Networking and egress

​

Egress

1. The platform floor, which no setting can open: private and internal ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, loopback, link-local including the cloud metadata address 169.254.169.254, multicast and reserved ranges, and their IPv6 equivalents), names such as localhost, *.local and *.internal, and the mail and DNS-over-TLS ports 25, 465, 587, 2525 and 853.
2. Your plan’s limits. Paid plans allow the public internet by default; the free plan allows no public egress.
3. The sandbox’s own policy: the E2B fields below on create, else your team’s egress settings (see Which policy applies).

from anona import Sandbox

offline = Sandbox.create("base", allow_internet_access=False)
offline.kill()

only_pypi = Sandbox.create(
    "base",
    network={"deny_out": ["0.0.0.0/0"], "allow_out": ["pypi.org", "files.pythonhosted.org"]},
)
only_pypi.kill()

no_example = Sandbox.create("base", network={"deny_out": ["93.184.215.14/32"]})
no_example.kill()

import { Sandbox } from "@anona/sdk";

const offline = await Sandbox.create("base", { allowInternetAccess: false });
await offline.kill();

const onlyPypi = await Sandbox.create("base", {
  network: { denyOut: ["0.0.0.0/0"], allowOut: ["pypi.org", "files.pythonhosted.org"] },
});
await onlyPypi.kill();

anona-compute run --no-internet -t base -- 'echo this sandbox has no internet'

• A destination inside the platform floor is refused with 400, and so is a host name that resolves into it (this blocks DNS-rebinding tricks).
• Host names in allow_out need public egress off (deny_out: ["0.0.0.0/0"] or allow_internet_access=false), as on E2B. Wildcard names and names that do not resolve are refused for now.
• deny_out takes IPv4 addresses and CIDRs only.
• Unknown keys inside network are refused, so a typo cannot silently drop part of a policy.
• Per plan: up to 512 allow entries and 1,024 deny entries on paid plans (64 and 256 on the free plan), and at most 10 DNS servers.

​

Which policy applies

1. The network and allow_internet_access fields of its create request.
2. Its template’s policy (built-in templates have none).
3. Your organization’s team egress settings: set them on the dashboard’s Network page (owners and admins), or with PUT /v1/network.
4. Your plan’s default.

curl -sS "https://api.compute.anonalabs.com/v1/sandboxes/$SANDBOX_ID/network/effective" \
  -H "X-API-Key: $E2B_API_KEY" | jq '{source, tier, internet: .policy.allow_internet_access}'
curl -sS https://api.compute.anonalabs.com/v1/network -H "X-API-Key: $E2B_API_KEY" | jq '{tier, revision, limits}'

​

Change a running sandbox

from anona import Sandbox

with Sandbox.create("base") as sbx:
    # lock it down to one API after setup
    sbx.update_network({"deny_out": ["0.0.0.0/0"], "allow_out": ["1.1.1.1"]})

import { Sandbox } from "@anona/sdk";

const sbx = await Sandbox.create("base");
await sbx.updateNetwork({ denyOut: ["0.0.0.0/0"], allowOut: ["1.1.1.1"] });
await sbx.kill();

​

Credentials without exposing them

from anona import Sandbox

# "github_token" was stored in the dashboard's Credential vault first.
sbx = Sandbox.create(
    "base",
    network={
        "deny_out": ["0.0.0.0/0"],
        "allow_out": ["api.github.com"],
        "rules": {"api.github.com": [{"transform": {"headers": {"Authorization": "Bearer ${vault.github_token}"}}}]},
    },
)
print(sbx.commands.run("env | grep -ci token || true").stdout.strip(), "token variables in the sandbox")
sbx.kill()

import { Sandbox } from "@anona/sdk";

const sbx = await Sandbox.create("base", {
  network: {
    denyOut: ["0.0.0.0/0"],
    allowOut: ["api.github.com"],
    rules: { "api.github.com": [{ transform: { headers: { Authorization: "Bearer ${vault.github_token}" } } }] },
  },
});
await sbx.kill();

• A header value must be exactly ${vault.<name>}, optionally after Bearer or Basic . Literal values are refused, so no credential ends up in a policy.
• The first use binds the secret to that host and header. The vault page lists every binding and revokes one. Proxies cache a value for up to 60 seconds, so a rotation or revocation reaches running sandboxes within a minute.
• The same rules work in the team egress settings, so every new sandbox gets them.
• Secret names are lowercase letters, digits and _, up to 63 characters; values up to 8 KiB.

​

Ingress

​

DNS