    [ABE] < LOCAL> Deny on {GET http://jessie/icons/openlogo-75.png <<< http://jessie/ - 1}    SYSTEM rule:    Site LOCAL    Accept from LOCAL    Denyi.e. pages on http://jessie cannot load images or any other sub-resource.$ getent ahosts jessie192.168.122.74 STREAM jessie192.168.122.74 DGRAM192.168.122.74 RAWfe80::b4f5:2ff:feb9:b12f STREAMfe80::b4f5:2ff:feb9:b12f DGRAMfe80::b4f5:2ff:feb9:b12f RAWNoScript version 5.0.5jessie is a systemd-nspawn container.  Its name is resolved by nss-mymachines.  Why does this happen, what is the diagreement between systemd and NoScript?
Firefox+noscript v.s. systemd-nspawn - ABE denial
security;firefox;systemd nspawn
barbaz on the forums suggests this can happen if jessie resolves to both LOCAL and non-LOCAL address.  It sounds like NoScript interprets it as an attack like the DNS rebinding attack.IPv6 link-local addresses (your fe80... addresses) are not treated as LOCAL.  I think the explanation is it would break some sites on the Web which have mis-configured DNS :(.  https://github.com/avian2/noscript/blob/ebc093642cb9645bc18b63fc151d3b00063b97ee/xpi/chrome/content/noscript/DNS.js#L337I think it's possible to disable IPv6 inside the container, using the sysctl net.ipv6.conf.all.disable_ipv6=1.  But I'm not sure this is a great response, for what is an limitation in NoScript's IPv6 support.I can work around it in NoScript by adding this at the very top of NoScript Options > Advanced > ABE > SYSTEM:# NoScript default rule chokes when name resolves to both IPv6 LLA# and IPv4 private address.# https://unix.stackexchange.com/questions/370485/firefoxnoscript-v-s-systemd-nspawn-abe-denials/370486#370486# Treat nodots domain as (an independent) LAN.# Useful for nss-mymachines.   I think LLMNR would also be affected.Site ^https?://[^.]*[:/]Accept from ^https?://[^.]*[:/]Deny