What is egress control?
Egress control decides which outbound network connections a machine may make: none, only named hosts, or everything but a deny list.
On Runtime every sandbox's outbound traffic passes through a proxy on the host, outside the microVM, so root inside the sandbox cannot go around the rules. A sandbox has no network card. Rules can be set at create or at any time after, and apply at once, to connections already open too (the sandbox environment).
Why it matters for AI agents
Code an agent writes, or a package it installs, can try to send your data out. A prompt injection in a web page or a file can tell the agent to post secrets to an address the attacker controls. Isolation keeps that code off your host; egress control decides whether it can reach anyone else. It also stops a sandbox from reaching your private network and internal addresses.
Most agent tasks need some internet: a package registry, a model API, a Git host. Egress control lets you allow exactly those and refuse the rest.
Runtime's egress rules
| Rule or limit | What it does |
|---|---|
internet: false |
Refuses every outbound connection |
allow |
Narrows the sandbox to domains, *.domain, addresses or CIDR ranges |
deny |
Refuses the listed destinations; a deny always wins |
connect |
Adds host:port pairs beyond the web ports, such as github.com:22 |
| Private addresses | Always refused, whatever the rules say |
| Ports | Any port on paid accounts; 80 and 443 on the free trial |
| Mail ports | 25, 465 and 587 closed unless support enables mail for the account |
| Protocols | TCP; on paid sandboxes also QUIC (UDP 443) and NTP (UDP 123); DNS is answered inside |
| Programs without proxy settings | Their TCP connections go to the same proxy on their own |
Each sandbox also has limits on concurrent connections, bandwidth and bytes per day, so one sandbox cannot crowd out others (security).
Set the rules
TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ network: { internet: true, allow: ["pypi.org", "*.pythonhosted.org"] },});await sbx.exec("pip install requests", { check: true, timeoutMs: 120_000 });await sbx.network.set({ internet: false }); // off before untrusted code runsconsole.log(await sbx.network.get());Pythonfrom withruntime import Sandboxwith Sandbox.create(network={"internet": True, "allow": ["pypi.org", "*.pythonhosted.org"]}) as sbx: sbx.exec("pip install requests", timeout_ms=120_000) sbx.network.set(internet=False) print(sbx.network.get())Keys the sandbox never holds
Egress control has a second use: letting code call an API without holding its key. Store the key as a Runtime secret with the hosts it may go to. The sandbox sees a placeholder, and the host's proxy puts the real value into HTTPS requests to those hosts only. A request anywhere else carries the worthless placeholder, so a prompt injection cannot leak the key (secrets).
Related
- How to turn off a sandbox's internet
- How to run untrusted code from an LLM safely
- What is an agent sandbox?
- Security
Facts on this page were checked on 25 September 2026.