Skip to main content
Compute goals run their autonomous work in sandboxes. By default a sandbox can reach any host. Two settings limit it to OneShot’s API plus an allowlist:
  • Per goal: pass egress_allowlist when you create the goal. Setting it, even to [], limits every sandbox of that goal.
  • Per organization: an admin turns on default-deny with PUT /v1/org/sandbox-egress { "default_deny": true }. Every sandbox of the organization’s goals is then limited, with or without a goal allowlist.
Entries are hostnames, IPv4 addresses or IPv4 ranges, at most 50. No wildcards, URLs, IPv6 or all-traffic ranges. The policy is read from the database when a sandbox is created, so it covers goals queued before the setting changed; a running sandbox keeps the policy it started with.

​
What is enforced

The sandbox’s network filter denies every connection except OneShot’s API and the listed hosts. Its limits:
  • Hostnames are matched on the HTTP Host header (port 80) and the TLS server name (port 443). Other ports are matched by address, so list an address or range for them.
  • A hostname on a shared CDN endpoint may expose other sites served there.
  • With hostnames in the allowlist, the sandbox can also reach the public DNS resolver 8.8.8.8. This cannot be closed today.
  • Only IPv4 is filtered.

​
Blocked attempts

There is no log of denied connections at the network level, and no command is refused on its text: a URL in a command is data until a connection is made, so every command runs and the network filter decides. The sandbox runtime records what it observes at run time as egress_blocked goal events with source: command_failure: a finished command, including a background one, reported a refused or reset connection. The host is given when the command named one outside the allowlist. An attempt inside a script that hides its errors is blocked but produces no event. Reports are retried and flushed before the agent exits. On the agent loop, where commands run through the platform, a blocked attempt fails the command and produces no event.
OneShot tools the sandbox calls (web read, search, browser, email) run outside the sandbox and are not limited by this setting.

​
API

Both return { success: true, data: { default_deny } }. Each change is an org.sandbox_egress_changed audit entry.