Networking

Each sandbox runs in its own Linux network namespace with a dedicated TAP device and veth pair. Outbound traffic passes through a Layer-7 TCP proxy that enforces your network policy before packets reach the internet.

Default behavior

By default, sandboxes have unrestricted outbound internet access. Any public domain or IP is reachable. Two things are always blocked, regardless of policy: cloud metadata endpoints, and private address ranges (RFC 1918, carrier-grade NAT, link-local), which sandboxes have no legitimate reason to reach.

Block all outbound traffic

ALL_TRAFFIC is a constant equal to "0.0.0.0/0". Adding it to deny_out blocks everything.

Python
TypeScript

from declaw import Sandbox, ALL_TRAFFIC

sbx = Sandbox.create(
    network={"deny_out": [ALL_TRAFFIC]}
)

# This will fail — no outbound traffic allowed
result = sbx.commands.run("curl -s https://example.com")
print(result.exit_code)  # non-zero

import { Sandbox, ALL_TRAFFIC } from '@declaw/sdk';

const sbx = await Sandbox.create({
  network: { denyOut: [ALL_TRAFFIC] },
});

Domain allowlist

Allow only specific domains and block everything else.

Python
TypeScript

from declaw import Sandbox, ALL_TRAFFIC

sbx = Sandbox.create(
    network={
        "allow_out": ["api.openai.com", "pypi.org"],
        "deny_out": [ALL_TRAFFIC],
    }
)

# This works — pypi.org is allowed
result = sbx.commands.run("pip install requests")

# This is blocked
result = sbx.commands.run("curl -s https://google.com")

const sbx = await Sandbox.create({
  network: {
    allowOut: ['api.openai.com', 'pypi.org'],
    denyOut: [ALL_TRAFFIC],
  },
});

Wildcard domain matching

Use *. prefix to match all subdomains.

sbx = Sandbox.create(
    network={
        "allow_out": [
            "*.openai.com",        # api.openai.com, platform.openai.com, etc.
            "*.anthropic.com",     # api.anthropic.com, etc.
            "*.github.com",        # api.github.com, raw.githubusercontent.com, etc.
            "pypi.org",            # exact match only
        ],
        "deny_out": [ALL_TRAFFIC],
    }
)

When domain filtering is enabled, DNS queries to 8.8.8.8 are automatically allowed so that domain resolution works. You do not need to add it manually.

IP and CIDR rules

Use IP addresses or CIDR ranges directly when you know the destination IPs.

sbx = Sandbox.create(
    network={
        "deny_out": [ALL_TRAFFIC],
        "allow_out": [
            "1.1.1.1",        # exact IP
            "8.8.8.0/24",     # CIDR range
        ],
    }
)

Combined domains and IPs

Domain and IP rules can be mixed in the same allow_out list.

sbx = Sandbox.create(
    network={
        "allow_out": [
            "*.openai.com",
            "8.8.8.8",           # Google DNS (by IP)
        ],
        "deny_out": [ALL_TRAFFIC],
    }
)

Priority rules

Allow rules always take precedence over deny rules, regardless of order.

The evaluation order is:

If the destination matches any allow_out entry, the connection is permitted.
If the destination matches any deny_out entry, the connection is rejected.
If no rule matches, the connection is permitted by default (unless deny_out=[ALL_TRAFFIC]).

SandboxNetworkOpts model

Field	Type	Description
`allow_out`	`list[str]`	Domains, IPs, or CIDRs to allow
`deny_out`	`list[str]`	IPs or CIDRs to deny; use `ALL_TRAFFIC` to deny everything. Domain names are rejected here (the create returns `400`) — restrict domains with `allow_out`
`mask_request_host`	`str \| None`	Override the `Host` header on outbound requests

Host header masking

Use mask_request_host to override the Host header on all outbound requests. Useful when routing traffic through an internal proxy.

sbx = Sandbox.create(
    network={"mask_request_host": "internal-proxy.company.com"}
)

How enforcement works

Domain and IP rules are enforced at two layers:

Layer 3/4: IP and CIDR rules are applied as kernel-level DROP rules with no userspace proxy overhead.
Layer 7 (TCP proxy): For domain-based rules, all TCP traffic is redirected to the per-namespace proxy. HTTP Host headers and TLS SNI fields are inspected before forwarding.

Domain allowlists apply to TCP only (ports 80 and 443, inspected by SNI/Host). UDP and QUIC (HTTP/3) to the addresses a domain resolves to are dropped — a domain rule never permits UDP, because the proxy can only tell one site from another on a shared CDN address over TCP. To allow UDP to a destination, list its IP or CIDR in allow_out (an IP entry permits every protocol to that address).When a content scanner (PII, prompt injection, etc.) is enabled, outbound HTTP/3 (UDP/443) is blocked — including to IPs and CIDRs listed in allow_out — so requests fall back to TCP, where the scanners run. Other UDP is unaffected.

Block cloud metadata service

Cloud instances expose a metadata endpoint at 169.254.169.254. This is automatically blocked in all sandboxes to prevent SSRF attacks.

# This is always blocked, even with no network policy configured
result = sbx.commands.run("curl -s http://169.254.169.254/latest/meta-data/")
print(result.exit_code)  # non-zero (connection refused)

Inbound traffic (port proxy)

The network policy controls outbound traffic. For inbound HTTP access to ports inside a sandbox, see Port Proxy. Inbound access is gated by the allow_public_traffic field in NetworkPolicy (defaults to true).

Using SecurityPolicy network configuration

For richer network control integrated with PII scanning and audit logging, use NetworkPolicy inside a SecurityPolicy:

from declaw import Sandbox, SecurityPolicy, NetworkPolicy, ALL_TRAFFIC

policy = SecurityPolicy(
    network=NetworkPolicy(
        allow_out=["*.openai.com", "*.anthropic.com", "pypi.org"],
        deny_out=[ALL_TRAFFIC],
        allow_public_traffic=False,
    ),
    audit=True,
)

sbx = Sandbox.create(security=policy)

Getting Started

Core Features

CLI

Security

Platform

Deployment

Architecture

Default behavior

Block all outbound traffic

Domain allowlist

Wildcard domain matching

IP and CIDR rules

Combined domains and IPs

Priority rules

SandboxNetworkOpts model

Host header masking

How enforcement works

Block cloud metadata service

Inbound traffic (port proxy)

Using SecurityPolicy network configuration

​Default behavior

​Block all outbound traffic

​Domain allowlist

​Wildcard domain matching

​IP and CIDR rules

​Combined domains and IPs

​Priority rules

​SandboxNetworkOpts model

​Host header masking

​How enforcement works

​Block cloud metadata service

​Inbound traffic (port proxy)

​Using SecurityPolicy network configuration

Default behavior

Block all outbound traffic

Domain allowlist

Wildcard domain matching

IP and CIDR rules

Combined domains and IPs

Priority rules

SandboxNetworkOpts model

Host header masking

How enforcement works

Block cloud metadata service

Inbound traffic (port proxy)

Using SecurityPolicy network configuration