedNetwork.IPAM.Config[0]?.Subnet !== identity.subnet
@@ -129,8 +133,13 @@ export function createVendorNetwork(invocation: InvocationInput, imageId: string
       "socket.once('connect',()=>{socket.destroy();process.exit(0)});",
       "socket.once('error',()=>{socket.destroy();if(++attempts===50)process.exit(1);setTimeout(check,20)})};check();",
     ].join('')], remaining());
-    const network = Object.freeze({ name, proxyContainer, proxyUrl: 'http://codeboost-proxy:3128', vendor });
-    identities.set(network, Object.freeze({ allocationId, imageId, invocation, subnet }));
+    const proxyInspect = JSON.parse(docker(['container', 'inspect', proxyContainer], remaining()))[0] as
+      { NetworkSettings?: { Networks?: Record<string, { IPAddress?: string }> } } | undefined;
+    const proxyIp = proxyInspect?.NetworkSettings?.Networks?.[name]?.IPAddress;
+    if (!proxyIp || !/^10\.254\.\d{1,3}\.\d{1,3}$/.test(proxyIp))
+      throw new Error('Vendor proxy did not receive its expected internal address.');
+    const network = Object.freeze({ name, proxyContainer, proxyUrl: `http://${proxyIp}:3128`, vendor });
+    identities.set(network, Object.freeze({ allocationId, imageId, invocation, subnet, proxyIp }));
     validateVendorNetwork(network, invocation, undefined, remaining);
     remaining();
     return network;
 
@@ -296,6 +296,11 @@ describe('real Docker agent isolation', () => {
     expect(state.State.Status).toBe('created');
     docker('rm', '--force', valid.name); containers.delete(valid.name);
 
+    const dnsArgs = valid.args.map(value => value === '--dns=127.0.0.1' ? '--dns=8.8.8.8' : value);
+    docker(...dnsArgs); containers.add(valid.name);
+    expect(() => validateContainer(valid.name, valid)).toThrow('DNS configuration');
+    docker('rm', '--force', valid.name); containers.delete(valid.name);
+
     const imageIndex = valid.args.indexOf(imageId);
     const namespaceArgs = [...valid.args.slice(0, imageIndex), '--uts=host', ...valid.args.slice(imageIndex)];
     docker(...namespaceArgs); containers.add(valid.name);
@@ -336,7 +341,7 @@ describe('real Docker agent isolation', () => {
     expect(() => prepareTaskFilesystems({ ...data.clone }, {
       workBytes: 1024, workInodes: 16, metadataBytes: 1024, metadataInodes: 16,
     }, imageId)).toThrow('trusted clone builder');
-  });
+  }, 60_000);
 
   if (process.env.CODEBOOST_RUN_AUTH_PROBES === '1') {
     it('runs the authenticated Codex startup path with isolated writable state', () => {
 
@@ -49,6 +49,16 @@ describe('vendor-only egress', () => {
     expect(direct.stdout).toBe('000');
   }, 60_000);
 
+  it('does not forward arbitrary DNS even when the embedded resolver is addressed directly', () => {
+    const result = spawnSync('docker', ['run', '--rm', `--network=${network.name}`, '--dns=127.0.0.1',
+      '--entrypoint', 'node', imageId, '-e', [
+        "const dns=require('node:dns');dns.setServers(['127.0.0.11']);",
+        "dns.resolve4('example.com',(error)=>process.exit(error?0:1));",
+        'setTimeout(()=>process.exit(0),3000);',
+      ].join('')], { encoding: 'utf8', timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] });
+    expect(result.status).toBe(0);
+  }, 30_000);
+
   it('rejects a copied network capability', () => {
     expect(() => createVendorNetwork(invocation, imageId, 0)).toThrow('positive integer');
     expect(() => assertVendorNetwork(network, invocation, undefined, 0)).toThrow('positive integer');
@@ -75,7 +85,10 @@ describe('vendor-only egress', () => {
     }
   }, 60_000);
 
-  it('rejects a proxy replaced with a host namespace before launch', () => {
+  it.each([
+    ['host namespace', ['--pid=host']],
+    ['extra Node environment', ['--env', 'NODE_OPTIONS=--trace-warnings']],
+  ] as const)('rejects a proxy replaced with %s before launch', (_label, extra) => {
     const replacementInvocation = captureInvocation({ ...invocation, attemptId: 'mutated-proxy-probe',
       deadline: Date.now() + 60_000 });
     const replacement = createVendorNetwork(replacementInvocation, imageId);
@@ -86,7 +99,7 @@ describe('vendor-only egress', () => {
       docker('rm', '--force', replacement.proxyContainer);
       docker('run', '--detach', '--name', replacement.proxyContainer, '--read-only', '--user', '10001:10001',
         '--cap-drop=ALL', '--security-opt=no-new-privileges', '--pids-limit=64', '--memory=64m', '--memory-swap=64m',
-        '--cpus=.25', '--pid=host', '--network', replacement.name, '--network-alias', 'codeboost-proxy',
+        '--cpus=.25', ...extra, '--network', replacement.name, '--network-alias', 'codeboost-proxy',
         '--label', `io.codeboost.egress=${allocation}`, '--env', `CODEBOOST_ALLOWED_HOSTS=${VENDOR_HOSTS.claude.join(',')}`,
         '--entrypoint', 'node', imageId, '/usr/local/lib/codeboost-egress-proxy.mjs');
       docker('network', 'connect', 'bridge', replacement.proxyContainer);
 
@@ -7,8 +7,8 @@ import { ReviewService } from '../runner/review.ts';
 import { Questions } from '../runner/questions.ts';
 import { choiceKeys } from '../core/approvals.ts';
 import { agentArguments } from '../runner/question-agent.ts';
-// Real-Git context reads match the existing review integration suite budget.
-vi.setConfig({testTimeout:15000});
+// Real-Git context reads can overlap the Docker-backed isolation suite in a full run.
+vi.setConfig({testTimeout:30000});
 const roots:string[]=[], services:ReviewService[]=[], managers:Questions[]=[];
 afterEach(async()=>{for(const manager of managers.splice(0))await manager.close();services.splice(0).forEach(s=>s.close());roots.splice(0).forEach(root=>rmSync(root,{recursive:true,force:true}));vi.restoreAllMocks();});
 function waitForAbort(_prompt:string,signal:AbortSignal):Promise<string>{return new Promise((_,reject)=>signal.addEventListener('abort',()=>reject(signal.reason),{once:true}));}