Network

Every sandbox has an outbound policy. Archil enforces it outside the microVM, so code inside can’t change it, and it can add headers to requests as they leave, so a key the sandbox uses never sits inside it.

With default: deny, a sandbox reaches only the hosts it allows. The policy adds the Authorization header to requests for api.github.com, so the token never enters the sandbox.

Deny by default

src/agent.ts

export const Agent = Archil.Sandbox("Agent", {
  network: {
    egress: { default: "deny", allow: ["registry.npmjs.org", "*.github.com"] },
  },
});

Deny entries win over allow entries. A wildcard matches subdomains, not the apex domain.

Add a credential on the way out

An allow entry can set headers on matching HTTPS requests. The sandbox never sees the value:

src/agent.ts

export const Agent = Archil.Sandbox("Agent", {
  network: {
    egress: {
      default: "deny",
      allow: [
        { target: "api.github.com", headers: { Authorization: Config.Redacted("GITHUB_AUTH") } },
      ],
    },
  },
});

Archil has no secret store, so the value lives in the sandbox’s policy.

Change it while it runs

yield* sandbox.setEgress({ default: "deny", allow: ["api.openai.com"] });

The new policy applies at once. On a declared Archil.Sandbox, changing network updates it in place.

Plans

On Archil’s Free plan, sandboxes reach only a managed allowlist of package registries, Git hosts and model APIs, and adding headers needs the Developer plan or above. A sandbox created on a paid plan with no policy reaches anything.