Network Policy

Network policies control outbound network access from a box.

Use them when you want to:

• block all outbound traffic
• allow only specific public domains
• restrict egress to specific CIDR ranges

By default, boxes use:

Modes#

The SDK type is:

Create a box with a policy#

Pass networkPolicy when creating a box:

You can also combine domain and CIDR rules:

networkPolicy is also supported in Box.fromSnapshot() and EphemeralBox.

Read the current policy#

Use the networkPolicy getter:

Update a running box#

Update the policy after creation:

Switch back to unrestricted outbound access:

Changes take effect immediately. You do not need to recreate the box.

Matching rules#

• allowedDomains supports exact matches such as api.github.com
• wildcard domains must use *.suffix form, for example *.githubusercontent.com
• allowedCidrs and deniedCidrs use standard CIDR notation
• in custom mode, deniedCidrs takes precedence over allowed CIDRs
• private IP ranges are always blocked even if you try to allow them explicitly

Example patterns#

Allow only GitHub and npm:

Block all outbound traffic:

Allow a specific public CIDR:

Block a specific CIDR range:

Related#

• Security
• Shell
• How It Works