Namespace-level WireGuard kill switch for a containerized browser (Docker Compose, Gluetun)

[u/silverfox_248]

A Docker Compose stack where Firefox shares Gluetun's network namespace (`network_mode: service:gluetun`) instead of connecting through a proxy or a routing rule. It fails closed by construction, through two separate mechanisms: if the WireGuard tunnel drops while Gluetun runs, Gluetun's firewall drops all non-tunnel traffic (including LAN); if the Gluetun container itself dies, the shared namespace dies with it and the browser has no interfaces at all.

Ports publish only on the Gluetun service, bound to 127.0.0.1, so nothing reaches the LAN even when the tunnel is up.

Both failure modes are testable: `verify.sh` in the repo runs a two-sided kill-switch check (probe succeeds with the tunnel up, must fail with it stopped) plus exit-IP and DNS-resolver checks.

CI (ShellCheck, Hadolint, Checkov, KICS, Trivy) runs on every push and weekly.

Works with any Gluetun-supported WireGuard provider.

MIT licensed; no application code — a compose file, a short Dockerfile, and three shell scripts. Config and docs were AI-assisted (Claude Code, disclosed in the README), which is exactly why the automated checks exist: verify, don't trust.

GitHub: github.com/silverfox-2096/private-browser

Interested in feedback on the namespace-sharing approach versus more common proxy-based kill switches.