Docs

Egress policy

Pin the hosts a sandboxed agent run is allowed to reach, per repo. Nothing else leaves. Each pinned domain or IP maps to exactly one network capability the sandbox grants, so the allowlist is the policy rather than a description of one. Loopback and private ranges can never be pinned, because allowing those would let a run call back into your own machine.

Where to find it

  • Localhost: /egress-policy.html
  • API: GET /api/egress-policy, POST /api/egress-policy
  • CLI: repoops egress-policy add <host> and remove <host>
  • Navigation: AI Security in the sidebar, then Egress policy under All tools, in the Egress and containment group

What it does for you

The allowlist is enforced wherever a run is bound to the repo.A pinned host becomes one granted network capability on the sandbox runtime for runs bound to that repo, which today means the reference grader service started with --repo-id. An unbound sandbox run reads no policy and gets no network at all. Either way the granted set can never be broader than what you pinned: a per-host grant is the only route to the network the sandbox knows, and the allowlist is the only thing that produces one.
It fails closed, which is the only useful direction.A policy that will not load is treated as the empty allowlist. So a host that was reached is flagged, always. The failure mode of a config error is a noisy alert, never a silent allow.
You can hear about an unlisted host without watching for it.Set REPOOPS_EGRESS_POLICY_SCAN_INTERVAL_MS to a positive number of milliseconds and a background check reads the sandbox run audit rows per repo, evaluates each run against the allowlist, and fires one unlisted-host alert through the same sinks the rest of RepoOps uses (Slack, PagerDuty, incident.io). The scan is off until you set that variable, and the tab says whether it is running, so an empty alert list never has to mean two things. With no sink configured the tick is an honest no-op rather than a silent one.
Private ranges are refused on principle.Loopback and private addresses cannot be pinned at all. An allowlist that can be pointed back at your own network is not a containment boundary.

Built vs. planned

The allowlist, the capability mapping, the fail-closed evaluation, the alerting hook and the CLI all ship today, LLM-free and local-only. This configures the sandbox runtime that already ships; it does not reinvent one. The alert is deduplicated per repo and host, so a repeatedly reached host does not turn into a stream.

Last updated