Document what hosts are allowed by Copilot coding agent's recommended firewall allowlist (#58187)

Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

content/copilot/how-tos/use-copilot-agents/coding-agent/customize-the-agent-firewall.md

@@ -41,7 +41,7 @@ The agent firewall has important limitations that affect its security coverage.
 
 These limitations mean that the firewall provides a layer of protection for common scenarios, but should not be considered a comprehensive security solution.
 
-## Managing the recommended firewall allowlist
+## Understanding the recommended firewall allowlist
 
 The recommended allowlist, enabled by default, allows access to:
 
@@ -51,7 +51,11 @@ The recommended allowlist, enabled by default, allows access to:
 * Common certificate authorities (to allow SSL certificates to be validated).
 * Hosts used to download web browsers for the Playwright MCP server.
 
-You can choose to turn off the recommended allowlist.
+For the complete list of hosts included in the recommended allowlist, see [AUTOTITLE](/copilot/reference/copilot-allowlist-reference#copilot-coding-agent-recommended-allowlist).
+
+## Disabling the recommended allowlist
+
+You can choose to turn off the recommended allowlist. Disabling the recommended allowlist is likely to increase the risk of unauthorized access to external resources.
 
 {% data reusables.repositories.navigate-to-repo %}
 {% data reusables.repositories.sidebar-settings %}

content/copilot/reference/copilot-allowlist-reference.md

@@ -42,6 +42,352 @@ Depending on the security policies and editors your organization uses, you may n
 
 Every user of the proxy server or firewall also needs to configure their own environment to connect to {% data variables.product.prodname_copilot_short %}. See [AUTOTITLE](/copilot/configuring-github-copilot/configuring-network-settings-for-github-copilot).
 
