On Runtime, every sandbox's outbound traffic passes through a proxy on the host, outside the microVM. Root inside the sandbox cannot go around the rules. A sandbox has no network card. You can set rules when you create a sandbox, or at any time later. They apply immediately, including to connections already open (the sandbox environment).
Why it matters for AI agents
Code an agent writes, or a package it installs, can try to send your data out. A prompt injection in a web page or a file can tell the agent to post secrets to an address the attacker controls. Isolation keeps that code off your host. Egress control decides whether it can reach anyone else. It also stops a sandbox from reaching your private network and internal addresses.
Most agent tasks need some internet: a package registry, a model API, a Git host. Egress control lets you allow exactly those and refuse the rest.
Runtime's egress rules
| Rule or limit | What it does |
|---|---|
internet: false |
Refuses every outbound connection; with an allow list, everything but the list |
allow |
Narrows the sandbox to domains, *.domain, addresses or CIDR ranges |
deny |
Refuses the listed destinations; a deny always wins |
connect |
Adds host:port pairs beyond the web ports, such as github.com:22 |
| Private addresses | Always refused, whatever the rules say |
| Ports | Any port on paid accounts; 80 and 443 without credit |
| Mail ports | 25, 465 and 587 closed unless support enables mail for the account |
| Protocols | TCP; on paid sandboxes also UDP to any public address and port; DNS is handled inside |
| Programs without proxy settings | Their TCP connections go to the same proxy on their own |
Each sandbox also has limits on concurrent connections, bandwidth and bytes per day. So one sandbox cannot crowd out others (security).
Set the rules
TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ network: { internet: true, allow: ["pypi.org", "*.pythonhosted.org"] },});await sbx.exec("pip install requests", { check: true, timeoutMs: 120_000 });await sbx.network.set({ internet: false }); // off before untrusted code runsconsole.log(await sbx.network.get());Pythonfrom withruntime import Sandboxwith Sandbox.create(network={"internet": True, "allow": ["pypi.org", "*.pythonhosted.org"]}) as sbx: sbx.exec("pip install requests", timeout_ms=120_000) sbx.network.set(internet=False) print(sbx.network.get())Keys the sandbox never holds
Egress control has a second use. It lets code call an API without holding the API key. Store the key as a Runtime secret, with the hosts it may go to. The sandbox sees only a placeholder. The host's proxy puts the real value into HTTPS requests to those hosts only. A request to any other host carries the placeholder, which is useless to an attacker. So a prompt injection cannot leak the key (secrets).
Related
- How to turn off a sandbox's internet
- How to run untrusted code from an LLM safely
- What is an agent sandbox?
- Security
Facts on this page were checked on 25 October 2026.