Network Access Control

Feature introduction

• Public access authentication (inbound): whether the public URL that the sandbox exposes requires a token to be accessed.

• Egress access control (outbound / egress): which destinations are allowed or denied when the sandbox actively accesses external networks.

Network configuration is passed in when creating the sandbox through the top-level allowInternetAccess and network objects.

Field naming is not fully consistent across the three interfaces, so distinguish them carefully:

• Python SDK: all snake_case, e.g. allow_internet_access, allow_public_traffic, allow_out, deny_out.

• JavaScript / TypeScript SDK: all lower camelCase, e.g. allowInternetAccess, allowPublicTraffic, allowOut, denyOut.

• HTTP API: mixed style—in POST /sandboxes the top-level egress master switch is allow_internet_access (snake_case, with allowInternetAccess also accepted), while fields inside the network object are all lower camelCase (network.allowPublicTraffic, network.allowOut, network.denyOut, network.maskRequestHost); the egress master switch in PUT /sandboxes/{id}/network is allowInternetAccess (camelCase).

The examples below are provided in both Node.js and Python; choose the style that matches the SDK you use.

Prerequisites

The examples below are provided in both Node.js and Python, and read connection information from environment variables. Before running, install the SDK and configure the following environment variables (fill in E2B_API_URL / E2B_DOMAIN for your target region, where <region> is e.g. cn-shenzhen):

# Connection info (replace with your actual values)
export E2B_API_KEY="<your-api-key>"
export E2B_API_URL="https://api.<region>.e2b.fc.aliyuncs.com"
export E2B_DOMAIN="<region>.e2b.fc.aliyuncs.com"

Node.js (the example is written in TypeScript; save it as demo.ts):

npm install e2b@^2.31.0
npx tsx demo.ts

Python (save the example as demo.py, requires Python ≥ 3.10):

python3 --version        # confirm ≥ 3.10
pip install e2b==2.31.0 httpx   # httpx is only used by the public auth example
python demo.py

Parameter Overview

egressProxy is not yet supported; passing it has no effect. For more information about network.rules, see Outbound request header transformation.

Public Access Authentication

Services started inside the sandbox can be exposed externally through a public URL. By default, anyone who knows the URL can access it; for sensitive workloads, you can use allowPublicTraffic to force callers to authenticate first.

• allowPublicTraffic: true (default): the public URL can be accessed without authentication.

• allowPublicTraffic: false: every request to the public URL must carry the e2b-traffic-access-token header, whose value is the trafficAccessToken returned when the sandbox was created; requests without the token or with an invalid token return 403.

Node.js

import { Sandbox } from "e2b";

const sandbox = await Sandbox.create({
  apiKey: process.env.E2B_API_KEY,
  apiUrl: process.env.E2B_API_URL,
  domain: process.env.E2B_DOMAIN,
  secure: true, // required when allowPublicTraffic is false, otherwise the SDK cannot reach the control plane
  network: {
    allowPublicTraffic: false,
  },
});
console.log(`[create] sandbox created: ${sandbox.sandboxId}`);

try {
  // Grab the token right after creation and save it; getInfo / list will not return it later, but you can retrieve it again via connect (see below)
  // The token is sensitive; do not print it directly. Here we only note it was obtained; store the actual value securely.
  console.log(`[token] trafficAccessToken obtained (sensitive; do not log)`);

  // After starting a service inside the sandbox, use getHost to get the external hostname
  await sandbox.commands.run("python3 -m http.server 8080", { background: true });
  const url = `https://${sandbox.getHost(8080)}`;
  console.log(`[serve] service started, public address: ${url}`);

  // Without token: 403
  const r1 = await fetch(url);
  console.log(`[probe] access without token -> ${r1.status}`); // 403

  // With token: 200
  const r2 = await fetch(url, {
    headers: { "e2b-traffic-access-token": sandbox.trafficAccessToken },
  });
  console.log(`[probe] access with token -> ${r2.status}`); // 200
} finally {
  // Destroy the sandbox after finishing to avoid leftover usage and billing
  await sandbox.kill();
  console.log("[cleanup] sandbox destroyed");
}

