# RootNode Academy egress allowlist — one domain per line, matched with Squid's dstdomain ACL
# (a leading "." matches the domain and all subdomains). Configuration-driven, operator-edited,
# never student- or Lab-container-writable (docs/PHASE1_PLATFORM_FOUNDATION.md §6).
#
# Starting set covers what the existing scenario content actually pulls (nginx, busybox-style
# images used across scenarios/data/*.json setup_commands) — confirm/expand against real usage
# before relying on this for a live cohort; this is a first pass, not a final audit.

.docker.io
.docker.com
registry-1.docker.io
auth.docker.io
production.cloudflare.docker.com
.ghcr.io
.gcr.io
.k8s.io
.quay.io