From the README roadmap — policy-based network allowlist for AI sandboxes, e.g.:
```
gocker sandbox run claude ./ --network-policy deny --allow-host api.anthropic.com
```
Intent
Sandboxes default to full network access today. For actually-isolated agent runs we want a deny-by-default policy with an explicit allowlist (hostnames or CIDRs), enforced at the VM level so the agent can't escape.
Rough approach
- `--network-policy deny|allow` flag on `gocker sandbox run`
- `--allow-host ` (repeatable) and/or `--allow-cidr `
- Implemented via the VM's iptables/nftables rules on first boot; DNS for allowed hosts resolved at VM start and pinned to allow-list IPs
- Configurable default in `~/.gocker/config.yaml` under `sandbox:`
Related
Pairs well with the sandbox template images (#TBD for codex/gemini) — a locked-down default profile is most of the value of running agents in sandboxes.
From the README roadmap — policy-based network allowlist for AI sandboxes, e.g.:
```
gocker sandbox run claude ./ --network-policy deny --allow-host api.anthropic.com
```
Intent
Sandboxes default to full network access today. For actually-isolated agent runs we want a deny-by-default policy with an explicit allowlist (hostnames or CIDRs), enforced at the VM level so the agent can't escape.
Rough approach
Related
Pairs well with the sandbox template images (#TBD for codex/gemini) — a locked-down default profile is most of the value of running agents in sandboxes.