Dev servers, databases and Docker

Read this when

The agent runs a dev server, talks to a local database, or uses Docker.

Services on your machine can do a lot: the Docker daemon can start a container with your home folder mounted, a database holds real data, and cloud tools run local control APIs. OpenMoat does not allow them by default, but does not block them either: they go to your agent’s own prompt.

Command	Answer
npm run dev	allow: a project script
curl http://localhost:3000/health	defer: local-net, your agent asks
psql -h localhost -U app mydb	defer
docker compose up -d, docker run --rm -p 8080:80 nginx	defer
docker build .	allow
docker build --network host ., --secret, --ssh	ask: docker-secrets
curl http://169.254.169.254/	deny: the cloud metadata service hands out credentials

Stop the prompts

These calls are your agent’s own prompts, so the agent’s own “always allow” answer works for them, in that agent.

To allow a command for every agent at once, allow it in OpenMoat, in your own terminal:

moat allow "docker compose up -d" --always

What this opens

• That command runs without any prompt, also with extra arguments added at the end

What stays protected

• Other Docker commands still go to your agent's prompt

Think about

• A command rule covers the command, not a host it connects to: curl http://localhost:3000 keeps asking for localhost even after you allow the command
• Extra arguments are allowed too, so allow the shortest form that is safe with anything after it

Why not allow all of localhost?

moat allow --site localhost only lets the network part through; the command itself still goes to the prompt, and every local port (the Docker API among them) would be open to commands you allow. Allowing single commands is the safer way.