The lockdown browser is a firewall rule below the browser

Online exam, two hundred students, and the integrity tool isn't an app the student installs. It's egress rules on the exam container, written where the student can't reach them.

The proctor's script appends firewall rules per container: allow DNS, allow the exam domain, drop everything else. The rules live at the host level, so root inside the container can't remove them. The student's hoody-browser runs inside that container and can load exactly one site. When time is called, one request resets the firewall to open.

A lockdown browser inspects the student's machine and hopes. Here the network itself can reach one domain, and nothing inside the container can change that.