PyData · Published 2026-08-25

Building Secure Environments for CLI Code Agents [PyCon DE & PyData 2026]

privateReview: unreviewedConfidence: high
agentssecuritycontainersproxyObservabilityagent securitycontainer isolationMITM proxytoken usagecli agentsPrompt injectionleast privilege
Open on YouTube ↗

Summary

Overview

  • Speaker: Harald Nezbeda
  • Channel: PyData
  • Main topic: Securing and observing CLI-based LLM code agents using container isolation, proxies, and centralized logging.
  • Purpose: To explain the security vulnerabilities of running AI coding agents directly on developer machines and to demonstrate an architectural pattern and tool (VibePod) for isolating and monitoring them. Harald Nezbeda discusses the security risks introduced by CLI-based AI coding agents (such as Claude Code, Codex CLI, Gemini CLI) running directly on developer machines with unprivileged or inherited user access. He presents VibePod, an open-source tool and architecture implementing runtime container isolation, scoped workspace mounting, dedicated credential volumes, and a man-in-the-middle proxy for full traffic and token consumption observability.

Topic Map

Introduction and Evolution to Code Agents

  • Explanation: Overview of Harald Nezbeda's background and the historical transition from transformer-based language models to chat interfaces and finally to tool-using, agentic coding tools.
  • Key claims:
    • LLMs have evolved from text-in/text-out transformers to conversational chat interfaces and now to tool-using agents capable of executing shell commands, reading files, and calling APIs.
    • Assistant mode is mostly informational, while agent mode can execute shell commands, edit files, and make network requests.
  • Examples:
    • Claude Code, Codex CLI, Gemini CLI, OpenCode
  • Terminology:
    • CLI coding agent
    • Transformer architecture
    • Tool use
    • Function calling
  • Why it matters: Understanding the agent era highlights the critical shift from passive text generation to active execution of system-level commands with user permissions.

The Lethal Trifecta and Risk Scenarios

  • Explanation: Examination of Simon Willison's 'Lethal Trifecta' concept where private data, external access, and untrusted content combine to create high-risk scenarios.
  • Key claims:
    • CLI coding agents inherit user permissions without a sandbox.
    • Accidental data exfiltration, overzealous cleanup (deleting .git or home directories), and supply chain package attacks are real risks observed in practice.
  • Examples:
    • Agent accidentally exfiltrating local environment files via curl to an analytics endpoint.
    • Agent running rm -rf on home directory or git history.
    • Agent installing malicious npm packages or cryptominers from untrusted documentation.
  • Terminology:
    • Lethal Trifecta
    • Data exfiltration
    • Supply chain attack
    • Prompt injection
  • Why it matters: Demonstrates why running un-sandboxed coding agents on production machines poses severe security and data integrity threats.

Isolation Pattern and Reference Architecture

  • Explanation: Introduction of the isolation pattern (cloud-container / VibePod) designed to run agents in isolated containers with scoped workspace mounting and traffic inspection via a proxy.
  • Key claims:
    • Security must be architectural, not aspirational.
    • Isolate runtime in a container, scope access to active workspace and dedicated credential volumes, and observe behavior via a logging proxy.
  • Examples:
    • Using a man-in-the-middle proxy container to intercept and log all outbound traffic and token consumption.
  • Terminology:
    • Container isolation
    • Man-in-the-middle proxy
    • Scoped workspace
    • SQLite logs
  • Why it matters: Provides a robust, reproducible architecture to limit blast radius and maintain visibility when things go wrong.

VibePod CLI and Live Demonstration

  • Explanation: Demonstration of the VibePod CLI tool (vp) running Claude Code inside an isolated container, managing tasks, and reviewing telemetry and logs using Datasette.
  • Key claims:
    • VibePod provides a unified CLI and workflow across multiple AI coding agents while maintaining consistent runtime isolation.
    • HTTP proxy logs and token usage metrics can be inspected via Datasette dashboards.
  • Examples:
    • Running vp run claude, checking vp list, and viewing HTTP proxy requests and token usage dashboards.
  • Terminology:
    • VibePod
    • Datasette
    • Token consumption
    • Dangerous permissions mode
  • Why it matters: Shows practical application of containerized agent workflows and local observability in real time.

