Execution chains — agent

systemd › containerd-shim-runc-v2 › touch › setup-iptables.sh › setup-iptables.sh › getent (pid 6138 · getent)

localhost [127.0.0.11] :49717, 53 (dns) UDP · (dns resolver)

systemd › containerd-shim-runc-v2 › containerd-shim-runc-v2 › awf-cmd-1.sh › node (pid 6652 · node)

localhost [127.0.0.11] :49717, 53 (dns) UDP · (dns resolver)
172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › hosted-compute-agent › Runner.Listener › Runner.Worker › bash › bash › xargs › bash › timeout › docker (pid 4323 · docker)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute- › Runner.Listener › Runner.Worker › bash › bash › sudo › node › node (pid 5392 · node)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute- › Runner.Listener › Runner.Worker › bash › bash › sudo › node › getent (pid 5421 · getent)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › dockerd (pid 1234 · dockerd)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
ghcr.io [140.82.114.34] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.108.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.109.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.110.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.111.154] :443 (https) TCP

systemd › hosted-compute- › Runner.Listener › Runner.Worker › bash › bash › sudo › node › docker › docker-compose (pid 5550 · docker-compose)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › containerd-shim-runc-v2 › awmg (pid 4780 · awmg)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
api.github.com [140.82.114.6] :443 (https) TCP

systemd › hosted-compute- (pid 2064 · hosted-compute-)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
hosted-compute-request-orchestrator-prod-iad-01 [140.82.112.24] :443 (https) TCP · also recorded: glb-2a3c35-public-internal.githubapp.com · (github infra)
140.82.114.23 :443 (https) TCP

systemd › hosted-compute- › sudo › sudo (pid 2083 · sudo)

140.82.114.24 :443 (https) TCP

systemd › containerd-shim-runc-v2 › squid (pid 5639 · squid)

api.anthropic.com [160.79.104.10] :443 (https) TCP
168.63.129.16 :53 (dns) UDP

systemd › python3 › python3 (pid 1516 · python3)

168.63.129.16 :32526, 80 (http) TCP
169.254.169.254 :80 (http) TCP · (cloud metadata)

systemd › systemd-resolve (pid 523 · systemd-resolve)

168.63.129.16 :53 (dns) UDP

systemd › containerd-shim-runc-v2 › containerd-shim-runc-v2 › awf-cmd-1.sh › node › claude.exe (pid 6836 · claude.exe)

172.17.0.1 :8080 (http-proxy) TCP
172.30.0.10 :3128 (squid-proxy) TCP
172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › containerd-shim-runc-v2 › node (pid 5645 · node)

172.30.0.10 :3128 (squid-proxy) TCP

systemd › containerd-shim-runc-v2 › containerd-shim-runc-v2 › api-proxy-health-check.sh › timeout › bash › cat (pid 6292 · cat)

172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › systemd-network (pid 721 · systemd-network)

ip6-allrouters [ff02::2] :0 (reserved) ICMPV6

jadoont/agent-behavior-index

Recorded at the kernel by Garnetfor commit 0822380

Record agent run/agent

run 378651301882026-10-09 00:35 UTC

Execution chains

18 destinations · 17 processes

systemd
- hosted-compute-agentRunner.ListenerRunner.Worker
  - bash
    - bash
      - xargs
        bash
        timeout
        docker[4323 · docker]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
- hosted-compute-[2064 · hosted-compute-]
  - Runner.ListenerRunner.Worker
    - bash
      - bash
        sudo
        node
        node[5392 · node]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
        getent[5421 · getent]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
        docker
        docker-compose[5550 · docker-compose]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - sudo
    - sudo[2083 · sudo]
      - 140.82.114.24:443 (https) · tcp
  - 140.82.114.23:443 (https) · tcp
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - hosted-compute-request-orchestrator-prod-iad-01140.82.112.24:443 (https) · tcp(github infra)also recorded: glb-2a3c35-public-internal.githubapp.com
- containerd-shim-runc-v2
  - touchsetup-iptables.shsetup-iptables.sh
    - getent[6138 · getent]
      - localhost127.0.0.11:49717, 53 (dns) · udp(dns resolver)
  - containerd-shim-runc-v2
    - awf-cmd-1.sh
      - node[6652 · node]step: <unknown>
        claude.exe[6836 · claude.exe]
        172.17.0.1:8080 (http-proxy) · tcp
        172.30.0.10:3128 (squid-proxy) · tcp
        172.30.0.30:10000 (ndmp), 10001 · tcp
        172.30.0.30:10000 (ndmp), 10001 · tcp
        localhost127.0.0.11:49717, 53 (dns) · udp(dns resolver)
    - api-proxy-health-check.shtimeoutbash
      - cat[6292 · cat]step: <unknown>
        172.30.0.30:10000 (ndmp), 10001 · tcp
  - awmg[4780 · awmg]step: <unknown>
    - api.github.com140.82.114.6:443 (https) · tcp
    - localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - squid[5639 · squid]
    - api.anthropic.com160.79.104.10:443 (https) · tcp
    - 168.63.129.16:53 (dns) · udp
  - node[5645 · node]
    - 172.30.0.10:3128 (squid-proxy) · tcp
- dockerd[1234 · dockerd]
  - ghcr.io140.82.114.34:443 (https) · tcp
  - pkg-containers.githubusercontent.com185.199.108.154:443 (https) · tcp
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)
- python3
  - python3[1516 · python3]
    - 168.63.129.16:32526, 80 (http) · tcp
    - 169.254.169.254:80 (http) · tcp(cloud metadata)
- systemd-resolve[523 · systemd-resolve]
  - 168.63.129.16:53 (dns) · udp
- systemd-network[721 · systemd-network]
  - ip6-allroutersff02::2:0 (reserved) · icmpv6

Run details

Repositoryjadoont/agent-behavior-index

WorkflowRecord agent run

Jobagent

Run ID37865130188

Profile UUID01a11e17-506b-709c-b5c7-0cd81be8c4ab

Commit SHA08223801f16deb1c8b8db762e1593c55a9711061

Timestamp2026-10-09 00:35:14 UTC

The record is egress-centric; processes without recorded egress do not appear.