Networking

import { NetworkPolicy, Rule, Destination } from "microsandbox";

// Custom policy literal
const custom = {
  defaultEgress: "deny",
  defaultIngress: "allow",
  rules: [
    Rule.allowEgress(Destination.domain("api.openai.com")),
    Rule.denyEgress(Destination.group("metadata")),
  ],
};

// Or via the builder
const built = NetworkPolicy.builder()
  .defaultDeny()
  .egress((e) => e.tcp().port(443).allowPublic())
  .build();

const policy = {
  defaultEgress: "deny",
  defaultIngress: "allow",
  rules: [
    Rule.allowEgress(Destination.cidr("10.0.0.0/8")),  // matches everything in 10.x
    Rule.denyEgress(Destination.cidr("10.0.0.5/32")),  // never reached
  ],
};

WARN rule #1 (Egress Cidr(10.0.0.5/32) Deny) is shadowed by rule #0 (Egress Cidr(10.0.0.0/8) Allow); to narrow, place the more specific rule first

NetworkPolicy.builder()
  .egress((r) => r
    .tcp().port(443).allowPublic()    // rule 1: egress, TCP, 443, allow Public
    .udp().allowPrivate()             // rule 2: egress, [TCP, UDP], 443, allow Private
  )
  .build();

static allowAll(): NetworkPolicy

static builder(): NetworkPolicyBuilder

static none(): NetworkPolicy

static nonLocal(): NetworkPolicy

static publicOnly(): NetworkPolicy

import { NetworkPolicy } from "microsandbox";

const policy = NetworkPolicy.builder()
  .defaultDeny()
  .egress((e) => e.tcp().port(443).allowPublic().allowPrivate())
  .rule((r) => r.any().deny((d) => d.ip("198.51.100.5")))
  .build();

any(configure: (r: RuleBuilder) => RuleBuilder): this

build(): NetworkPolicy

defaultAllow(): this

defaultDeny(): this

defaultEgress(action: "allow" | "deny"): this

defaultIngress(action: "allow" | "deny"): this

egress(configure: (r: RuleBuilder) => RuleBuilder): this

ingress(configure: (r: RuleBuilder) => RuleBuilder): this

rule(configure: (r: RuleBuilder) => RuleBuilder): this

any(): this

egress(): this

ingress(): this

icmpv4(): this

icmpv6(): this

tcp(): this

udp(): this

port(port: number): this

portRange(lo: number, hi: number): this

ports(ports: number[]): this

allowHost(): this

allowLinkLocal(): this

allowLoopback(): this

allowMeta(): this

allowMulticast(): this

allowPrivate(): this

allowPublic(): this

denyHost(): this

denyLinkLocal(): this

denyLoopback(): this

denyMeta(): this

denyMulticast(): this

denyPrivate(): this

denyPublic(): this

allowDomain(name: string): this

allowDomainSuffix(suffix: string): this

allowDomainSuffixes(suffixes: string[]): this

allowDomains(names: string[]): this

denyDomain(name: string): this

denyDomainSuffix(suffix: string): this

denyDomainSuffixes(suffixes: string[]): this

denyDomains(names: string[]): this

allowLocal(): this

denyLocal(): this

NetworkPolicy.builder()
  .egress((r) => r
    .tcp().port(443).allow((d) => d.domain("api.example.com"))
    .deny((d) => d.cidr("198.51.100.0/24"))
  )
  .build();

allow(configure: (d: RuleDestinationBuilder) => RuleDestinationBuilder): this

deny(configure: (d: RuleDestinationBuilder) => RuleDestinationBuilder): this

static allowAny(destination: Destination): Rule

static allowEgress(destination: Destination): Rule

static allowIngress(destination: Destination): Rule

static denyAny(destination: Destination): Rule

static denyEgress(destination: Destination): Rule

static denyIngress(destination: Destination): Rule

static allowDns(): Rule

static any(): Destination

static cidr(cidr: string): Destination

static domain(domain: string): Destination

static domainSuffix(suffix: string): Destination

static group(group: DestinationGroup): Destination

static range(start: number, end: number): PortRange

static single(port: number): PortRange

denyDomainSuffixes(...suffixes: string[]): this

denyDomains(...names: string[]): this

dns(f: (d: DnsBuilder) => DnsBuilder): this

enabled(b: boolean): this

maxConnections(n: number): this

onSecretViolation(action: ViolationAction): this

policy(policy: NetworkPolicy): this

port(host: number, guest: number): this

portUdp(host: number, guest: number): this

secret(f: (s: SecretBuilder) => SecretBuilder): this

secretEnv(envVar: string, value: string, placeholder: string, allowedHost: string): this

tls(f: (t: TlsBuilder) => TlsBuilder): this

trustHostCAs(enabled: boolean): this

nameservers(servers: string[]): this

queryTimeoutMs(ms: number): this

rebindProtection(enabled: boolean): this

blockQuic(block: boolean): this

bypass(pattern: string): this

interceptCaCert(path: string): this

interceptCaKey(path: string): this

interceptedPorts(ports: number[]): this

upstreamCaCert(path: string): this

verifyUpstream(verify: boolean): this

interface NetworkPolicy {
  readonly defaultEgress: Action;
  readonly defaultIngress: Action;
  readonly rules: readonly Rule[];
}

interface Rule {
  readonly direction: Direction;
  readonly destination: Destination;
  readonly protocols: readonly Protocol[]; // empty = any
  readonly ports: readonly PortRange[];    // empty = any
  readonly action: Action;
}

type Destination =
  | { kind: "any" }
  | { kind: "cidr"; cidr: string }
  | { kind: "domain"; domain: string }
  | { kind: "domainSuffix"; suffix: string }
  | { kind: "group"; group: DestinationGroup };

type Action = "allow" | "deny";

type Direction = "egress" | "ingress" | "any";

type Protocol = "tcp" | "udp" | "icmpv4" | "icmpv6";

type DestinationGroup =
  | "public"
  | "loopback"
  | "private"
  | "link-local"
  | "metadata"
  | "multicast"
  | "host";

interface PortRange {
  readonly start: number;
  readonly end: number;
}

interface PublishedPort {
  readonly hostPort: number;
  readonly guestPort: number;
  readonly protocol: "tcp" | "udp";
}