Key Points

Agents inherit user permissions

  • Explanation: CLI agents run with the full privileges of the user executing them, meaning no sandbox and no undo when destructive commands are issued.
  • Evidence: GitHub issues and Reddit incident reports detailing accidental home directory and git repository deletions.
  • Practical implication: Running agents directly on host machines is dangerous; runtime isolation is mandatory.

The Lethal Trifecta

  • Explanation: When an agent has access to private data, external network access, and processes untrusted content, the system is in extreme danger.
  • Evidence: Prompt injection combined with tool use leading to exfiltration or unauthorized installations.
  • Practical implication: Network and file system boundaries must be strictly enforced.

Security by Architecture

  • Explanation: Isolate the runtime, scope access to only the active workspace and credentials, and route API traffic through a logging proxy.
  • Evidence: Reference architecture using Docker containers, SQLite logging, and a man-in-the-middle proxy.
  • Practical implication: Reduces blast radius and ensures full auditability of agent actions.

Honest limits of containerization

  • Explanation: Containers reduce blast radius and improve observability, but they do not eliminate prompt-injection risks or misconfigured mount vulnerabilities.
  • Evidence: Misconfigured mounts can still expose host credentials, and prompt injection can still trigger local container-level attacks.
  • Practical implication: Human review and CI policies remain mandatory alongside architectural security.

Frameworks, Models & Processes

VibePod Architecture

  • How it works: Runs coding agents inside isolated Docker containers, mounting only the specific project workspace and dedicated credential volumes, while routing all outbound traffic through an intercepting proxy connected to a local SQLite database for logging and telemetry.
  • Components:
    • Agent Container
    • Project Workspace Volume
    • Dedicated Credential Volume
    • MITM Proxy
    • Datasette / SQLite Logs Dashboard
  • When to use: When running CLI-based AI coding agents that require file access, command execution, and network connectivity without exposing the host system.

Examples & Case Studies

Claude CLI users reported accidental deletion of their entire home directory due to unsafe rm commands executed by the agent.

  • Illustrates: The danger of running high-privilege code agents without sandboxing or workspace boundaries.
  • Lesson: Always isolate agent execution and restrict working directory permissions to prevent destructive host-level actions.

An agent reading external package documentation decided to install a malicious npm package containing a crypto-miner.

  • Illustrates: Supply chain vulnerabilities via untrusted content and tool use.
  • Lesson: Containerization limits the damage of malicious packages to the isolated container environment rather than affecting the host machine.

Actionable Takeaways

  • Immediate:
    • Isolate agent execution from the host machine using containers.
    • Apply the principle of least privilege to files, network access, and credentials.
    • Enable logging and traffic observability from day one.
  • Strategic:
    • Adopt architectural security over relying solely on user discipline.
    • Standardize agent workflows and telemetry across different coding agents using unified tooling like VibePod.
    • Maintain mandatory human review and strict CI policies.
  • Questions to investigate:
    • How to better support approval and denial workflows for outbound network requests within proxy layers?
    • How to integrate containerized CLI code agents with existing Kubernetes or advanced runtime environments?

Claims Worth Verifying

  • Claude CLI and other CLI agents have caused multiple reported user incidents involving accidental deletion of home directories. (empirical)
  • Routing all outbound agent traffic through a man-in-the-middle proxy enables complete capture of token consumption and API requests. (technical)

Notable Quotes

"Agents have the same access you do. No sandbox. No undo." (at 6:57) "Safety must be architectural, not aspirational." (at 10:46) "When the agent fails, failure is contained." (at 14:06) "Security posture equals architecture plus operations plus discipline." (at 32:36)

Compressed Summary

  • CLI code agents execute shell commands and file operations with user privileges, creating severe security risks.
  • The 'Lethal Trifecta' combines private data, external access, and untrusted content.
  • VibePod provides container runtime isolation, scoped workspace mounting, and MITM proxy traffic observability.
  • Containers reduce blast radius and improve auditing, but human review and discipline remain necessary.
  • Keywords: agents, security, containers, proxy, observability
  • Core insight: Securing CLI code agents requires shifting from aspirational safety to architectural isolation, least privilege, and local traffic observability.

Core insights

6
Architecturemedium noveltystrong evidence

CLI coding agents are no longer passive text processors: in agent mode they execute shell commands, edit files, and make network requests, yet they inherit the user's full permissions with no sandbox and no undo. Security for agent runtimes therefore has to be architectural (container, scoped mounts, proxy) rather than aspirational policy.

