What is your CI job talking to?

Blacksmith describes a host-based network observability system for ephemeral, untrusted CI virtual machines that records outbound traffic by job and, where possible, by domain name to diagnose slow builds and support future egress controls. Because guest workloads may be hostile and must remain unchanged, the design operates entirely outside each VM at its host-side virtual network interface, using iptables only to redirect DNS traffic to a host proxy and eBPF programs attached through Linux TCX to count traffic in both directions with minimal overhead. The DNS proxy associates observed DNS answers with destination IPs, while isolated per-VM eBPF maps maintain cumulative counters for each IP, port, and protocol combination. Rather than generating per-packet events or performing many userspace map lookups, BPF iterator programs export compact map snapshots once per second, which are stored in ClickHouse with job, VM, destination, timing, and traffic data that can be correlated with CI steps. The system is designed with bounded resources and visible overflow reporting, but domain attribution remains best-effort because shared IP addresses, hard-coded addresses, cached DNS, and encrypted DNS can prevent definitive name mapping; it currently supports IPv4 only. A planned second phase will use the same architecture to enforce domain-based default-deny egress policies in the host kernel.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.