.svg?fit=max&auto=format&n=nM2mZJMU7uXYPkZS&q=85&s=29b612f62877b603dd94f96feb774d3f)
.svg?fit=max&auto=format&n=nM2mZJMU7uXYPkZS&q=85&s=2d9f7d66947850756a7dab066026f65a)
NetworkPolicy
Static factory for creating preset network policies.NetworkPolicy.allowAll()
| Type | Description |
|---|---|
NetworkConfig | Network configuration |
NetworkPolicy.none()
exec and fs still work since they use the host-guest channel, not the network.
Returns
| Type | Description |
|---|---|
NetworkConfig | Network configuration |
NetworkPolicy.publicOnly()
| Type | Description |
|---|---|
NetworkConfig | Network configuration |
Types
NetworkConfig
Network configuration object passed asSandboxConfig.network. Use NetworkPolicy presets for common cases, or build a custom configuration with rules.
| Field | Type | Default | Description |
|---|---|---|---|
| blockDomains? | Array<string> | [] | Block DNS for exact domains (returns NXDOMAIN) |
| blockDomainSuffixes? | Array<string> | [] | Block DNS for all subdomains of a suffix |
| defaultAction? | PolicyAction | 'allow' | Action when no rule matches |
| dnsRebindProtection? | boolean | true | Block DNS responses resolving to private IPs |
| maxConnections? | number | - | Maximum concurrent connections |
| policy? | string | - | Preset name (set automatically by NetworkPolicy.*()) |
| rules? | Array<PolicyRule> | [] | Custom rules evaluated first-match-wins |
| tls? | TlsConfig | - | TLS interception configuration |
PolicyAction
| Value | Description |
|---|---|
'allow' | Permit the traffic |
'deny' | Drop the traffic silently |
PolicyDirection
| Value | Description |
|---|---|
'inbound' | Traffic entering the sandbox (via published ports) |
'outbound' | Traffic leaving the sandbox |
PolicyProtocol
| Value | Description |
|---|---|
'icmpv4' | ICMPv4 traffic |
'icmpv6' | ICMPv6 traffic |
'tcp' | TCP traffic |
'udp' | UDP traffic |
PolicyRule
A single network policy rule.| Field | Type | Description |
|---|---|---|
| action | PolicyAction | What to do when this rule matches |
| destination? | string | Target filter: 'any', 'private', 'loopback', 'metadata', 'multicast', 'link-local', or a CIDR like '10.0.0.0/8' |
| direction? | PolicyDirection | Traffic direction |
| port? | string | Single port ("443") or range ("8000-9000") |
| protocol? | PolicyProtocol | Protocol filter |
TlsConfig
TLS interception settings withinNetworkConfig.
| Field | Type | Default | Description |
|---|---|---|---|
| blockQuic? | boolean | true | Block QUIC/HTTP3 (UDP) on intercepted ports, forcing TCP/TLS fallback |
| bypass? | Array<string> | [] | Domains to skip interception. Supports *.suffix wildcards. Use for domains with certificate pinning. |
| interceptCaCert? | string | - | Path to a custom interception CA certificate PEM file |
| interceptCaKey? | string | - | Path to a custom interception CA private key PEM file |
| interceptedPorts? | Array<number> | [443] | TCP ports where TLS interception is active |
| upstreamCaCert? | Array<string> | [] | Paths to additional trusted CA PEM files for upstream verification |
| verifyUpstream? | boolean | true | Verify upstream server certificates. Set to false only for self-signed servers. |