When the VPN goes down, nothing leaves

The research fleet must never show the server's own address to the sites it studies. Every container routes through a SOCKS5 provider, set once with PUT /api/v1/containers/{id}/network and type: socks5. The route is applied on the host, so nothing inside the container is configured, and nothing inside it can be misconfigured.

At 03:10 the provider drops. On a laptop VPN this is the moment the real address leaks. Here the container simply cannot make outbound connections. There is no direct route to fall back to, because there was never a second route. The kill switch is the absence of an alternative.

A cron polls GET .../network every minute and reads remote_status.is_running. When it flips to false, a notification goes out and a human picks a new provider or waits. The proxy credentials are write-only: the same GET returns credentials_configured: true and nothing more.

The exit is a property of the host, and the host has no plan B.