Python

import os

import httpx

from e2b import Sandbox

sandbox = Sandbox.create(
    api_key=os.environ["E2B_API_KEY"],
    api_url=os.environ["E2B_API_URL"],
    domain=os.environ["E2B_DOMAIN"],
    secure=True,  # required when allow_public_traffic is False, otherwise the SDK cannot reach the control plane
    network={"allow_public_traffic": False},
)
print(f"[create] sandbox created: {sandbox.sandbox_id}")

try:
    # Grab the token right after creation and save it; getInfo / list will not return it later, but you can retrieve it again via connect (see below)
    # The token is sensitive; do not print it directly. Here we only note it was obtained; store the actual value securely.
    print("[token] traffic_access_token obtained (sensitive; do not log)")

    # After starting a service inside the sandbox, use get_host to get the external hostname
    sandbox.commands.run("python3 -m http.server 8080", background=True)
    url = f"https://{sandbox.get_host(8080)}"
    print(f"[serve] service started, public address: {url}")

    # Without token: 403
    r1 = httpx.get(url)
    print(f"[probe] access without token -> {r1.status_code}")  # 403

    # With token: 200
    r2 = httpx.get(url, headers={"e2b-traffic-access-token": sandbox.traffic_access_token})
    print(f"[probe] access with token -> {r2.status_code}")  # 200
finally:
    # Destroy the sandbox after finishing to avoid leftover usage and billing
    sandbox.kill()
    print("[cleanup] sandbox destroyed")

Egress Access Control

Egress access control constrains the range of destinations the sandbox can actively access on external networks, determined jointly by allowInternetAccess, allowOut, and denyOut.

import { Sandbox } from "e2b";

// Fully isolate from external networks
const sandbox = await Sandbox.create({
  apiKey: process.env.E2B_API_KEY,
  apiUrl: process.env.E2B_API_URL,
  domain: process.env.E2B_DOMAIN,
  allowInternetAccess: false,
});
console.log(`[create] sandbox created (network isolated): ${sandbox.sandboxId}`);

try {
  // Egress is forbidden; rely on the application-layer result; use || echo as a fallback to avoid a non-zero exit code raising an exception
  const probe = await sandbox.commands.run(
    'curl -sS -o /dev/null -w "%{http_code}" -m 5 https://api.github.com || echo blocked'
  );
  console.log(`[probe] access api.github.com -> ${probe.stdout.trim()}`); // blocked
} finally {
  // Destroy the sandbox after finishing to avoid leftover usage and billing
  await sandbox.kill();
  console.log("[cleanup] sandbox destroyed");
}

import os

from e2b import Sandbox

# Fully isolate from external networks
sandbox = Sandbox.create(
    api_key=os.environ["E2B_API_KEY"],
    api_url=os.environ["E2B_API_URL"],
    domain=os.environ["E2B_DOMAIN"],
    allow_internet_access=False,
)
print(f"[create] sandbox created (network isolated): {sandbox.sandbox_id}")

try:
    # Egress is forbidden; rely on the application-layer result; use || echo as a fallback to avoid a non-zero exit code raising an exception
    probe = sandbox.commands.run(
        'curl -sS -o /dev/null -w "%{http_code}" -m 5 https://api.github.com || echo blocked'
    )
    print(f"[probe] access api.github.com -> {probe.stdout.strip()}")  # blocked
finally:
    # Destroy the sandbox after finishing to avoid leftover usage and billing
    sandbox.kill()
    print("[cleanup] sandbox destroyed")

import { Sandbox } from "e2b";

// Allowlist mode: deny everything, allow only the specified targets
const sandbox = await Sandbox.create({
  apiKey: process.env.E2B_API_KEY,
  apiUrl: process.env.E2B_API_URL,
  domain: process.env.E2B_DOMAIN,
  network: {
    denyOut: ["0.0.0.0/0"],
    allowOut: ["8.8.8.8", "8.8.8.0/24", "api.example.com", "*.github.com"],
  },
});
console.log(`[create] sandbox created (allowlisted egress): ${sandbox.sandboxId}`);

try {
  // Matches *.github.com, allowed
  const allowed = await sandbox.commands.run(
    'curl -sS -o /dev/null -w "%{http_code}" -m 5 https://api.github.com || echo blocked'
  );
  console.log(`[probe] api.github.com (in allowlist) -> ${allowed.stdout.trim()}`);

