Control internet access
On or off#
import { Sandbox } from 'e2b'
const sandbox = await Sandbox.create({ allowInternetAccess: true }) // default
const isolated = await Sandbox.create({ allowInternetAccess: false })from e2b import Sandbox
sandbox = Sandbox.create(allow_internet_access=True) # default
isolated = Sandbox.create(allow_internet_access=False)Allow only what the job needs#
Deny all traffic, then allow specific domains, wildcard subdomains, IPs or CIDR blocks. Allow rules always win over deny rules. When you allow any domain, the default nameserver 8.8.8.8 is allowed automatically so DNS keeps working.
const sandbox = await Sandbox.create({
network: {
allowOut: ['api.example.com', '*.github.com', '8.8.8.8'],
denyOut: ({ allTraffic }) => [allTraffic], // allTraffic === '0.0.0.0/0'
},
})sandbox = Sandbox.create(
network={
"allow_out": ["api.example.com", "*.github.com", "8.8.8.8"],
"deny_out": lambda ctx: [ctx.all_traffic], # "0.0.0.0/0"
}
)Hostname rules match HTTP Host on port 80 and TLS SNI on port 443 — they apply to HTTP(S) only. Use CIDR rules for other protocols.
Change rules on a running sandbox#
updateNetwork / update_network replaces the whole egress configuration. It does not merge with the rules already in place.
await sandbox.updateNetwork({
denyOut: ({ allTraffic }) => [allTraffic],
allowOut: ['api.example.com'],
})
// Or cut internet access without recreating the sandbox
await sandbox.updateNetwork({ allowInternetAccess: false })sandbox.update_network({
"deny_out": lambda ctx: [ctx.all_traffic],
"allow_out": ["api.example.com"],
})
# Or cut internet access without recreating the sandbox
sandbox.update_network({"allow_internet_access": False})Inject headers per host (beta)#
Register rules under network.rules to transform outbound requests — for example to add a header only on calls to one API, so the credential never lives inside the sandbox.
await Sandbox.create({
network: {
allowOut: ({ rules }) => [...rules.keys()],
denyOut: ({ allTraffic }) => [allTraffic],
rules: {
'api.example.com': [
{ transform: { headers: { 'X-Header': 'Content' } } },
],
},
},
})sandbox = Sandbox.create(
network={
"allow_out": lambda ctx: list(ctx.rules.keys()),
"deny_out": lambda ctx: [ctx.all_traffic],
"rules": {
"api.example.com": [
{"transform": {"headers": {"X-Header": "Content"}}},
],
},
},
)