Danny Kopping
7a94a683c4
*Disclaimer: implemented by a Coder Agent using Claude Opus 4.6* ## Summary Renames product references across documentation: | Old Name | New Name | |----------|----------| | AI Bridge | AI Gateway | | AI Bridge Proxy | AI Gateway Proxy | | Agent Boundaries | Agent Firewall | ## What changed - Prose text, headings, titles, and descriptions updated across all docs - Directories renamed: - `docs/ai-coder/ai-bridge/` → `docs/ai-coder/ai-gateway/` - `docs/ai-coder/ai-bridge/ai-bridge-proxy/` → `docs/ai-coder/ai-gateway/ai-gateway-proxy/` - `docs/ai-coder/agent-boundaries/` → `docs/ai-coder/agent-firewall/` - All internal markdown links updated to new paths - `manifest.json` route paths updated - Rename notice added to AI Gateway and Agent Firewall entrypoint pages ## Companion PR URL redirects (old paths → new paths): [coder/coder.com#700](https://github.com/coder/coder.com/pull/700) ## What is intentionally NOT changed - **Env vars**: `CODER_AIBRIDGE_*` - **CLI flags**: `--aibridge-*` - **API paths**: `/api/v2/aibridge/*` - **Config keys**: `aibridge:` YAML blocks - **Terraform variables**: `enable_aibridge`, `boundary_version`, `use_boundary_directly` - **Process names**: `aibridged`, `aibridgeproxyd` - **Prometheus metrics**: `coder_aibridged_*`, `coder_aibridgeproxyd_*` - **SDK types**: `codersdk.AIBridge*` - **GitHub URLs**: `github.com/coder/aibridge` - **Image paths**: `images/aibridge/` - **Auto-generated reference docs**: `docs/reference/cli/aibridge*.md`, `docs/reference/api/aibridge.md`, `docs/reference/api/schemas.md` - **Frontend code**: `site/src/` references (separate PR) Code-level renames (env vars, configs, frontend) are planned for a follow-up PR.
1.3 KiB
nsjail on ECS
This page describes the runtime and permission requirements for running Agent Firewall with the nsjail jail type on Amazon ECS.
Runtime & Permission Requirements for Running Agent Firewall in ECS
The setup for ECS is similar to nsjail on Kubernetes; that environment is better explored and tested, so the Kubernetes page is a useful reference. On ECS, requirements depend on the node OS and how ECS runs your tasks. The following examples use ECS with Self Managed Node Groups (EC2 launch type).
Example 1: ECS + Self Managed Node Groups + Amazon Linux
On Amazon Linux nodes with ECS, the default Docker seccomp profile enforced
by ECS blocks the syscalls needed for Agent Firewall. Because it is difficult to
disable or modify the seccomp profile on ECS, you must grant SYS_ADMIN (along
with NET_ADMIN) so that Agent Firewall can create namespaces and run nsjail.
Task definition (Terraform) — linuxParameters:
container_definitions = jsonencode([{
name = "coder-agent"
image = "your-coder-agent-image"
linuxParameters = {
capabilities = {
add = ["NET_ADMIN", "SYS_ADMIN"]
}
}
}])
This gives the container the capabilities required for nsjail when ECS uses the default Docker seccomp profile.