# What is egress control?

Egress control decides which outbound network connections a machine may make: none, only named hosts, or everything but a deny list.

**On Runtime every sandbox's outbound traffic passes through a proxy on the
host, outside the microVM, so root inside the sandbox cannot go around the
rules.** A sandbox has no network card. Rules can be set at create or at any
time after, and apply at once, to connections already open too
([the sandbox environment](/docs/sandbox-environment#the-network)).

## Why it matters for AI agents

Code an agent writes, or a package it installs, can try to send your data out.
A prompt injection in a web page or a file can tell the agent to post secrets
to an address the attacker controls. Isolation keeps that code off your host;
egress control decides whether it can reach anyone else. It also stops a
sandbox from reaching your private network and internal addresses.

Most agent tasks need some internet: a package registry, a model API, a Git
host. Egress control lets you allow exactly those and refuse the rest.

## Runtime's egress rules

| Rule or limit                   | What it does                                                                         |
| ------------------------------- | ------------------------------------------------------------------------------------ |
| `internet: false`               | Refuses every outbound connection                                                    |
| `allow`                         | Narrows the sandbox to domains, `*.domain`, addresses or CIDR ranges                 |
| `deny`                          | Refuses the listed destinations; a deny always wins                                  |
| `connect`                       | Adds `host:port` pairs beyond the web ports, such as `github.com:22`                 |
| Private addresses               | Always refused, whatever the rules say                                               |
| Ports                           | Any port on paid accounts; 80 and 443 on the free trial                              |
| Mail ports                      | 25, 465 and 587 closed unless support enables mail for the account                   |
| Protocols                       | TCP; on paid sandboxes also QUIC (UDP 443) and NTP (UDP 123); DNS is answered inside |
| Programs without proxy settings | Their TCP connections go to the same proxy on their own                              |

Each sandbox also has limits on concurrent connections, bandwidth and bytes per
day, so one sandbox cannot crowd out others ([security](/docs/security#network-access)).

## Set the rules

```ts check
import { Sandbox } from "withruntime";

await using sbx = await Sandbox.create({
  network: { internet: true, allow: ["pypi.org", "*.pythonhosted.org"] },
});
await sbx.exec("pip install requests", { check: true, timeoutMs: 120_000 });
await sbx.network.set({ internet: false }); // off before untrusted code runs
console.log(await sbx.network.get());
```

```python check
from withruntime import Sandbox

with Sandbox.create(network={"internet": True, "allow": ["pypi.org", "*.pythonhosted.org"]}) as sbx:
    sbx.exec("pip install requests", timeout_ms=120_000)
    sbx.network.set(internet=False)
    print(sbx.network.get())
```

## Keys the sandbox never holds

Egress control has a second use: letting code call an API without holding its
key. Store the key as a Runtime secret with the hosts it may go to. The sandbox
sees a placeholder, and the host's proxy puts the real value into HTTPS
requests to those hosts only. A request anywhere else carries the worthless
placeholder, so a prompt injection cannot leak the key
([secrets](/docs/security#secrets-sandboxes-never-see)).

## Related

- [How to turn off a sandbox's internet](/how-to/turn-off-sandbox-internet)
- [How to run untrusted code from an LLM safely](/use-cases/run-untrusted-llm-code)
- [What is an agent sandbox?](/glossary/agent-sandbox)
- [Security](/docs/security)

Facts on this page were checked on 25 September 2026.