[deep-report] Harden AWF firewall: enforce proxy/iptables on safe-outputs container to block docker exec escape

[github-actions]

Description
Firewall escape testing confirmed that docker exec into the safe-outputs node:lts-alpine container allows unrestricted outbound access (example.com/google.com), bypassing AWF firewall rules. Apply proxy env vars and firewall rules to sibling containers (safe-outputs/MCP) or segment networks to ensure all containers enforce the same egress policy.

Expected Impact
Closes a critical firewall bypass vector and restores network policy enforcement across all AWF containers.

Suggested Agent
The Great Escapi or Workflow Health Manager

Estimated Effort
Medium (1-4 hours)

Data Source
DeepReport Intelligence Briefing 2026-01-16 (run 21071073449); discussion #10180

AI generated by DeepReport - Intelligence Gathering Agent