+## {% data variables.copilot.copilot_coding_agent %} recommended allowlist
+
+The {% data variables.copilot.copilot_coding_agent %} includes a built-in firewall with a recommended allowlist that is enabled by default. The recommended allowlist allows access to:
+
+* Common operating system package repositories (for example, Debian, Ubuntu, Red Hat).
+* Common container registries (for example, Docker Hub, Azure Container Registry, AWS Elastic Container Registry).
+* Packages registries used by popular programming languages (C#, Dart, Go, Haskell, Java, JavaScript, Perl, PHP, Python, Ruby, Rust, Swift).
+* Common certificate authorities (to allow SSL certificates to be validated).
+* Hosts used to download web browsers for the Playwright MCP server.
+
+For more information about configuring the {% data variables.copilot.copilot_coding_agent %} firewall, see [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/customize-the-agent-firewall).
+
+The allowlist allows access to the following hosts:
+
+### Azure Infrastructure: Metadata Service
+
+* `168.63.129.16`
+
+### Certificate Authorities: DigiCert
+
+* `crl3.digicert.com`
+* `crl4.digicert.com`
+* `ocsp.digicert.com`
+
+### Certificate Authorities: Symantec
+
+* `ts-crl.ws.symantec.com`
+* `ts-ocsp.ws.symantec.com`
+* `s.symcb.com`
+* `s.symcd.com`
+
+### Certificate Authorities: GeoTrust
+
+* `crl.geotrust.com`
+* `ocsp.geotrust.com`
+
+### Certificate Authorities: Thawte
+
+* `crl.thawte.com`
+* `ocsp.thawte.com`
+
+### Certificate Authorities: VeriSign
+
+* `crl.verisign.com`
+* `ocsp.verisign.com`
+
+### Certificate Authorities: GlobalSign
+
+* `crl.globalsign.com`
+* `ocsp.globalsign.com`
+
+### Certificate Authorities: SSL.com
+
+* `crls.ssl.com`
+* `ocsp.ssl.com`
+
+### Certificate Authorities: IdenTrust
+
+* `crl.identrust.com`
+* `ocsp.identrust.com`
+
+### Certificate Authorities: Sectigo
+
+* `crl.sectigo.com`
+* `ocsp.sectigo.com`
+
+### Certificate Authorities: UserTrust
+
+* `crl.usertrust.com`
+* `ocsp.usertrust.com`
+
+### Container Registries: Docker
+
+* `172.18.0.1`
+* `ghcr.io`
+* `registry.hub.docker.com`
+* `*.docker.io`
+* `*.docker.com`
+* `production.cloudflare.docker.com`
+* `auth.docker.io`
+* `quay.io`
+* `mcr.microsoft.com`
+* `gcr.io`
+* `public.ecr.aws`
+
+### GitHub: Content & API
+
+* `*.githubusercontent.com`
+* `raw.githubusercontent.com`
+* `objects.githubusercontent.com`
+* `lfs.github.com`
+* `github-cloud.githubusercontent.com`
+* `github-cloud.s3.amazonaws.com`
+* `codeload.github.com`
+* `scanning-api.github.com`
+* `api.mcp.github.com`
+* `uploads.github.com/copilot/chat/attachments/`
+
+### GitHub: Actions Artifact Storage
+
+* `productionresultssa0.blob.core.windows.net`
+* `productionresultssa1.blob.core.windows.net`
+* `productionresultssa2.blob.core.windows.net`
+* `productionresultssa3.blob.core.windows.net`
+* `productionresultssa4.blob.core.windows.net`
+* `productionresultssa5.blob.core.windows.net`
+* `productionresultssa6.blob.core.windows.net`
+* `productionresultssa7.blob.core.windows.net`
+* `productionresultssa8.blob.core.windows.net`
+* `productionresultssa9.blob.core.windows.net`
+* `productionresultssa10.blob.core.windows.net`
+* `productionresultssa11.blob.core.windows.net`
+* `productionresultssa12.blob.core.windows.net`
+* `productionresultssa13.blob.core.windows.net`
+* `productionresultssa14.blob.core.windows.net`
+* `productionresultssa15.blob.core.windows.net`
+* `productionresultssa16.blob.core.windows.net`
+* `productionresultssa17.blob.core.windows.net`
+* `productionresultssa18.blob.core.windows.net`
+* `productionresultssa19.blob.core.windows.net`
+
+### Programming Languages & Package Managers: C# / .NET
+
+* `nuget.org`
+* `dist.nuget.org`
+* `api.nuget.org`
+* `nuget.pkg.github.com`
+* `dotnet.microsoft.com`
+* `pkgs.dev.azure.com`
+* `builds.dotnet.microsoft.com`
+* `dotnetcli.blob.core.windows.net`
+* `nugetregistryv2prod.blob.core.windows.net`
+* `azuresearch-usnc.nuget.org`
+* `azuresearch-ussc.nuget.org`
+* `dc.services.visualstudio.com`
+* `dot.net`
+* `download.visualstudio.microsoft.com`
+* `dotnetcli.azureedge.net`
+* `ci.dot.net`
+* `www.microsoft.com`
+* `oneocsp.microsoft.com`
+* `www.microsoft.com/pkiops/crl/`
+
+### Programming Languages & Package Managers: Dart
+
+* `pub.dev`
+* `pub.dartlang.org`
