Egress

Network access is set by the sandbox's security profile and enforced by host firewall rules outside the microVM.

Built-in profiles

• offline: no network.
• model-only: only the model endpoint.
• internet: public internet.
• internet-lan: public internet plus your LAN.
• unrestricted: everything except the floor.

Save your own profile as a base plus allows and denies; operators can lock profiles.

The always-closed floor

Cloud metadata, link-local and other sandboxes' addresses are always closed, whatever the profile allows. A deny beats every allow, and deny-only overrides never widen. These properties are proved in Lean 4 for every IPv4 address, port and protocol; see Security model.

Change it live

A profile can change on a running sandbox. The new rules are probed and rolled back if they fail.

Denied connections are logged

On rootless sandboxes every drop rule records the destination; it is logged once, then at most every 30 s, as a policy.denied event in the audit log.

Related: Policies · Security model · Install