Not lame. The interesting part is you can lock down egress by default and the failure mode is loud (blocked call, retry, error) instead of silent like a bad prompt.

varlock's new credential broker lets you manage allowed hosts and injection of credentials (replaces placeholders). So you'd get a very expressive way to handle this without any code. I need to do some work to make it run on a worker, but should happen soon!

This is so true

with @stashbase we do have agent profiles with proxy, you can define egress, credential injection with local or remote execution and more, no need for everyone to build custom solution!

Could add support for plain containers with my Zeroness.dev