Network Limits

Network limits control outbound internet access from sandboxes. Each sandbox runs behind a firewall that restricts which external IP addresses and domains it can reach, preventing untrusted code from exfiltrating data or contacting arbitrary hosts.

Egress is open by default. You can restrict access per sandbox with a network policy: a default-deny allow list of IPv4 CIDR ranges and domains. Set the policy when you create a sandbox, then update or reset it while the sandbox exists.

Use cases

Network limits are used when code in a sandbox must not reach arbitrary hosts.

• Untrusted or generated code. Code from users or agents runs with no outbound access, so it cannot send data out of the sandbox. With blocking on and empty allow lists, DNS resolves no names either. Network policies apply to Linux and macOS sandboxes, and Windows and GPU sandboxes do not accept them.

• Agents that call known services. A domain allow list lets an agent reach the model provider and the APIs it needs, and blocks every other host. The sandbox resolves only the names on the list. A domain allow list turns blocking on by itself.

• Dependency installs. The domains of package registries, such as PyPI or npm, are allowed, and the rest of the internet is blocked. A wildcard entry covers the subdomains of a registry host but not the host itself, which needs its own entry. Each entry is a hostname without a protocol, path, port, or query string.

• Sensitive data. A sandbox that processes private files or datasets reaches only the hosts on its allow list. DNS is filtered as well, so a name that is not on the list does not resolve. Egress is open by default, so the sandbox gets its policy when it is created.

• Restrict after setup. A sandbox installs its dependencies with open egress, and its policy is updated to block all egress before untrusted code runs. The update applies in the background, and the policy status reads applied once the sandbox enforces it. An update works while the sandbox is running, paused, or stopped.

Create sandboxes with network restrictions

Create a sandbox with a network policy. With blocking turned on, the sandbox can reach only the domains and IPv4 ranges on its allow lists. A domain allow list turns blocking on by itself, while an IPv4 allow list restricts egress only when blocking is on. When a policy has both lists, web traffic on ports 80 and 443 needs a listed domain, even to a listed IPv4 range. Network policies apply to Linux sandboxes and macOS sandboxes; the examples below create Linux sandboxes, and a macOS create takes the same policy. Windows and GPU sandboxes do not accept them.

from daytona import Daytona

daytona = Daytona()

# Allow access to specific domains; everything else is denied
sandbox = daytona.v2.create(
    network_policy={"block_all": True, "allow_domains": ["example.com", "*.daytona.io"]},
)

Block all egress

Create a sandbox with no outbound access, for code that needs no network. With blocking on and empty allow lists, the sandbox reaches no external address and DNS resolves no names.

from daytona import Daytona

daytona = Daytona()

# Deny all outbound traffic
sandbox = daytona.v2.create(network_policy={"block_all": True})

Allow IPv4 ranges

Create a sandbox that reaches only specific IPv4 addresses and ranges, in the network allow list format. An IPv4 allow list applies only when blocking is on, so turn it on explicitly. Without a domain allow list, DNS resolves a name only to its IPv4 addresses inside the allowed ranges, and a name with no address in them resolves to no address. IPv6 lookups are refused.

from daytona import Daytona

daytona = Daytona()

# Allow one address and one subnet; everything else is denied
sandbox = daytona.v2.create(
    network_policy={"block_all": True, "allow_cidrs": ["1.1.1.1/32", "208.80.152.0/22"]},
)

Allow domains

Create a sandbox that reaches only specific hosts by name, in the domain allow list format. The sandbox resolves and connects to the listed domains; a wildcard covers every subdomain of a host but not the host itself. The domain list turns blocking on by itself.

from daytona import Daytona

daytona = Daytona()

# Allow a host and all of its subdomains; everything else is denied
sandbox = daytona.v2.create(
    network_policy={"allow_domains": ["pythonhosted.org", "*.pythonhosted.org", "pypi.org"]},
)

Network allow list format

Allow outbound traffic to specific IPv4 addresses and ranges. Each entry on the network allow list is a single address or a CIDR block, and the sandbox can reach it on any port. With a domain allow list, ports 80 and 443 still need a listed hostname, whatever address the sandbox connects to: a web request that names a host not on the domain allow list is refused with 403, even when its address is on the network allow list, and UDP port 443 is blocked. The list takes effect only when blocking is on. The SDKs, the API, and the CLI reject a non-empty list unless blocking or a domain allow list is set; the API returns 400.

Domain allow list format

Allow outbound traffic to specific hosts by name. Each entry is a hostname, or a wildcard covering a hostname's subdomains. A domain allow list turns blocking on by itself.

DNS is filtered as well: the sandbox resolves only the names on the list and refuses all others. A policy with only IPv4 entries resolves a name only to its addresses inside the allowed ranges, and a policy with empty lists resolves no names at all.

The domain allow list also covers web traffic to the addresses on the network allow list. On ports 80 and 443, the sandbox reaches a host only by a name on the domain allow list, and connecting to a listed IPv4 address does not change which host it reaches.

Operations

The SDKs and the API get, update, and reset the network policy of an existing sandbox. The CLI sets a policy only when it creates a sandbox.

Get network policy

Get the network policy of a sandbox. The response carries two policies: the desired policy, which is the last one you set, and the applied policy, which the sandbox currently enforces. A change is applied in the background, so the two differ until the sandbox catches up. The response also carries an ETag that identifies the current revision; an update or reset must send it back.

from daytona import Daytona

daytona = Daytona()
sandbox = daytona.v2.create()

policy = sandbox.get_network_policy()
print(policy.status, policy.desired, policy.applied, policy.etag)

Update network policy

Replace the whole network policy of an existing sandbox, with the same fields and rules as at create time. The sandbox must be running, paused, or stopped. The new policy is stored at once and applied in the background; get the policy to see when it takes effect.

Every update sends the ETag of the revision it replaces. If the policy changed since, the update is rejected instead of overwriting it; get the policy and retry with the new ETag.

from daytona import Daytona

daytona = Daytona()
sandbox = daytona.v2.create()

current = sandbox.get_network_policy()
updated = sandbox.update_network_policy(
    network_policy={"block_all": True, "allow_domains": ["pypi.org", "files.pythonhosted.org"]},
    if_match=current.etag,
)
print(updated.status)  # pending until the sandbox applies it

Reset network policy

Reset the network policy of a sandbox to open egress. A reset removes the restrictions but keeps the revision history, so it follows the same ETag rules as an update.

from daytona import Daytona

daytona = Daytona()
sandbox = daytona.v2.create()

current = sandbox.get_network_policy()
sandbox.reset_network_policy(if_match=current.etag)

Test network access

Run the commands inside the sandbox. They test the allow lists only when blocking is on: a sandbox without a network policy has open egress, so both commands succeed. With blocking on, each command succeeds only when its target is on the sandbox's allow list.

# Test HTTP connectivity to an allowed address; needs 208.80.152.0/22 on the network allow list
curl -I http://208.80.154.232

# Test HTTP connectivity to an allowed domain; needs example.com on the domain allow list
curl -I https://example.com

Permissions

Network policies use the sandbox permissions of the project, which you can grant to an organization role or an API key.

The audit logs record network policy updates.