Execution chains — agent

systemd › dockerd (pid 1199 · dockerd)

registry-1.docker.io [100.48.25.216] :443 (https) TCP
localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
d3ipk8a4rcghwr.cloudfront.net [13.225.196.38] :443 (https) TCP · also recorded: production.cloudfront.docker.com
ghcr.io [140.82.114.34] :443 (https) TCP
168.63.129.16 :53 (dns) UDP
auth.docker.io [172.64.144.78] :443 (https) TCP · also recorded: auth.docker.io.cdn.cloudflare.net
pkg-containers.githubusercontent.com [185.199.109.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.110.154] :443 (https) TCP
registry-1.docker.io [34.238.55.159] :443 (https) TCP
registry-1.docker.io [54.237.130.1] :443 (https) TCP

systemd › containerd-shim-runc-v2 › touch › setup-iptables.sh › setup-iptables.sh › getent (pid 5906 · getent)

localhost [127.0.0.11] :39355, 53 (dns) UDP · (dns resolver)

systemd › containerd-shim-runc-v2 › entrypoint.sh › awf-cmd-1.sh › node (pid 6558 · node)

localhost [127.0.0.11] :39355, 53 (dns) UDP · (dns resolver)
172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › hosted-compute-agent › Runner.Listener › Runner.Worker › bash › bash › xargs › bash › timeout › docker (pid 4374 · docker)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute-agent › Runner.Listener › Runner.Worker › bash › bash › sudo › node › getent (pid 5157 · getent)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute-agent › Runner.Listener › Runner.Worker › bash › bash › sudo › node › docker › docker-compose (pid 5300 · docker-compose)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › containerd-shim-runc-v2 › awmg (pid 4531 · awmg)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
api.github.com [140.82.114.5] :443 (https) TCP

systemd › hosted-compute-agent › Runner.Listener › Runner.Worker › node (pid 8446 · node)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
api.github.com [140.82.114.5] :443 (https) TCP

systemd › hosted-compute-agent › sudo › provjobd1484051564 (pid 2058 · provjobd1484051564)

140.82.114.23 :443 (https) TCP

systemd › hosted-compute-agent (pid 2039 · hosted-compute-agent)

140.82.114.23 :443 (https) TCP

systemd › containerd-shim-runc-v2 › squid (pid 5390 · squid)

api.anthropic.com [160.79.104.10] :443 (https) TCP
168.63.129.16 :53 (dns) UDP

systemd › python3.12 › python3.12 (pid 1336 · python3.12)

168.63.129.16 :32526, 80 (http) TCP
169.254.169.254 :80 (http) TCP · (cloud metadata)

systemd › systemd-resolved (pid 522 · systemd-resolved)

168.63.129.16 :53 (dns) UDP

systemd › containerd-shim-runc-v2 › entrypoint.sh › awf-cmd-1.sh › node › claude.exe (pid 6593 · claude.exe)

172.17.0.1 :8080 (http-proxy) TCP
172.30.0.10 :3128 (squid-proxy) TCP
172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › containerd-shim-runc-v2 › node (pid 5397 · node)

172.30.0.10 :3128 (squid-proxy) TCP

systemd › containerd-shim-runc-v2 › entrypoint.sh › api-proxy-health-check.sh › timeout › bash › cat (pid 6064 · cat)

172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › systemd-networkd (pid 720 · systemd-networkd)

ip6-allrouters [ff02::2] :0 (reserved) ICMPV6

jadoont/agent-behavior-index

Recorded at the kernel by Garnetfor commit 40eb61e

Record agent run/agent

run 357977467132026-09-22 23:34 UTC

Execution chains

19 destinations · 17 processes

systemd
- hosted-compute-agent[2039 · hosted-compute-agent]
  - Runner.Listener
    - Runner.Worker
      - bash
        bash
        xargs
        bash
        timeout
        docker[4374 · docker]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
        sudo
        node
        getent[5157 · getent]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
        docker
        docker-compose[5300 · docker-compose]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
      - node[8446 · node]
        api.github.com140.82.114.5:443 (https) · tcp
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - sudo
    - provjobd1484051564[2058 · provjobd1484051564]
      - 140.82.114.23:443 (https) · tcp
  - 140.82.114.23:443 (https) · tcp
- dockerd[1199 · dockerd]
  - registry-1.docker.io100.48.25.216:443 (https) · tcp
  - d3ipk8a4rcghwr.cloudfront.net13.225.196.38:443 (https) · tcpalso recorded: production.cloudfront.docker.com
  - ghcr.io140.82.114.34:443 (https) · tcp
  - 168.63.129.16:53 (dns) · udp
  - auth.docker.io172.64.144.78:443 (https) · tcpalso recorded: auth.docker.io.cdn.cloudflare.net
  - pkg-containers.githubusercontent.com185.199.109.154:443 (https) · tcp
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)
- containerd-shim-runc-v2
  - touchsetup-iptables.shsetup-iptables.sh
    - getent[5906 · getent]
      - localhost127.0.0.11:39355, 53 (dns) · udp(dns resolver)
  - entrypoint.sh
    - awf-cmd-1.sh
      - node[6558 · node]step: <unknown>
        claude.exe[6593 · claude.exe]
        172.17.0.1:8080 (http-proxy) · tcp
        172.30.0.10:3128 (squid-proxy) · tcp
        172.30.0.30:10000 (ndmp), 10001 · tcp
        172.30.0.30:10000 (ndmp), 10001 · tcp
        localhost127.0.0.11:39355, 53 (dns) · udp(dns resolver)
    - api-proxy-health-check.shtimeoutbash
      - cat[6064 · cat]step: <unknown>
        172.30.0.30:10000 (ndmp), 10001 · tcp
  - awmg[4531 · awmg]step: <unknown>
    - api.github.com140.82.114.5:443 (https) · tcp
    - localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - squid[5390 · squid]
    - api.anthropic.com160.79.104.10:443 (https) · tcp
    - 168.63.129.16:53 (dns) · udp
  - node[5397 · node]
    - 172.30.0.10:3128 (squid-proxy) · tcp
- python3.12
  - python3.12[1336 · python3.12]
    - 168.63.129.16:32526, 80 (http) · tcp
    - 169.254.169.254:80 (http) · tcp(cloud metadata)
- systemd-resolved[522 · systemd-resolved]
  - 168.63.129.16:53 (dns) · udp
- systemd-networkd[720 · systemd-networkd]
  - ip6-allroutersff02::2:0 (reserved) · icmpv6

Run details

Repositoryjadoont/agent-behavior-index

WorkflowRecord agent run

Jobagent

Run ID35797746713

Profile UUID01a0cb79-39dc-7fc9-be09-6ff03575c1df

Commit SHA40eb61eebb5ebfd73c1eacc40ece05d3a611049c

Timestamp2026-09-22 23:34:52 UTC

The record is egress-centric; processes without recorded egress do not appear.