Network Limits

Network limits control outbound internet access from sandboxes. Each sandbox runs behind a firewall that restricts which external IP addresses and domains it can reach, preventing untrusted code from exfiltrating data or contacting arbitrary hosts.

Egress is open by default. You can restrict access per sandbox with a network policy: a default-deny allow list of IPv4 CIDR ranges and domains. Set the policy when you create a sandbox, then update or reset it while the sandbox exists.

Use cases

Network limits are used when code in a sandbox must not reach arbitrary hosts.

• Untrusted or generated code: code from users or agents runs with no outbound access, so it cannot send data out of the sandbox.
• Agents that call known services: a domain allow list lets an agent reach the model provider and the APIs it needs, and blocks every other host. The sandbox resolves only the names on the list.
• Dependency installs: the domains of package registries, such as PyPI or npm, are allowed, and the rest of the internet is blocked.
• Services at fixed addresses: an IPv4 range allow list admits services with known addresses, such as an internal API behind a static IP.
• Sensitive data: a sandbox that processes private files or datasets reaches only the hosts on its allow list. DNS is filtered as well, so a name that is not on the list does not resolve.
• Restrict after setup: a sandbox installs its dependencies with open egress, and its policy is updated to block all egress before untrusted code runs.
• Temporary access: the policy of a running, paused, or stopped sandbox is replaced to allow one more host for a task. A later update or a reset changes it again, and the revision history is kept.
• Checks before critical work: a request to an allowed host and a request to a blocked host confirm that the policy is in effect before work starts.

Create sandboxes with network restrictions

Create a sandbox with a network policy. With blocking turned on, the sandbox can reach only the domains and IPv4 ranges on its allow lists. A domain allow list turns blocking on by itself, while an IPv4 allow list restricts egress only when blocking is on. Network policies apply to Linux sandboxes only; Windows and GPU sandboxes do not accept them.

from daytona import Daytona

daytona = Daytona()

# Allow access to specific domains; everything else is denied
sandbox = daytona.v2.create(
    network_policy={"block_all": True, "allow_domains": ["example.com", "*.daytona.io"]},
)

Block all egress

Create a sandbox with no outbound access, for code that needs no network. With blocking on and empty allow lists, the sandbox reaches no external address and DNS resolves no names.

from daytona import Daytona

daytona = Daytona()

# Deny all outbound traffic
sandbox = daytona.v2.create(network_policy={"block_all": True})

Allow IPv4 ranges

Create a sandbox that reaches only specific IPv4 addresses and ranges, in the network allow list format. An IPv4 allow list applies only when blocking is on, so turn it on explicitly. Without a domain allow list, DNS resolves no names; connect by IP address.

from daytona import Daytona

daytona = Daytona()

# Allow one address and one subnet; everything else is denied
sandbox = daytona.v2.create(
    network_policy={"block_all": True, "allow_cidrs": ["208.80.154.232/32", "208.80.152.0/22"]},
)

Allow domains

Create a sandbox that reaches only specific hosts by name, in the domain allow list format. The sandbox resolves and connects to the listed domains; a wildcard covers every subdomain of a host but not the host itself. The domain list turns blocking on by itself.

from daytona import Daytona

daytona = Daytona()

# Allow a host and all of its subdomains; everything else is denied
sandbox = daytona.v2.create(
    network_policy={"allow_domains": ["pythonhosted.org", "*.pythonhosted.org", "pypi.org"]},
)

Network allow list format

Allow outbound traffic to specific IPv4 addresses and ranges. Each entry on the network allow list is a single address or a CIDR block, and the sandbox can reach it on any port. The list takes effect only when blocking is on. The SDKs and the API accept allow_cidrs with blocking off and ignore it; the CLI rejects --allow-cidr without --block-all or --allow-domain.

Domain allow list format

Allow outbound traffic to specific hosts by name. Each entry is a hostname, or a wildcard covering a hostname's subdomains. A domain allow list turns blocking on by itself.

DNS is filtered as well: the sandbox resolves only the names on the list and refuses all others. A policy with only IPv4 entries, or with empty lists, resolves no names at all.

Operations

Get network policy

Get the network policy of a sandbox. The response carries two policies: the desired policy, which is the last one you set, and the applied policy, which the sandbox currently enforces. A change is applied in the background, so the two differ until the sandbox catches up. The response also carries an ETag that identifies the current revision; an update or reset must send it back.

from daytona import Daytona

daytona = Daytona()
sandbox = daytona.v2.create()

policy = sandbox.get_network_policy()
print(policy.state, policy.desired, policy.applied, policy.etag)

policy = daytona.v2.get_network_policy("{sandboxId}")

Update network policy

Replace the whole network policy of an existing sandbox, with the same fields and rules as at create time. The sandbox must be running, paused, or stopped. The new policy is stored at once and applied in the background; get the policy to see when it takes effect.

Every update sends the ETag of the revision it replaces. If the policy changed since, the update is rejected instead of overwriting it; get the policy and retry with the new ETag.

from daytona import Daytona

daytona = Daytona()
sandbox = daytona.v2.create()

current = sandbox.get_network_policy()
updated = sandbox.update_network_policy(
    network_policy={"block_all": True, "allow_domains": ["pypi.org", "files.pythonhosted.org"]},
    if_match=current.etag,
)
print(updated.state)  # pending until the sandbox applies it

current = daytona.v2.get_network_policy("{sandboxId}")
updated = daytona.v2.update_network_policy(
    "{sandboxId}",
    network_policy={"block_all": True, "allow_domains": ["pypi.org"]},
    if_match=current.etag,
)

Reset network policy

Reset the network policy of a sandbox to open egress. A reset removes the restrictions but keeps the revision history, so it follows the same ETag rules as an update.

from daytona import Daytona

daytona = Daytona()
sandbox = daytona.v2.create()

current = sandbox.get_network_policy()
sandbox.reset_network_policy(if_match=current.etag)

current = daytona.v2.get_network_policy("{sandboxId}")
daytona.v2.reset_network_policy("{sandboxId}", if_match=current.etag)

Test network access

# Test HTTP connectivity to allowed addresses
curl -I http://208.80.154.232

# Test HTTP connectivity to allowed domains
curl -I https://example.com