From 8f5fcf99d4f58216c6a6e1b054443bfc87b106cc Mon Sep 17 00:00:00 2001
From: mlsmaycon <mlsmaycon@gmail.com>
Date: Fri, 31 Jul 2026 20:07:12 +0200
Subject: [PATCH] address comments

---
 AGENTS.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 7efd56981..4ac006795 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -89,12 +89,21 @@ PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-
 ./client/proto/generate.sh
 ./flow/proto/generate.sh
 
-# Run locally
+# Run locally (lab only, never on a machine you rely on)
 sudo ./client/netbird up --log-level debug --log-file console
+sudo ./client/netbird down                   # teardown: restores routing, firewall, DNS
 ./signal/signal run --log-level debug --log-file console
 ./management/management management --log-level debug --log-file console --config ./management.json
 ```
 
+`netbird up` needs root and rewrites the host's routing table, firewall rules,
+DNS configuration, and WireGuard® interface. Run it only in a disposable test
+environment (a VM, container, or throwaway host) that you can rebuild, never on
+a workstation or server whose connectivity matters. Run `sudo netbird down`
+before you stop working, before rebuilding the binary, and on every failure
+path, so the host's networking state is restored instead of left half-applied.
+See [Pitfalls](#pitfalls) for why cleanup on every exit path matters.
+
 ## Structure
 
 ```text