> ## Documentation Index
> Fetch the complete documentation index at: https://docs.archil.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox Firewall

> Network egress filters for sandboxes.

Archil's persistent sandboxes support defining a network policy to filter network egress from the sandbox. This is useful when running untrusted workloads, including agents.

The sandbox firewall operates on both the IP and transport layer, so you can filter both CIDR ranges and domains.

To deny all network egress you can set the `default` to `deny`. On top of this, you can apply additional `deny` and `allow` rules to whitelist certain targets. For example:

```typescript theme={null}
import * as archil from "disk";

const sandbox = await archil.createSandbox({
  network: {
    egress: {
      default: "deny",
      allow: ["192.168.14.0/24", "*.github.com"],
    }
  }
});
```

## Domain filtering

Domain filtering applies to all HTTP traffic (ports 80/443). HTTP/3 is blocked when domain filters are in place. It validates SNI using the TLS ClientHello, the `Host` header, and the URI authority for every request. If any are denied, then the request will be rejected.

To support this, our egress proxy must terminate TLS, so we install an "archil egress" proxy CA into every sandbox.

## Credential brokering

For HTTP egress, we also support defining rules for transforming requests. This means that secret credentials can live outside the sandbox, so untrusted workloads cannot access them directly. For example, you can add API keys to outgoing HTTP requests so your sandbox never sees them:

```typescript theme={null}
import * as archil from "disk";

const sandbox = await archil.createSandbox({
  network: {
    egress: {
      default: "deny",
      allow: [{
        target: "api.github.com",
        transform: {
          headers: {
            Authorization: `Bearer ${process.env.GITHUB_TOKEN}`
          }
        }
      }],
    }
  }
});
```

## Dynamic Updates

Network policy can be updated dynamically, even while a sandbox is running. For example you can:

1. initially pull data from an S3 bucket
2. deny all egress while an agent is running
3. run a verifier and upload evaluation results

```typescript theme={null}
import * as archil from "disk";

const sandbox = await archil.createSandbox({
  network: {
    egress: {
      default: "deny",
      allow: ["data-bucket.s3.us-east-1.amazonaws.com"],
    }
  }
});

// download data...

await sandbox.updateNetworkPolicy({
  egress: {
    default: "deny",
  }
});

// run agent...

await sandbox.updateNetworkPolicy({
  egress: {
    default: "deny",
    allow: ["result-bucket.s3.us-east-1.amazonaws.com"]
  }
});

// run verifier...
```