Why it matters

Execution privilege is the whole safety boundary: any coding agent can run destructive commands or exfiltrate data, so the boundary must be designed into the runtime rather than being left to the agent's good behavior.

Generalization

Any system that gives an LLM tool execution on a user's machine should treat the runtime as untrusted and separate it from the host and from ambient credentials.

CLI agents run with the full privileges of the user executing them, meaning no sandbox and no undo when destructive commands are issued.
Open source video
Security must be architectural, not aspirational.
Open source video
Mechanismhigh noveltystrong evidence

A man-in-the-middle proxy container placed in the agent's network path turns every outbound agent API request into an auditable artifact: request traffic and token consumption are logged to SQLite and inspected through Datasette. This gives operations a network-level trace of what the agent actually sent and received, independent of the agent tool's own logs.

Why it matters

Without such a proxy, agent actions and especially token spend are only visible through vendor UIs or the agent's own logs; with it, every request, body, and cost metric becomes a queryable local record.

Generalization

Routing an untrusted subsystem's outbound traffic through a logging proxy is a non-invasive way to make any externally calling agent auditable.

Using a man-in-the-middle proxy container to intercept and log all outbound traffic and token consumption.
Open source video
HTTP proxy logs and token usage metrics can be inspected via Datasette dashboards.
Open source video
Mental Modelmedium noveltystrong evidence

The 'Lethal Trifecta' is a risk model for agent systems: the system is in extreme danger when an agent simultaneously has access to private data, has external network access, and processes untrusted content. Prompt injection plus tool use turns untrusted content from an input into an active threat vector.

Why it matters

It gives a concrete checklist: remove or strictly bound at least one of the three elements (private data access, external access, untrusted content) to break the most dangerous agent failure scenarios.

Generalization

For any LLM-integrated software, untrusted documents should not share a session with private files and a live network-call mechanism unless those three paths are individually scoped and observed.

When an agent has access to private data, external network access, and processes untrusted content, the system is in extreme danger.
Open source video
Tradeoffmedium noveltystrong evidence

Container isolation is a blast-radius control, not a complete security boundary: it reduces host-level damage and improves observability, but it does not eliminate prompt-injection risks or vulnerabilities from misconfigured mounts, which can still expose host credentials. Human review and CI policy gates remain part of the security control loop.

Why it matters

Teams may over-trust container sandboxing and drop human oversight; the remaining risks are inside the container and at the mount-configuration layer.

Generalization

The last line of defense for LLM execution should remain formal human or CI review, because prompt injection can still trigger harmful actions inside the isolated runtime.

Containers reduce blast radius and improve observability, but they do not eliminate prompt-injection risks or misconfigured mount vulnerabilities.
Open source video
Human review and CI policies remain mandatory alongside architectural security.
Open source video
Architecturemedium noveltystrong evidence

Instead of granting the agent the developer's whole filesystem, the reference architecture mounts only the active project workspace and dedicated credential volumes. This gives the agent the data and secrets it needs for the task without inheriting ambient home-directory files or ambient host credentials.

Why it matters

Scoping file access at the mount level is what prevents both accidental data exfiltration of unrelated local files and catastrophic deletion of the user's home directory by a single rm command.

Generalization

Least privilege for agent context means providing only the workspace and credential set required, with separate volumes for code, credentials, and logs.

runtime container isolation, scoped workspace mounting, dedicated credential volumes
Open source video
mounting only the specific project workspace and dedicated credential volumes
Open source video
Empirical Resultmedium noveltymoderate evidence

Severe agent failures are not hypothetical: public reports document agents deleting home directories and .git histories, and an agent reading external package documentation decided to install a malicious npm package containing a crypto-miner. These occur through ordinary, plausible CLI agent workflows on un-isolated machines.

Why it matters

Sandboxing decisions should be justified by observed incidents, and the incidents show that tail-risk actions (destructive filesystem commands and supply chain installs) become likely enough to occur in the field.

Generalization

Once a model is given shell and filesystem tools, high-impact accidental actions become a practical concern on everyday tasks, not just an adversarial-research worry.

