Skip to content

Update from code changes: document sandbox egress allowlists #437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mintlify wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Update from code changes: document sandbox egress allowlists #437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fe85b28
docs: document sandbox egress allowlists
mintlify[bot] Jul 27, 2026
c58644e
docs: note cluster-level egress enforcement toggle
mintlify[bot] Jul 28, 2026
eaf8b4d
Merge remote-tracking branch 'origin/main' into mintlify/9166e654
mintlify[bot] Jul 28, 2026
d03fd79
docs: reconcile egress allowlist docs with in-cluster service entries
mintlify[bot] Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions sandbox/sdk/python/reference.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ Arguments:
| `tags` | `dict[str, str] \| None` | Key-value labels for finding related sandboxes. |
| `volume_mounts` | `dict[str, str] \| None` | Volume IDs keyed by absolute mount path inside the sandbox. |
| `networking` | `list[SandboxNetworkingSpec] \| None` | Port to expose and, optionally, the domain and visibility to serve it on. Omit to expose nothing. See [Sandbox Networking](/sandboxes/networking). |
| `egress` | `SandboxEgressSpec \| None` | Restricts the sandbox's outbound traffic to a list of allowed destinations (hostnames, wildcards, IP literals, CIDR ranges, or in-cluster Service DNS names). Omit to leave internet access unrestricted. See [Restrict egress with an allowlist](/sandboxes/networking#restrict-egress-with-an-allowlist). |
| `ttl_seconds` | `int \| None` | Maximum lifetime in seconds, counted from creation. The sandbox is terminated once it elapses. Omit for no limit. See [sandbox lifetime](/sandboxes/overview#sandbox-lifetime). |

Returns a `Sandbox` handle.
Expand Down
1 change: 1 addition & 0 deletions sandbox/sdk/typescript/reference.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ Options:
| `tags` | `Record<string, string> \| undefined` | Key-value labels for finding related sandboxes. |
| `volume_mounts` | `Record<string, string> \| undefined` | Volume IDs keyed by absolute mount path inside the sandbox. |
| `networking` | `SandboxNetworkingSpec[] \| undefined` | Port to expose and, optionally, the domain and visibility to serve it on. Omit to expose nothing. See [Sandbox Networking](/sandboxes/networking). |
| `egress` | `SandboxEgressSpec \| undefined` | Restricts the sandbox's outbound traffic to a list of allowed destinations (hostnames, wildcards, IP literals, CIDR ranges, or in-cluster Service DNS names). Omit to leave internet access unrestricted. See [Restrict egress with an allowlist](/sandboxes/networking#restrict-egress-with-an-allowlist). |
| `ttl_seconds` | `number \| undefined` | Maximum lifetime in seconds, counted from creation. The sandbox is terminated once it elapses. Omit for no limit. See [sandbox lifetime](/sandboxes/overview#sandbox-lifetime). |

Returns a `Sandbox` handle.
Expand Down
2 changes: 1 addition & 1 deletion sandboxes/networking.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Sandboxes run untrusted code, so their outbound traffic is isolated by default,
| ----------- | --------- |
| Public internet | Yes |
| Cluster DNS | Yes |
| In-cluster services and other pods (including other sandboxes) | No |
| In-cluster services and other pods (including other sandboxes) | No (unless allowlisted, see below) |
| Kubernetes API server and the sandbox control plane | No |
| Cloud metadata endpoint (`169.254.169.254`) | No |
| Private address space (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `100.64.0.0/10`) | No |
Expand Down