feat: add sandbox network out configuration #1447

dobrac · 2025-11-06T16:00:55Z

Add sandbox network out traffic configuration. The usage would look then something like this:

const sbx = await Sandbox.create({
  network: {
    allowOut: ['8.8.8.8'],
    blockOut: ['8.8.0.0/16'],
  },
})

Note

Adds configurable egress allow/deny for sandboxes, wires it through API → orchestrator, enforces via firewall, and persists in snapshots; updates proto/spec and tests.

API:
- Add SandboxNetworkConfig (allowOut, denyOut) to spec and generated types; include network in NewSandbox. Clarify allow_internet_access semantics (equivalent to denyOut: ["0.0.0.0/0"] when false).
- Handlers pass network to orchestrator on create/resume/connect.
Orchestrator:
- Accept and translate network config; if allowInternetAccess is false, set deny 0.0.0.0/0.
- Update network pool/slot to configure per-sandbox egress; firewall refactor to allow/deny sets, allow-list precedence, support "block all", default-allow hyperloop IP, and validate private ranges cannot be allowed.
- Extend gRPC/proto with SandboxNetworkConfig and egress fields.
DB:
- Add snapshots.config (JSONB) via migration; define PausedSandboxConfig and SandboxNetworkConfig types; store network config on pause; update queries/models.
Tests:
- Integration tests for egress allow/deny, CIDR handling, precedence, persistence across pause/resume, and hyperloop accessibility with blocked internet.
- Unit tests for firewall address validation.

^{Written by Cursor Bugbot for commit 738177c. This will update automatically on new commits. Configure here.}

packages/orchestrator/internal/server/sandboxes.go

packages/orchestrator/internal/sandbox/network/firewall.go

packages/orchestrator/internal/server/sandboxes.go

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

packages/orchestrator/internal/sandbox/network/firewall.go

packages/orchestrator/internal/server/sandboxes.go

packages/api/internal/orchestrator/nodemanager/sandboxes.go

packages/orchestrator/internal/sandbox/network/slot.go

packages/api/internal/handlers/sandbox.go

sitole · 2025-11-11T09:55:34Z

packages/api/internal/orchestrator/create_instance.go

+
+	// Handle the case where internet access is explicitly disabled
+	// This should be applied after copying the network config to preserve allowed addresses
+	if allowInternetAccess != nil && !*allowInternetAccess {


I think we should return error when both network egress allow/block lists and allow internet are provided. It can bring unexpected behavior for users.

The allowOut takes precedence over blockOut

also, internet is defined by default, allowInternetAccess false does the same as blockOut=[0.0.0.0/0]

packages/api/internal/orchestrator/create_instance.go

sitole · 2025-11-11T10:23:28Z

packages/api/internal/orchestrator/nodemanager/sandboxes.go


+		network := &types.SandboxNetworkConfig{
+			Egress: &types.SandboxNetworkEgressConfig{
+				AllowedAddresses: config.GetNetwork().GetEgress().GetAllowedAddresses(),


Are we sure this call chain will work correctly when communicating with orchestrators that are not yet supporting network configuration?

yes: https://go.dev/play/p/TbywUVUKQ_4

Thing was if we will not receive nil. It not, that is okay.

we'll receive nil for the list, but nil is a valid empty list

sitole · 2025-11-11T10:29:45Z

packages/orchestrator/internal/sandbox/network/firewall.go


 // AddBlockedIP adds a single CIDR to the block set at runtime.
-func (fw *Firewall) AddBlockedIP(cidr string) error {
+func (fw *Firewall) AddBlockedIP(address string) error {


We switched to inserting blocked IPs and not using CIDRs, which seems cleaner to me.

Function comment still refers to CIDRs

you can insert:

One IP

Cidr

IP range (1.1.1.0-1.1.1.1)

Can we make it cidr only to simplify thinking around? I think api should move all three types (i dont like IP range tho) to CIDR format.

removed support for IP ranges, passing now addresses only as CIDR blocks to the orchestrator. In the DB, they're saved as user provided

packages/orchestrator/internal/sandbox/network/firewall.go

packages/orchestrator/internal/sandbox/network/slot.go

packages/orchestrator/internal/server/sandboxes.go

sitole · 2025-11-11T11:23:38Z

Btw @dobrac can we check with deny all hyperloop server is still working?

cursor · 2025-11-11T13:43:21Z

packages/orchestrator/internal/server/sandboxes.go

+			network.Egress = &orchestrator.SandboxNetworkEgressConfig{}
+		}
+		network.Egress.DeniedCidrs = []string{internetBlockCIDR}
+	}


Bug: Global Config Overwrites User Network Access

Global config AllowSandboxInternet can override user-provided network configuration when AllowInternetAccess is not explicitly set in the request. If a user provides custom network.denyOut addresses without setting allowInternetAccess, and the global config is false, the orchestrator overwrites DeniedCidrs with ["0.0.0.0/0"], discarding the user's explicit configuration. This logic duplicates what the API layer already does and contradicts the TODO comment indicating it should be removed now that network config is passed from the API.