+* `storage.googleapis.com/pub-packages/`
+* `storage.googleapis.com/dart-archive/`
+
+### Programming Languages & Package Managers: Go
+
+* `go.dev`
+* `golang.org`
+* `proxy.golang.org`
+* `sum.golang.org`
+* `pkg.go.dev`
+* `goproxy.io`
+* `storage.googleapis.com/proxy-golang-org-prod/`
+
+### Programming Languages & Package Managers: Haskell
+
+* `haskell.org`
+* `*.hackage.haskell.org`
+* `get-ghcup.haskell.org`
+* `downloads.haskell.org`
+
+### Programming Languages & Package Managers: Java
+
+* `www.java.com`
+* `jdk.java.net`
+* `api.adoptium.net`
+* `adoptium.net`
+* `search.maven.org`
+* `maven.apache.org`
+* `repo.maven.apache.org`
+* `repo1.maven.org`
+* `maven.pkg.github.com`
+* `maven-central.storage-download.googleapis.com`
+* `maven.google.com`
+* `maven.oracle.com`
+* `jcenter.bintray.com`
+* `oss.sonatype.org`
+* `repo.spring.io`
+* `gradle.org`
+* `services.gradle.org`
+* `plugins.gradle.org`
+* `plugins-artifacts.gradle.org`
+* `repo.grails.org`
+* `download.eclipse.org`
+* `download.oracle.com`
+
+### Programming Languages & Package Managers: Node.js / JavaScript
+
+* `npmjs.org`
+* `npmjs.com`
+* `registry.npmjs.com`
+* `registry.npmjs.org`
+* `skimdb.npmjs.com`
+* `npm.pkg.github.com`
+* `api.npms.io`
+* `nodejs.org`
+* `yarnpkg.com`
+* `registry.yarnpkg.com`
+* `repo.yarnpkg.com`
+* `deb.nodesource.com`
+* `get.pnpm.io`
+* `bun.sh`
+* `deno.land`
+* `registry.bower.io`
+* `binaries.prisma.sh`
+
+### Programming Languages & Package Managers: Perl
+
+* `cpan.org`
+* `www.cpan.org`
+* `metacpan.org`
+* `cpan.metacpan.org`
+
+### Programming Languages & Package Managers: PHP
+
+* `repo.packagist.org`
+* `packagist.org`
+* `getcomposer.org`
+
+### Programming Languages & Package Managers: Python
+
+* `pypi.python.org`
+* `pypi.org`
+* `pip.pypa.io`
+* `*.pythonhosted.org`
+* `files.pythonhosted.org`
+* `bootstrap.pypa.io`
+* `conda.binstar.org`
+* `conda.anaconda.org`
+* `binstar.org`
+* `anaconda.org`
+* `download.pytorch.org`
+* `repo.continuum.io`
+* `repo.anaconda.com`
+
+### Programming Languages & Package Managers: Ruby
+
+* `rubygems.org`
+* `api.rubygems.org`
+* `rubygems.pkg.github.com`
+* `bundler.rubygems.org`
+* `gems.rubyforge.org`
+* `gems.rubyonrails.org`
+* `index.rubygems.org`
+* `cache.ruby-lang.org`
+* `*.rvm.io`
+
+### Programming Languages & Package Managers: Rust
+
+* `crates.io`
+* `index.crates.io`
+* `static.crates.io`
+* `sh.rustup.rs`
+* `static.rust-lang.org`
+
+### Programming Languages & Package Managers: Swift
+
+* `download.swift.org`
+* `swift.org`
+* `cocoapods.org`
+* `cdn.cocoapods.org`
+
+### Infrastructure & Tools: HashiCorp
+
+* `releases.hashicorp.com`
+* `apt.releases.hashicorp.com`
+* `yum.releases.hashicorp.com`
+* `registry.terraform.io`
+
+### Infrastructure & Tools: JSON Schema
+
+* `json-schema.org`
+* `json.schemastore.org`
+
+### Infrastructure & Tools: Playwright
+
+* `playwright.download.prss.microsoft.com`
+* `cdn.playwright.dev`
+* `playwright.azureedge.net`
+* `playwright-akamai.azureedge.net`
+* `playwright-verizon.azureedge.net`
+
+### Linux Package Managers: Ubuntu
+
+* `archive.ubuntu.com`
+* `security.ubuntu.com`
+* `ppa.launchpad.net`
+* `keyserver.ubuntu.com`
+* `azure.archive.ubuntu.com`
+* `api.snapcraft.io`
+
+### Linux Package Managers: Debian
+
+* `deb.debian.org`
+* `security.debian.org`
+* `keyring.debian.org`
+* `packages.debian.org`
+* `debian.map.fastlydns.net`
+* `apt.llvm.org`
+
+### Linux Package Managers: Fedora
+
+* `dl.fedoraproject.org`
+* `mirrors.fedoraproject.org`
+* `download.fedoraproject.org`
+
+### Linux Package Managers: CentOS
+
+* `mirror.centos.org`
+* `vault.centos.org`
+
+### Linux Package Managers: Alpine
+
+* `dl-cdn.alpinelinux.org`
+* `pkg.alpinelinux.org`
+
+### Linux Package Managers: Arch
+
+* `mirror.archlinux.org`
+* `archlinux.org`
+
+### Linux Package Managers: SUSE
+
+* `download.opensuse.org`
+
+### Linux Package Managers: Red Hat
+
+* `cdn.redhat.com`
+
+### Linux Package Managers: Common Package Sources
+
+* `packagecloud.io`
+* `packages.cloud.google.com`
+* `packages.microsoft.com`
+
+### Other
+
+* `dl.k8s.io`
+* `pkgs.k8s.io`
+
 ## Further reading
 
 * [Network Connections in {% data variables.product.prodname_vscode %}](https://code.visualstudio.com/docs/setup/network) in the {% data variables.product.prodname_vs %} documentation