GitHub issues and Reddit incident reports detailing accidental home directory and git repository deletions.
Open source video
An agent reading external package documentation decided to install a malicious npm package containing a crypto-miner.
Open source video

Deep dives

4

Checking where to place the human approval gate

Research question

Which approval checkpoint placement—before destructive commands, after a proposed plan, or only on anomalous proxy events—best trades off task autonomy and failure prevention for containerized code agents?

Why

Prompt injection can trigger destructive actions inside the container, but per-command permission requests can destroy agent usefulness, so the checkpoint location remains the key open design variable.

Human review and CI policies remain mandatory alongside architectural security.
Open source video
Security must be architectural, not aspirational.
Open source video
Source video

Network egress policy for coding agents

Research question

What combination of domain allowlists and deny rules stops curl-to-analytics exfiltration without breaking package installation and API calls that coding agents depend on?

Why

The Lethal Trifecta is present by construction in coding agents, and proxy telemetry alone provides no automated enforcement of network access.

Network and file system boundaries must be strictly enforced.
Open source video
Using a man-in-the-middle proxy container to intercept and log all outbound traffic and token consumption.
Open source video
Agent accidentally exfiltrating local environment files via curl to an analytics endpoint.
Open source video
Source video

Automated anomaly detection over agent proxy logs

Research question

Which log features—destination domain, payload shape, file-like content flags, token burn rate—most reliably separate prompt-injection exfiltration from benign coding traffic?

Why

The current architecture collects rich logs but leaves review as post-hoc forensics; moving to triage requires identifying predictive signals in those logs.

HTTP proxy logs and token usage metrics can be inspected via Datasette dashboards.
Open source video
Agent accidentally exfiltrating local environment files via curl to an analytics endpoint.
Open source video
Source video

Container mount misconfigurations that leak host credentials

Research question

Which host paths, volume binds, or Docker-socket passes reintroduce host credential exposure inside a supposedly isolated agent container?

Why

Mount misconfiguration is a named residual risk of container isolation; teams need a concrete testing methodology before trusting mount templates.

Containers reduce blast radius and improve observability, but they do not eliminate prompt-injection risks or misconfigured mount vulnerabilities.
Open source video
Source video

Article ideas

4

Your coding agent should never see your home directory

Code agents should be confined to an explicitly mounted workspace because ambient access to the whole file system is what turns an odd prompt or malicious document into a catastrophic deletion or data leak.

Angle

A practical security default for developers and engineering leads, grounded in mount-scoping architecture rather than policy warnings.

Source video

Why agent observability belongs at the network layer

Transcripts show what the agent intended to do, but only a MITM proxy log shows what bytes actually left the machine, so a robust agent security posture must treat the outbound network path as a source of truth.

Angle

An operator's argument for instrumenting the request path instead of relying on tool reports or vendor dashboards.

Source video

Containers are not a security boundary for agentic AI

Container isolation shrinks blast radius but leaves prompt injection active inside the pod and host credentials exposed through misconfigured mounts, so teams should treat containers as a control layer, not as clearance to remove human and CI gates.

Angle

A corrective argument against over-trusting container sandboxes in agent deployments.

Source video

Audit your code agent stack against the Lethal Trifecta

Any agent setup that simultaneously combines private data, external network access, and untrusted content is dangerous by construction; teams should use the Lethal Trifecta as the first design-review gate for every new agent integration.

Angle

A security-design checklist drawn from the reported failure modes of code agents.

Source video

Project ideas

4

ExfilShield

gatehouse

When a coding agent's network is routed through an allowlist MITM proxy configured to permit only package registries and needed API hosts, planted exfiltration attempts are blocked in at least 90% of trials, while task success on a standard package-install/API benchmark drops less than 10% relative to unrestricted access.

Proof of concept

Wrap the VibePod proxy with a programmable domain allowlist for npm/PyPI/GitHub and worker-mandated API endpoints, then run a benchmark of coding tasks and inject deliberate curl-to-analytics exfiltration prompts.

Measurement

Exfiltration block rate, task success rate, and number of user approvals needed on the benchmark corpus.

Source video

AgentApprovalLab

movement-lab

A plan-level human approval gate in a containerized CLI agent yields the same catastrophic-incident rate as a per-command gate while increasing task completion by at least 25% and reducing per-task interruptions by more than 60%.

Proof of concept

Extend the VibePod wrapper to support three gate modes—no gate, per-command allow/deny, plan-level approve, and anomaly-alert-only—then execute a task suite seeded with dangerous commands in each mode.

