Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Lock down sandbox egress to specific CIDRs or domains with allow and deny lists.
network rules to narrow the allowlist further.
allowOut / allow_out accepts a mix of CIDRs and domain patterns. Combine it with denyOut: ["0.0.0.0/0"] to build a strict allowlist - deny everything, then add exceptions.
const sandbox = await Sandbox.create({
name: "restricted",
network: {
allowOut: ["api.openai.com", "*.github.com", "140.82.112.0/20"],
denyOut: ["0.0.0.0/0"],
},
})
from superserve import Sandbox, NetworkConfig
sandbox = Sandbox.create(
name="restricted",
network=NetworkConfig(
allow_out=["api.openai.com", "*.github.com", "140.82.112.0/20"],
deny_out=["0.0.0.0/0"],
),
)
| Field | Accepts | Notes |
|---|---|---|
allowOut / allow_out | CIDRs + domains | Domains support wildcards (*.example.com). A wildcard matches subdomains at any depth but not the bare domain — *.example.com does not match example.com; list both if you need the apex. |
denyOut / deny_out | CIDRs only | Use 0.0.0.0/0 to deny the entire internet and rely on allowOut for exceptions. |
await sandbox.update({
network: {
allowOut: ["api.anthropic.com", "api.openai.com"],
denyOut: ["0.0.0.0/0"],
},
})
sandbox.update(
network=NetworkConfig(
allow_out=["api.anthropic.com", "api.openai.com"],
deny_out=["0.0.0.0/0"],
),
)
*.superserve.ai will break the SDK’s ability to communicate with the sandbox.