Your dev environment can't reach production

Everyone has the story: a test suite truncated a production table because an .env pointed at the wrong host. The usual defense is discipline. The structural defense is a wall the dev environment can't see. On Hoody, egress firewall rules are written at the host level, outside the container: POST the rule once, and dev containers get no route to production's addresses.

The mistake changes shape. The wrong .env now produces a connection refused in two seconds instead of an incident review on Thursday. Root inside the container doesn't help, because the wall isn't inside the container: not your code, not a pasted command, not a curious script can opt out of it.