Measurement

Safety incident rate, task completion score, interruptions per task, and wall-clock overhead.

Source video

MountAudit

gatehouse

A static scanner over container run configurations can detect every vulnerable mount that allows host credential disclosure across a curated red-team corpus without flagging safe workspace and credential-volume patterns.

Proof of concept

Build a configuration scanner for run commands and reference templates; create a corpus of 20 vulnerable and 20 safe mount configurations; validate that an agent inside a vulnerable container can read host environment and key files.

Measurement

Detection precision and recall on the vulnerable/safe corpus, plus time-to-detection per configuration.

Source video

DataExfilDetector

beyond-evals

Features derived from MITM proxy logs—request destination, payload size, file-like content flags, and token burn rate—can classify injected exfiltration sessions versus benign agent coding sessions with AUC greater than 0.9.

Proof of concept

Collect labeled SQLite proxy logs from benign coding sessions and prompt-injection sessions that instruct an agent to curl environment files; train a simple classifier and compare it with rule-based detection.

Measurement

AUC, precision at a fixed false-positive rate, and alert latency after the exfiltration attempt begins.

Source video

Architectural implications

4

Coding agents are currently executed directly under the developer's user account, so the agent's filesystem capabilities equal the developer's.

Before

A misbehaving or confused agent can modify or delete anything the host user can, including the home directory and git history.

After

Agent execution is moved into an isolated container that mounts only the active workspace and dedicated credential volumes.

Consequence

The host failure domain is reduced to the container boundary and the mounted volumes, making a catastrophic rm -rf on the home directory impossible.

Source video

Outbound agent traffic (API requests, package downloads, data uploads) is generally invisible or only visible through vendor-specific dashboards.

Before

There is no unified operational record of exactly which requests the agent made and how many tokens each run consumed.

After

All outbound traffic is routed through a local MITM proxy and written to SQLite, then browsed with Datasette.

Consequence

Every agent API call, payload, and token-consumption metric can be inspected after the fact and correlated with a specific run.

Source video

Each CLI agent (Claude Code, Codex CLI, Gemini CLI, OpenCode) has its own configuration, permission model, and safety behavior.

Before

A secure setup has to be reimplemented per tool and is easy to skip, leading to inconsistent security across agents.

After

A lightweight CLI wrapper (VibePod/vp) applies the same container isolation, workspace and credential volume scoping, and telemetry across all supported agents.

Consequence

Security posture and audit workflows become consistent regardless of which agent is used.

Source video

Agent observability currently focuses on textual transcripts or tool calls, not on the raw network perimeter.

Before

You can see what the model said it did, but not necessarily the exact bytes it sent externally.

After

The proxy records the actual outbound requests and responses, creating a separate, tamper-resistant (local log) source of truth.

Consequence

Detection of accidental data exfiltration and token waste can be done at the network layer, complementing agent-level trace logging.

Source video

Tradeoffs and failure modes

4

Container isolation as the agent sandbox

Benefit

Limits the blast radius of destructive agent commands and provides a reproducible environment plus better observability.

Cost or risk

It does not stop prompt-injection-triggered attacks inside the container, and a misconfigured mount can still expose host credentials.

Containers reduce blast radius and improve observability, but they do not eliminate prompt-injection risks or misconfigured mount vulnerabilities.
Open source video
Source video

MITM proxy for full network audit

Benefit

Captures every outbound request and token consumption, enabling post-hoc analysis in Datasette dashboards.

Cost or risk

Adds an infrastructure component in the request path that can fail or add latency; its logs are useful only if there is tooling to search and review them.

Using a man-in-the-middle proxy container to intercept and log all outbound traffic and token consumption.
Open source video
Source video

Strict network and filesystem boundary enforcement

Benefit

Breaks the Lethal Trifecta by removing or tightening one of the three dangerous conditions for agent incidents.

Cost or risk

Coding agents legitimately need network access for package docs and APIs; overly broad restrictions can impair the tasks that motivated agentic coding, so boundaries must be tuned rather than simply maximized.

Network and file system boundaries must be strictly enforced.
Open source video
Source video

Reliance on human review and CI policies

Benefit

Provides a final decision gate for actions that container isolation cannot make safe.