  // Not in the allowlist, denied
  const denied = await sandbox.commands.run(
    'curl -sS -o /dev/null -w "%{http_code}" -m 5 https://pypi.org || echo blocked'
  );
  console.log(`[probe] pypi.org (not in allowlist) -> ${denied.stdout.trim()}`); // blocked
} finally {
  // Destroy the sandbox after finishing to avoid leftover usage and billing
  await sandbox.kill();
  console.log("[cleanup] sandbox destroyed");
}

import os

from e2b import Sandbox

sandbox = Sandbox.create(
    api_key=os.environ["E2B_API_KEY"],
    api_url=os.environ["E2B_API_URL"],
    domain=os.environ["E2B_DOMAIN"],
    network={
        "deny_out": ["0.0.0.0/0"],
        "allow_out": ["8.8.8.8", "8.8.8.0/24", "api.example.com", "*.github.com"],
    },
)
print(f"[create] sandbox created (allowlisted egress): {sandbox.sandbox_id}")

try:
    # Matches *.github.com, allowed
    allowed = sandbox.commands.run(
        'curl -sS -o /dev/null -w "%{http_code}" -m 5 https://api.github.com || echo blocked'
    )
    print(f"[probe] api.github.com (in allowlist) -> {allowed.stdout.strip()}")

    # Not in the allowlist, denied
    denied = sandbox.commands.run(
        'curl -sS -o /dev/null -w "%{http_code}" -m 5 https://pypi.org || echo blocked'
    )
    print(f"[probe] pypi.org (not in allowlist) -> {denied.stdout.strip()}")  # blocked
finally:
    # Destroy the sandbox after finishing to avoid leftover usage and billing
    sandbox.kill()
    print("[cleanup] sandbox destroyed")

import { Sandbox } from "e2b";

const sandbox = await Sandbox.create({
  apiKey: process.env.E2B_API_KEY,
  apiUrl: process.env.E2B_API_URL,
  domain: process.env.E2B_DOMAIN,
  network: {
    denyOut: ({ allTraffic }) => [allTraffic], // allTraffic === "0.0.0.0/0"
    allowOut: ["1.1.1.1", "8.8.8.0/24"],
  },
});
console.log(`[create] sandbox created: ${sandbox.sandboxId}`);

try {
  // ... business logic ...
} finally {
  // Destroy the sandbox after finishing to avoid leftover usage and billing
  await sandbox.kill();
  console.log("[cleanup] sandbox destroyed");
}

import os

from e2b import Sandbox

sandbox = Sandbox.create(
    api_key=os.environ["E2B_API_KEY"],
    api_url=os.environ["E2B_API_URL"],
    domain=os.environ["E2B_DOMAIN"],
    network={
        "deny_out": lambda ctx: [ctx.all_traffic],  # ctx.all_traffic == "0.0.0.0/0"
        "allow_out": ["1.1.1.1", "8.8.8.0/24"],
    },
)
print(f"[create] sandbox created: {sandbox.sandbox_id}")

try:
    # ... business logic ...
    pass
finally:
    # Destroy the sandbox after finishing to avoid leftover usage and billing
    sandbox.kill()
    print("[cleanup] sandbox destroyed")

Priority and Matching Rules

When multiple parameters are present at the same time, whether a given egress request is allowed is decided by the following rules:

1. Allow takes priority over deny: allowOut always takes priority over denyOut. If a target matches both the allow and deny lists, it is allowed.

2. allowInternetAccess: false merely appends ["0.0.0.0/0"] to denyOut: it establishes a "deny all by default" baseline, but is not a hard kill switch. Because allow beats deny, targets matched by allowOut still punch through this baseline and are allowed—so allowInternetAccess: false + allowOut means "deny all + allowlist", and it truly forbids all egress only when no allowOut is set.

3. A domain allowlist requires an explicit denyOut for all traffic: see the previous section.

Effects of common combinations:

Behavior of Denied Connections

Because of how the egress firewall is implemented, a denied TCP connection may appear to "succeed" from inside the sandbox: the firewall must accept the connection first before it can decide whether the target is allowed, so the socket may show as established, while no packets actually reach the target.

