Firewall Configuration

Introduction

If your environment uses a firewall or proxy that restricts outbound traffic, you must allow access to the external services listed below. These services are required for installation, upgrades, and runtime vulnerability data updates. If the host cannot reach the internet at all, use the Air-Gapped Deployments workflow instead — it requires no outbound access from the target host.

The specific configuration steps will vary depending on your firewall solution. Work with your network administrator to ensure the domains listed below are accessible over HTTPS (TCP 443) from your Manifest deployment.

Required External Services

Installation and Upgrades

Required when downloading the CLI and the platform packages, and during deploy. All platform container images ship inside the downloaded packages and are served from an in-cluster registry, so no public container registries need to be reachable.

Domain	Purpose
`github.com`, `api.github.com`, `objects.githubusercontent.com`	`manifest-installer` CLI download and release lookups (GitHub Releases)
`api.ecr.us-east-1.amazonaws.com`	Registry authentication (Amazon ECR)
`623542229617.dkr.ecr.us-east-1.amazonaws.com`	Manifest platform packages
`*.s3.us-east-1.amazonaws.com`	Package layer downloads (ECR redirects to Amazon S3)

Vulnerability Data Sources

These services are accessed at runtime to retrieve and update vulnerability data and package metadata. If these are blocked, vulnerability information will not be updated automatically.

Domain	Purpose
`nvd.nist.gov`	NVD vulnerability database
`services.nvd.nist.gov`	NVD API endpoint
`osv-vulnerabilities.storage.googleapis.com`	OSV vulnerability data
`www.cisa.gov`	CISA Known Exploited Vulnerabilities (KEV)
`epss.cyentia.com`	EPSS exploit prediction scores
`epss.empiricalsecurity.com`	EPSS exploit prediction scores
`ecosyste.ms`	Open source package metadata
`deps.dev`	Open source package metadata
`api.github.com`	SBOM component enrichment

Optional Services

AI Risk Product

If your organization is subscribed to the AI Risk product, the following additional services must be accessible.

Domain	Purpose
`huggingface.co`	Hugging Face API
`api.openai.com`	OpenAI API
`export.arxiv.org`	ArXiv Paper Archive