A devcontainer firewall intermittently lost access to a Google-fronted service because one DNS answer did not represent the addresses used by the shared front end. The fix uses Google's published ranges for that infrastructure, building on the earlier [outbound firewall work](/posts/the-allowlist-was-too-generous#keep-the-friction-where-the-decision-is).

## Follow the shared address pool

The shared edge's address pool changed faster than the resolver-based model accounted for. An Antigravity eligibility check exposed the mismatch through intermittent connectivity, while the setup-devcontainer skill already carried a fix for this class of failure.

The update brings the shared firewall templates into the devcontainer. Startup and background refresh now use the same provider-published range source, and the README explains why a point-in-time lookup was not enough. That keeps the two paths aligned without hardcoding a snapshot of Google's network.

The script checks passed. Future firewall updates could follow the shared setup-devcontainer template instead of rebuilding this implementation independently.