Cost or risk

Human review does not scale to every tool call or prompt, so deciding where to insert the gate (per command, per plan, or on anomalies) remains an open design problem.

Human review and CI policies remain mandatory alongside architectural security.
Open source video
Source video

Open questions

4

Given that human review remains mandatory, where should the approval checkpoint sit: before destructive commands, after a proposed plan, or only when an anomaly is detected in the proxy logs?

Why unresolved

Prompt injection can act anywhere inside a container, so a single approval point may miss actions, but requiring interactive approval on every tool call undermines agent autonomy.

Research direction

Prototype permission and approval models in containerized agent runtimes and measure trade-offs between agent task success and incident prevention.

Source video

Which network-egress restrictions (domain allowlists, deny rules for data-upload endpoints) can prevent the curl-to-analytics exfiltration pattern without breaking package installation and API workflows?

Why unresolved

The Lethal Trifecta shows that private-data access, external access, and untrusted content are typically all present by construction in coding agents, and the summary does not specify an egress policy.

Research direction

Measure agent task success under progressive egress restrictions, using the MITM proxy as both enforcement point and telemetry source.

Source video

What signals in MITM proxy logs (request destination, payload shape, token rate, file-like content in outgoing requests) are predictive of prompt injection or data exfiltration so that review becomes triage rather than post-hoc forensics?

Why unresolved

The described architecture captures logs, but no automated detection or alerting is described.

Research direction

Build a labeled dataset from SQLite proxy logs of benign versus malicious or injected agent sessions and train detectors for suspicious outbound traffic.

Source video

Can a scoped-workspace-plus-credential-volume model remain sufficient when coding tasks require broader system capabilities such as local daemons, docker-in-docker, or opening specific ports?

Why unresolved

The reference architecture addresses file and credential exposure, but common real-world tasks often need more than a static workspace, and the summary does not discuss those capability extensions.

Research direction

Enumerate the system capabilities required by common coding-agent tasks and map them to the smallest safe extension of container mounts, ports, and device access.

Source video

Key claims

7
factualVerification needed

CLI agents run with the full privileges of the user executing them, meaning no sandbox and no undo when destructive commands are issued.

Evidence

CLI agents run with the full privileges of the user executing them, meaning no sandbox and no undo when destructive commands are issued.

Question

Do the default installs of Claude Code, Codex CLI, and Gemini CLI truly provide no OS-level sandbox or filesystem undo?

Source video
factualVerification needed

Agent mode can execute shell commands, edit files, and make network requests.

Evidence

agent mode can execute shell commands, edit files, and make network requests.

Question

Can each of the mentioned CLI agents perform all three action classes in a standard installation?

Source video
causalVerification needed

Prompt injection combined with tool use can lead to data exfiltration or unauthorized package installations.

Evidence

Prompt injection combined with tool use leading to exfiltration or unauthorized installations.

Question

Are there documented reproductions or incident reports showing prompt injection causing a tool-using agent to exfiltrate data or install malicious packages?

Source video
factualVerification needed

Reported real-world agent incidents include accidental deletion of home directories and .git histories, as well as installation of a malicious npm package containing a crypto-miner.

Evidence

GitHub issues and Reddit incident reports detailing accidental home directory and git repository deletions. An agent reading external package documentation decided to install a malicious npm package containing a crypto-miner.

Question

Which specific GitHub issues or Reddit threads document these events and are they verifiable?

Source video
causalVerification needed

Container isolation reduces blast radius and improves observability but does not eliminate prompt-injection risks or misconfigured-mount vulnerabilities.

Evidence

Containers reduce blast radius and improve observability, but they do not eliminate prompt-injection risks or misconfigured mount vulnerabilities.

Question

Can a misconfigured mount be demonstrated to expose host credentials even when the agent runs inside a container?

Source video
opinionVerification not requested

Security for agent environments must be enforced by architecture, not aspirational policy.

Evidence

Security must be architectural, not aspirational.

Source video
comparativeVerification needed

A unified CLI wrapper (VibePod) can enforce consistent runtime isolation and telemetry across multiple AI coding agents.

Evidence

VibePod provides a unified CLI and workflow across multiple AI coding agents while maintaining consistent runtime isolation.

Question

Does VibePod actually abstract away per-agent differences in workspace mounting, credential handling, and proxy configuration in practice?

Source video

Connections

6