Skip to main content
Vulpy installs a host-level firewall rule that blocks the AWS Instance Metadata Service (IMDS) endpoint. This prevents Fox from silently picking up the VM’s IAM role and acting with cloud permissions you never intended to grant an AI operator.
Ask Fox to check the lock. Fox knows whether the IMDS lock is on and can explain the trade-off before you change it.Try prompts like:
  • “Is the IMDS lock on right now?”
  • “Explain the risk of setting VULPY_IMDS_LOCK=0.”
  • “Run pnpm vulpy hermes doctor and tell me the IMDS status.”

​
What IMDS is and why it matters

The Instance Metadata Service runs at 169.254.169.254 on EC2 and Lightsail instances. Any process on the VM can request temporary credentials from this address if the instance has an IAM instance profile attached. For a containerized AI operator like Fox, unrestricted access means it could read the VM’s role, call AWS APIs, and perform actions under your cloud account.

​
What Vulpy installs

Vulpy adds an nft reject rule that drops traffic to 169.254.169.254 for the host and for all containers. The lock is active by default because Fox ships without a Docker socket and without cloud credentials of its own. Blocking IMDS closes a path where Fox could otherwise inherit the VM’s identity.

​
Default behavior and how to check it

The lock is on by default. VULPY_IMDS_LOCK is set to 1 in your environment unless you override it. Run the doctor command to verify the current state:
The report shows whether the IMDS lock is active on AWS and whether host egress is restricted separately.

​
When to opt out

You should only disable the lock if Fox needs to use Amazon Bedrock through the VM’s IAM instance profile and you do not want to pass explicit AWS credentials. Set the variable before starting Fox:
Opting out gives Fox any permission attached to the VM IAM role. Scope the role narrowly and review its policy before you disable the lock.

​
Preferred alternative: explicit credentials

Instead of opening IMDS to Fox, keep the lock on and pass explicit AWS keys as environment variables. This limits Fox to the exact permissions you define and keeps the metadata endpoint blocked for every other container on the host. See the AI providers page for how to configure Bedrock keys.

​
Host egress lock

The IMDS rule is separate from host egress restrictions. pnpm vulpy hermes doctor reports both. If you see a failure on egress, review your firewall rules independently of the IMDS setting.

AI Providers

Configure Bedrock, OpenAI, and other providers with explicit keys instead of relying on VM roles.

Security

Review firewall rules, access modes, and hardening guidance for production deployments.