When one DNS answer was not enough
A devcontainer firewall update replaces a point-in-time DNS assumption with published ranges for shared Google infrastructure.
A devcontainer firewall intermittently lost access to a Google-fronted service because one DNS answer did not represent the addresses used by the shared front end. The fix uses Google’s published ranges for that infrastructure, building on the earlier outbound firewall work.
Follow the shared address pool#
The shared edge’s address pool changed faster than the resolver-based model accounted for. An Antigravity eligibility check exposed the mismatch through intermittent connectivity, while the setup-devcontainer skill already carried a fix for this class of failure.
The update brings the shared firewall templates into the devcontainer. Startup and background refresh now use the same provider-published range source, and the README explains why a point-in-time lookup was not enough. That keeps the two paths aligned without hardcoding a snapshot of Google’s network.
The script checks passed. Future firewall updates could follow the shared setup-devcontainer template instead of rebuilding this implementation independently.