I think here we should fallback to s.config.AllowSandboxInternet only when customers configuration is not provided at all (both allow internet access flag and egress internet config).

cc @dobrac

thats desired

sitole · 2025-11-11T13:52:23Z

Looks like hyperloop server is not accessible with the internet disabled.
Just this and nit related to s.config.AllowSandboxInternet and then its ready to go. @dobrac

spec/openapi.yml

packages/orchestrator/internal/sandbox/sandbox.go

dobrac added the feature New feature label Nov 6, 2025

e2b-request-same-site-reviewers bot assigned sitole Nov 6, 2025

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch 3 times, most recently from a0928bb to 1c34d0d Compare November 6, 2025 16:18

feat: add sandbox egress firewall for ip addresses

09d9394

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from 1c34d0d to 09d9394 Compare November 6, 2025 16:22

dobrac added 2 commits November 6, 2025 18:00

API implementation

05c3c98

fix format

e0a5b01

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch 2 times, most recently from 8d392ab to 5c95692 Compare November 7, 2025 11:53

refactor end span

4ba7bc7

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch 3 times, most recently from 007f4f8 to 35fdb12 Compare November 7, 2025 16:41

change firewall to network, save config in db

33c5a57

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from 35fdb12 to 33c5a57 Compare November 10, 2025 18:34

dobrac changed the title ~~feat: add sandbox egress firewall for ip addresses~~ feat: add sandbox network out configuration Nov 10, 2025

improve 0.0.0.0/0 handling, disallow allowing blocked range IP

e3e805c

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch 5 times, most recently from 4559b70 to b74976f Compare November 11, 2025 00:05

add tests

1c4264b

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from b74976f to 1c4264b Compare November 11, 2025 00:20

dobrac marked this pull request as ready for review November 11, 2025 00:32

dobrac requested review from ValentaTomas and jakubno as code owners November 11, 2025 00:32

cursor bot reviewed Nov 11, 2025

View reviewed changes

packages/orchestrator/internal/server/sandboxes.go Outdated Show resolved Hide resolved

packages/orchestrator/internal/sandbox/network/firewall.go Outdated Show resolved Hide resolved

packages/orchestrator/internal/server/sandboxes.go Outdated Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Nov 11, 2025

View reviewed changes

packages/orchestrator/internal/sandbox/network/firewall.go Show resolved Hide resolved

cursor bot reviewed Nov 11, 2025

View reviewed changes

packages/orchestrator/internal/sandbox/network/firewall.go Outdated Show resolved Hide resolved

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch 2 times, most recently from 4404e80 to abb52a3 Compare November 11, 2025 01:07

cursor bot reviewed Nov 11, 2025

View reviewed changes

packages/orchestrator/internal/server/sandboxes.go Outdated Show resolved Hide resolved

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch 2 times, most recently from 4c45801 to e62ca88 Compare November 11, 2025 01:21

fix PR comments

d9e12b3

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from e62ca88 to d9e12b3 Compare November 11, 2025 01:28

cursor bot reviewed Nov 11, 2025

View reviewed changes

packages/api/internal/orchestrator/nodemanager/sandboxes.go Show resolved Hide resolved

dobrac mentioned this pull request Nov 11, 2025

feat: implement network out allow/deny list support e2b-dev/E2B#1016

Merged

1 task

fix runtime, formatting

01a4356

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from 0468847 to 01a4356 Compare November 11, 2025 01:58

cursor bot reviewed Nov 11, 2025

View reviewed changes

packages/orchestrator/internal/sandbox/network/slot.go Outdated Show resolved Hide resolved

add blocked ranges unit test

ef7e29b

sitole requested changes Nov 11, 2025

View reviewed changes

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from 5857131 to a0f052f Compare November 11, 2025 13:34

dobrac requested a review from sitole November 11, 2025 13:35

rename block to deny, use CIDR in the orchestrator

61047a4

dobrac force-pushed the add-allow-deny-ip-egress-limit-suport branch from a0f052f to 61047a4 Compare November 11, 2025 13:36

cursor bot reviewed Nov 11, 2025

View reviewed changes

sitole reviewed Nov 11, 2025

View reviewed changes

spec/openapi.yml Show resolved Hide resolved

fix always allow hyperloopIP, more block to deny renaming

738177c

cursor bot reviewed Nov 11, 2025

View reviewed changes

dobrac requested a review from sitole November 11, 2025 14:55

sitole approved these changes Nov 11, 2025

View reviewed changes

dobrac merged commit 802fdaf into main Nov 11, 2025
28 checks passed

dobrac deleted the add-allow-deny-ip-egress-limit-suport branch November 11, 2025 14:57

feat: add sandbox network out configuration #1447

feat: add sandbox network out configuration #1447

Uh oh!

Conversation

dobrac commented Nov 6, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sitole commented Nov 11, 2025

Uh oh!

cursor bot Nov 11, 2025

Choose a reason for hiding this comment

Bug: Global Config Overwrites User Network Access

Uh oh!

sitole Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sitole commented Nov 11, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dobrac commented Nov 6, 2025 •

edited by cursor bot

Loading

sitole Nov 11, 2025 •

edited

Loading