Network & secrets

Allow only some destinations

const sandbox = yield* sandboxes.create({
  network: { allowOut: ["github.com", "*.github.com", "registry.npmjs.org"] },
});

Once allowOut has entries, everything else is blocked. network: { allowOut: [] } blocks everything. denyOut blocks CIDR ranges.

Change it while the sandbox runs

yield* sandbox.updateNetwork({ allowOut: ["api.openai.com"] });

The update replaces the sandbox’s rules.

Store a secret

src/Secrets.ts

import * as Alchemy from "alchemy";
import * as E2B from "@alchemy.run/e2b";

export const GitHubToken = E2B.Secret("GitHubToken", { value: Alchemy.Secret("GITHUB_TOKEN") });

E2B never returns a secret’s value. Changing value stores a new version.

Inject it on the way out

const github = yield* GitHubToken;
const sandbox = yield* sandboxes.create({
  network: {
    allowOut: ["api.github.com"],
    rules: {
      "api.github.com": [{ transform: { headers: { Authorization: `Bearer ${github.ref}` } } }],
    },
  },
});

github.ref is a placeholder (${e2b.secrets.<name>}). E2B swaps in the value on the host, only for requests to api.github.com. Code in the sandbox can’t read it.

A secret per user

const secrets = yield* E2B.CreateSecret();
// in fetch:
const token = yield* secrets.put(`github-${user}`, Redacted.make(userToken));

Provide E2B.CreateSecretHttp. Objects created at run time are tagged with the stack, stage and binding (alchemy::stack, alchemy::stage, alchemy::id) and are not deleted when the stack is destroyed. List them by those tags to clean them up. secrets.list() returns the ones the binding stored:

yield* Effect.forEach(yield* secrets.list(), (secret) => secrets.delete(secret.secretId));

Rotate a secret

const token = yield* E2B.WriteSecret(GitHubToken);
// in a scheduled handler:
yield* token.put(Redacted.make(fresh));

Sandboxes use the new version on their next request.

Public URLs

Sandbox ports are public unless you create the sandbox with network: { allowPublicTraffic: false }. Then sandbox.fetch sends the sandbox’s traffic token for you.

Workload identity

const sandbox = yield* sandboxes.create({
  iam: { tokens: { aws: { audience: "sts.amazonaws.com", tokenType: "JWT-SVID" } } },
});

The sandbox gets tokens it can exchange with your cloud, so you don’t hand it long-lived keys.