field-cage: MIT-licensed eBPF tool blocks unauthorized outbound traffic in GitHub Actions

A developer has released field-cage, an open-source eBPF agent designed to monitor and restrict outbound network connections from Linux GitHub Actions runners. The tool enforces explicit allowlists of domains, IP addresses, and CIDR ranges, blocking any connections not defined in policy at the kernel level. Unlike StepSecurity's Harden-Runner, field-cage focuses solely on network egress control and requires no external backend or vendor account. All functionality, including audit, block, and reporting modes, is available under the MIT license for both public and private repositories at no cost. The trade-off is that field-cage lacks Harden-Runner's broader runtime security features such as centralized dashboards, managed threat intelligence, and organization-wide policy management.