Execution chains — agent

systemd › containerd-shim-runc-v2 › touch › setup-iptables.sh › setup-iptables.sh › getent (pid 6164 · getent)

localhost [127.0.0.11] :45992, 53 (dns) UDP · (dns resolver)

systemd › containerd-shim-runc-v2 › entrypoint.sh › awf-cmd-1.sh › node (pid 6679 · node)

localhost [127.0.0.11] :45992, 53 (dns) UDP · (dns resolver)
172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › hosted-compute-agent › Runner.Listener › Runner.Worker › bash › bash › xargs › bash › timeout › docker (pid 4492 · docker)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute- › Runner.Listener › Runner.Worker › bash › bash › sudo › node › getent (pid 5423 · getent)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute- › Runner.Listener › Runner.Worker › bash › bash › sudo › node › docker › docker-compose (pid 5572 · docker-compose)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)

systemd › hosted-compute- (pid 2065 · hosted-compute-)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
140.82.112.23 :443 (https) TCP
140.82.113.23 :443 (https) TCP
hosted-compute-request-orchestrator-prod-iad-02 [140.82.114.23] :443 (https) TCP · also recorded: glb-2a3c35-public-internal.githubapp.com · (github infra)

systemd › containerd-shim-runc-v2 › awmg (pid 4802 · awmg)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
api.github.com [140.82.116.6] :443 (https) TCP

systemd › dockerd (pid 1293 · dockerd)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
pkg-containers.githubusercontent.com [185.199.108.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.109.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.110.154] :443 (https) TCP
pkg-containers.githubusercontent.com [185.199.111.154] :443 (https) TCP
ghcr.io [20.29.134.18] :443 (https) TCP

systemd › hosted-compute- › Runner.Listener › Runner.Worker › node (pid 8460 · node)

localhost [127.0.0.53] :53 (dns) UDP · (dns resolver)
api.github.com [20.29.134.17] :443 (https) TCP

systemd › hosted-compute- › sudo › sudo (pid 2080 · sudo)

140.82.113.23 :443 (https) TCP

systemd › containerd-shim-runc-v2 › squid (pid 5657 · squid)

api.anthropic.com [160.79.104.10] :443 (https) TCP
168.63.129.16 :53 (dns) UDP
api.github.com [20.29.134.17] :443 (https) TCP

systemd › python3 › python3 (pid 1499 · python3)

168.63.129.16 :32526, 80 (http) TCP
169.254.169.254 :80 (http) TCP · (cloud metadata)

systemd › systemd-resolve (pid 513 · systemd-resolve)

168.63.129.16 :53 (dns) UDP

systemd › containerd-shim-runc-v2 › entrypoint.sh › awf-cmd-1.sh › node › claude.exe (pid 6797 · claude.exe)

172.17.0.1 :8080 (http-proxy) TCP
172.30.0.10 :3128 (squid-proxy) TCP
172.30.0.30 :10000 (ndmp), 10001 TCP

systemd › containerd-shim-runc-v2 › entrypoint.sh › awf-cmd-1.sh › node › claude.exe › bash › python3.12 (pid 7529 · python3.12)

172.30.0.10 :3128 (squid-proxy) TCP

systemd › containerd-shim-runc-v2 › containerd-shim-runc-v2 (pid 5665 · containerd-shim-runc-v2)

172.30.0.10 :3128 (squid-proxy) TCP

systemd › containerd-shim-runc-v2 › entrypoint.sh › api-proxy-health-check.sh › api-proxy-health-check.sh › bash › cat (pid 6313 · cat)

172.30.0.30 :10000 (ndmp), 10001 TCP

jadoont/agent-behavior-index

Recorded at the kernel by Garnetfor commit 0822380

Record agent run/agent

run 378761737412026-10-09 02:49 UTC

Execution chains

18 destinations · 17 processes

systemd
- hosted-compute-agentRunner.ListenerRunner.Worker
  - bash
    - bash
      - xargs
        bash
        timeout
        docker[4492 · docker]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
- hosted-compute-[2065 · hosted-compute-]
  - Runner.Listener
    - Runner.Worker
      - bash
        bash
        sudo
        node
        getent[5423 · getent]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
        docker
        docker-compose[5572 · docker-compose]step: <unknown>
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
      - node[8460 · node]
        api.github.com20.29.134.17:443 (https) · tcp
        localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - sudo
    - sudo[2080 · sudo]
      - 140.82.113.23:443 (https) · tcp
  - 140.82.112.23:443 (https) · tcp
  - 140.82.113.23:443 (https) · tcp
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - hosted-compute-request-orchestrator-prod-iad-02140.82.114.23:443 (https) · tcp(github infra)also recorded: glb-2a3c35-public-internal.githubapp.com
- containerd-shim-runc-v2
  - touchsetup-iptables.shsetup-iptables.sh
    - getent[6164 · getent]
      - localhost127.0.0.11:45992, 53 (dns) · udp(dns resolver)
  - entrypoint.sh
    - awf-cmd-1.sh
      - node[6679 · node]step: <unknown>
        claude.exe[6797 · claude.exe]
        bash
        python3.12[7529 · python3.12]
        172.30.0.10:3128 (squid-proxy) · tcp
        172.17.0.1:8080 (http-proxy) · tcp
        172.30.0.10:3128 (squid-proxy) · tcp
        172.30.0.30:10000 (ndmp), 10001 · tcp
        172.30.0.30:10000 (ndmp), 10001 · tcp
        localhost127.0.0.11:45992, 53 (dns) · udp(dns resolver)
    - api-proxy-health-check.shapi-proxy-health-check.shbash
      - cat[6313 · cat]step: <unknown>
        172.30.0.30:10000 (ndmp), 10001 · tcp
  - awmg[4802 · awmg]step: <unknown>
    - api.github.com140.82.116.6:443 (https) · tcp
    - localhost127.0.0.53:53 (dns) · udp(dns resolver)
  - squid[5657 · squid]
    - api.anthropic.com160.79.104.10:443 (https) · tcp
    - 168.63.129.16:53 (dns) · udp
    - api.github.com20.29.134.17:443 (https) · tcp
  - containerd-shim-runc-v2[5665 · containerd-shim-runc-v2]
    - 172.30.0.10:3128 (squid-proxy) · tcp
- dockerd[1293 · dockerd]
  - pkg-containers.githubusercontent.com185.199.108.154:443 (https) · tcp
  - ghcr.io20.29.134.18:443 (https) · tcp
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)
- python3
  - python3[1499 · python3]
    - 168.63.129.16:32526, 80 (http) · tcp
    - 169.254.169.254:80 (http) · tcp(cloud metadata)
- systemd-resolve[513 · systemd-resolve]
  - 168.63.129.16:53 (dns) · udp

Run details

Repositoryjadoont/agent-behavior-index

WorkflowRecord agent run

Jobagent

Run ID37876173741

Profile UUID01a11e92-2059-79c5-8b63-c096af4340dc

Commit SHA08223801f16deb1c8b8db762e1593c55a9711061

Timestamp2026-10-09 02:49:31 UTC

The record is egress-centric; processes without recorded egress do not appear.