Proposal: start sandboxes with a closed network by default

[sumansaurabh]

The problem

A sandbox with no network policy can reach the internet, plus anything its server can reach. That includes private addresses, the cloud metadata service (169.254.169.254) and other sandboxes. V8 isolates are the one exception. The server-wide guards only apply once the operator writes a network policy file: a default policy, address ranges that are always blocked, and a guard for AerolVM's own ports. A fresh install has no such file.

What you can do today

Set networkBlockAll or networkAllowOut on every create. Or write a policy file (SB_EGRESS_OPERATOR_FILE) with default_policy: block_all, add 169.254.169.254/32 to deny_cidrs, and keep the control-port guard on. The file looks like this:

version: 1
default_policy:
  mode: block_all                  # creates that set no policy get no network
deny_cidrs: [169.254.169.254/32] # the cloud metadata service; add your private ranges
node_control_port_guard: true    # no sandbox can reach AerolVM's own ports

A starting shape

Two steps, so nobody's setup breaks without warning:

1. Always on, even with no policy file: block the cloud metadata service and AerolVM's own ports for every sandbox. Very little real code needs either, and both are common targets.
2. New installs start closed: install.sh writes a policy file with default_policy: block_all. Existing servers keep their behavior until the operator opts in, and a release note says how.

A sandbox that needs the internet still asks for it with networkAllowOut.

Questions for you

1. Would step 1 break anything you run? Some setups read the metadata service on purpose.
2. Should new installs start with block_all, or with an allow list of common package sites?
3. How much warning do you need before a default changes on existing servers?

How to weigh in

React with 👍 if you need this, and comment with your answers.

Want to talk it through? Book a call with the maintainer, or join the community call on the first Saturday of every month at 8 pm Pacific Time.

If your company needs this soon, you can sponsor the work. It is built in the open and ships to everyone.