> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Domain Allowlist

> Configure a Declaw sandbox to allow outbound traffic only to specific domains, blocking everything else.

## What You'll Learn

* Creating a sandbox with `network={"allow_out": ["api.github.com"]}`
* Understanding how `allow_out` creates an implicit deny-all for unmatched destinations
* Verifying that non-allowlisted destinations are blocked
* Inspecting sandbox info to confirm the policy was applied

## How It Works

The `allow_out` parameter accepts domain names (e.g., `"api.github.com"`, `"*.google.com"`) and IP/CIDR ranges. When an allowlist is set, only traffic to those destinations is permitted; all other outbound traffic is denied.

<Note>
  Domain-based allowlisting requires DNS resolution at the firewall level. In some environments this may not be fully functional. The sandbox is always created with the policy stored and returned regardless.
</Note>

## Prerequisites

<Snippet file="snippets/env-setup.mdx" />

<Note>This example is available in Python. TypeScript version coming soon.</Note>

## Code Walkthrough

Pass the `network` dict with `allow_out` at sandbox creation time:

```python theme={null}
from declaw import Sandbox

sbx = Sandbox.create(
    template="python",
    timeout=300,
    network={"allow_out": ["api.github.com"]},
)
print(f"Sandbox created: {sbx.sandbox_id}")
```

The test script uses a raw TCP socket to verify blocking:

```python theme={null}
NET_TEST_SCRIPT = """
import socket
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("{host}", {port}))
    s.close()
    print("CONNECTED")
except Exception as e:
    print(f"BLOCKED: {{e}}")
"""
```

Test that a non-allowlisted IP is blocked:

```python theme={null}
script = NET_TEST_SCRIPT.format(host="1.1.1.1", port=80)
sbx.files.write("/tmp/net_test.py", script)
result = sbx.commands.run("python3 /tmp/net_test.py", timeout=15)
print(f"  Output: {result.stdout.strip()}")

if "BLOCKED" in result.stdout:
    print("  [PASS] Non-allowlisted destination was blocked.")
else:
    print("  [INFO] Connection was not blocked — domain allowlisting")
    print("         requires firewall-level DNS resolution.")
```

Verify the policy is stored by inspecting sandbox info:

```python theme={null}
info = sbx.get_info()
print(f"  Sandbox ID: {info.sandbox_id}")
print(f"  State: {info.state}")
print("  Network policy: allow_out=['api.github.com']")
print("  [PASS] Sandbox created with domain allowlist policy.")
```

## Expected Output

```
============================================================
Network Domain Allowlist Example
============================================================

--- Creating sandbox with allow_out=[api.github.com] ---
Sandbox created: sbx_abc123

--- Test 1: Connect to non-allowlisted IP (1.1.1.1:80) ---
  Output: BLOCKED: timed out
  [PASS] Non-allowlisted destination was blocked.

--- Test 2: Verify policy via sandbox info ---
  Sandbox ID: sbx_abc123
  State: running
  Network policy: allow_out=['api.github.com']
  [PASS] Sandbox created with domain allowlist policy.

--- How Domain Allowlisting Works ---
  When fully enforced, only traffic to api.github.com is allowed.
  All other outbound connections (HTTP, HTTPS, raw TCP) are blocked.
  DNS queries for the allowlisted domain are automatically permitted.

--- Cleaning Up ---
  Sandbox sbx_abc123 killed.

============================================================
Done!
============================================================
```