To determine whether traffic actually reaches the target, check the application-layer response (HTTP status code, TLS handshake, expected protocol bytes, etc.), rather than relying on whether the TCP connection is established.

Updating Egress Configuration at Runtime

After creation, you can use updateNetwork (TypeScript) / update_network (Python) to adjust egress rules without rebuilding the sandbox:

Node.js

import { Sandbox } from "e2b";

const sandbox = await Sandbox.create({
  apiKey: process.env.E2B_API_KEY,
  apiUrl: process.env.E2B_API_URL,
  domain: process.env.E2B_DOMAIN,
});
console.log(`[create] sandbox created: ${sandbox.sandboxId}`);

try {
  // Tighten: block a single IP
  await sandbox.updateNetwork({ denyOut: ["8.8.8.8"] });
  console.log("[update] blocked 8.8.8.8");

  // Replace with a pure allowlist
  await sandbox.updateNetwork({
    denyOut: ({ allTraffic }) => [allTraffic],
    allowOut: ["api.example.com"],
  });
  console.log("[update] switched to allowlist: only api.example.com allowed");

  // Directly toggle the master egress switch
  await sandbox.updateNetwork({ allowInternetAccess: false });
  console.log("[update] master egress switch turned off");
} finally {
  // Destroy the sandbox after finishing to avoid leftover usage and billing
  await sandbox.kill();
  console.log("[cleanup] sandbox destroyed");
}

Python

import os

from e2b import Sandbox

sandbox = Sandbox.create(
    api_key=os.environ["E2B_API_KEY"],
    api_url=os.environ["E2B_API_URL"],
    domain=os.environ["E2B_DOMAIN"],
)
print(f"[create] sandbox created: {sandbox.sandbox_id}")

try:
    # Tighten: block a single IP
    sandbox.update_network({"deny_out": ["8.8.8.8"]})
    print("[update] blocked 8.8.8.8")

    # Replace with a pure allowlist
    sandbox.update_network({
        "deny_out": lambda ctx: [ctx.all_traffic],
        "allow_out": ["api.example.com"],
    })
    print("[update] switched to allowlist: only api.example.com allowed")

    # Directly toggle the master egress switch
    sandbox.update_network({"allow_internet_access": False})
    print("[update] master egress switch turned off")
finally:
    # Destroy the sandbox after finishing to avoid leftover usage and billing
    sandbox.kill()
    print("[cleanup] sandbox destroyed")

Points to note:

• updateNetwork is a full replacement, not a merge with existing rules; passing an empty object updateNetwork({}) clears all allow / deny rules set at creation.

• The egress-related allowInternetAccess / allowOut / denyOut / network.rules can be updated. allowPublicTraffic and maskRequestHost are creation-time-locked parameters and cannot be modified after creation. For more information about how to configure network.rules, see Outbound request header transformation.

Limits

• egressProxy is not yet supported; passing it has no effect.

• trafficAccessToken is returned on create / connect / resume; it is not returned on getInfo / list. Persist it for simpler reuse.

• allowPublicTraffic can only be set at creation and cannot be modified afterward.

• denyOut supports IP / CIDR / domain.

• Domain filtering only covers HTTP:80 and TLS:443; other ports are filtered by IP / CIDR, and UDP (QUIC / HTTP/3) does not support domain filtering.

• Denied connections may appear as "connected successfully" inside the sandbox; rely on the application-layer response.

• Egress control (allowOut / denyOut) and public inbound authentication (allowPublicTraffic) are independent of each other.

Recommendations

• For untrusted code or third-party tasks, tighten egress by default: denyOut: ["0.0.0.0/0"] plus an allowOut allowlist as needed.

• When exposing a service externally with sensitive data, set allowPublicTraffic: false (and set secure: true), and save the trafficAccessToken at creation time for your application to pass along securely.

• When using a domain allowlist, always add denyOut: ["0.0.0.0/0"], and confirm the target uses port 80/443.

• Do not write trafficAccessToken or envdAccessToken into logs or command output.