Can I restrict internet access from a Novita Sandbox?

Yes. Sandboxes have outbound internet access by default, and you can turn it off entirely with allow_internet_access=False or limit it to specific domains and CIDRs with network.allow_out and network.deny_out. Inbound access to services you run is controlled separately, through public or token-protected sandbox URLs.

Details

Goal	Setting
No outbound internet at all	`allow_internet_access=False` / `allowInternetAccess: false`
Only specific destinations	`network.allow_out` with domains (wildcards like `*.github.com` work) plus `deny_out: ["0.0.0.0/0"]`
Block specific destinations	`network.deny_out` with domains or CIDRs
Expose a service on a port	`sandbox.get_host(port)` → `https://{port}-{sandboxId}.{domain}`
Require a token to reach that service	`network.allow_public_traffic=False`, then send `Sandbox-Traffic-Access-Token`

Set these options when you create the sandbox.

How to

from novita_sandbox import Novita

novita = Novita()

offline = novita.sandbox.create(allow_internet_access=False)

allowlisted = novita.sandbox.create(
    network={"allow_out": ["api.example.com", "*.github.com"], "deny_out": ["0.0.0.0/0"]}
)

import { Novita } from 'novita-sandbox'

const novita = new Novita()

const offline = await novita.sandbox.create({ allowInternetAccess: false })

const allowlisted = await novita.sandbox.create({
  network: { allowOut: ['api.example.com', '*.github.com'], denyOut: ['0.0.0.0/0'] },
})

Learn more: Internet access · Secured access

Last modified on November 11, 2026

⌘I