Network Metadata Blocking

What You’ll Learn

That 169.254.169.254 is blocked by default on every Declaw sandbox — no opt-in required
Verifying the metadata endpoint is unreachable (SSRF protection)
Verifying normal internet access still works in the same sandbox
How to add an explicit deny_out rule as belt-and-suspenders documentation of intent
Understanding why blocking the metadata service matters

Why This Matters

In cloud environments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 can expose:

IAM credentials and access tokens
Instance identity documents
User data scripts (which may contain secrets)
Network configuration details

An SSRF vulnerability could allow untrusted code inside a sandbox to reach this endpoint and steal credentials. Declaw blocks 169.254.169.254 by default — it is a hardcoded rule applied to every sandbox, so the metadata endpoint is never reachable even with no network policy set. Adding 169.254.169.254/32 to deny_out is therefore redundant; the example below uses it to make the intent explicit and to verify the default protection holds, not to provide it.

Prerequisites

export DECLAW_API_KEY="your-api-key"
export DECLAW_DOMAIN="your-declaw-instance.example.com:8080"

This example is available in Python. TypeScript version coming soon.

Code Walkthrough

The metadata IP is already blocked by default. The explicit deny_out rule below documents that intent and lets you assert it in tests — it does not change the behavior:

from declaw import Sandbox

# 169.254.169.254 is blocked by default; this deny_out rule is belt-and-suspenders.
sbx = Sandbox.create(
    template="python",
    timeout=300,
    network={"deny_out": ["169.254.169.254/32"]},
)

The metadata test script tries to open a TCP connection to port 80 on the metadata IP:

METADATA_TEST = """
import socket
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("169.254.169.254", 80))
    s.close()
    print("CONNECTED")
except Exception as e:
    print(f"BLOCKED: {e}")
"""

Test 1 — metadata endpoint should be blocked:

sbx.files.write("/tmp/meta_test.py", METADATA_TEST)
result = sbx.commands.run("python3 /tmp/meta_test.py", timeout=15)
print(f"  Output: {result.stdout.strip()}")

if "BLOCKED" in result.stdout:
    print("  [PASS] Cloud metadata endpoint blocked (SSRF mitigated).")
else:
    print("  [INFO] Metadata endpoint may not exist in this environment,")
    print("         but the deny rule is still applied.")

Test 2 — normal internet should still work (only metadata is denied):

INTERNET_TEST = """
import socket
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("1.1.1.1", 80))
    s.close()
    print("CONNECTED")
except Exception as e:
    print(f"BLOCKED: {e}")
"""

sbx.files.write("/tmp/inet_test.py", INTERNET_TEST)
result = sbx.commands.run("python3 /tmp/inet_test.py", timeout=15)

if "CONNECTED" in result.stdout:
    print("  [PASS] Normal internet access works (only metadata blocked).")

Expected Output

============================================================
Network Metadata Blocking Example (SSRF Protection)
============================================================

--- Creating sandbox with deny_out=[169.254.169.254/32] ---
Sandbox created: sbx_abc123

--- Test 1: Connect to metadata endpoint (should FAIL) ---
  Output: BLOCKED: timed out
  [PASS] Cloud metadata endpoint blocked (SSRF mitigated).

--- Test 2: Connect to normal internet (should SUCCEED) ---
  Output: CONNECTED
  [PASS] Normal internet access works (only metadata blocked).

--- Why Metadata Blocking Matters ---
  Cloud metadata services (169.254.169.254) expose:
    - IAM credentials and access tokens
    - Instance identity documents
    - Network configuration
  SSRF attacks trick apps into querying this endpoint.
  Blocking it prevents credential theft from compromised sandboxes.

--- Cleaning Up ---
  Sandbox sbx_abc123 killed.

============================================================
Done!
============================================================

Getting Started

Built-in Templates

Commands

PTY

OpenAI Agents

Filesystem

Volumes

Network Policies

PII Protection

Security Features

LLM Providers

Framework Integrations

Agent-in-Sandbox

Real-World Patterns

Security Demos

Network Metadata Blocking

What You’ll Learn

Why This Matters

Prerequisites

Code Walkthrough

Expected Output

​What You’ll Learn

​Why This Matters

​Prerequisites

​Code Walkthrough

​Expected Output

What You’ll Learn

Why This Matters

Prerequisites

Code Walkthrough

Expected Output