Bug: Egress filtering (`OPEN_TERMINAL_ALLOWED_DOMAINS`) is non-functional

[SoerenOestervig]

Description

Egress filtering via OPEN_TERMINAL_ALLOWED_DOMAINS does not work in the default container configuration. Two distinct bugs in entrypoint.sh prevent the feature from functioning at all.

Steps to Reproduce

docker run --rm --cap-add NET_ADMIN \
  -e OPEN_TERMINAL_ALLOWED_DOMAINS="pypi.org" \
  ghcr.io/open-webui/open-terminal:0.11.34 run

Expected Behavior

• Container starts successfully
• DNS resolves only whitelisted domains (pypi.org)
• HTTP traffic to non-whitelisted domains is blocked
• CAP_NET_ADMIN is dropped after firewall setup

Actual Behavior

The container crashes immediately on startup with:

unable to raise CAP_SETPCAP for BSET changes: Operation not permitted

If the crash is bypassed by running as root (--user 0:0), the container starts but the DNS whitelist is non-functional — all domains (including whitelisted ones) fail to resolve and all outbound connections time out.

Root Cause

1. capsh executed without sufficient privileges
At the end of the egress setup in entrypoint.sh, capsh --drop=cap_net_admin is called as the unprivileged user. Dropping capabilities from the bounding set requires CAP_SETPCAP, which the unprivileged user does not have. Since the script uses set -e, this kills the container.
2. iptables blocks dnsmasq from reaching upstream DNS
The rule iptables -A OUTPUT -p udp --dport 53 -j DROP is applied without an exception for the upstream DNS server that dnsmasq needs to forward whitelisted queries to. As a result, dnsmasq can never resolve anything, the allowed ipset stays empty, and all traffic is blocked.

Environment

• Image: ghcr.io/open-webui/open-terminal:0.11.34
• Runtime: Docker with --cap-add NET_ADMIN
• Host: Linux / Docker Desktop (macOS) #

PR opened here: #118