> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novita.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Internet access

Internet access is enabled in every sandbox by default, but you can disable it for isolated workloads.

Services running inside a sandbox can also be exposed through a public URL.

## Toggling internet access

When creating a sandbox, you can use the `allowInternetAccess` / `allow_internet_access` parameter to configure internet connectivity. Internet access is turned on by default, but it can be disabled for workloads with stricter security requirements.

<CodeGroup>
  ```js JavaScript & TypeScript icon="js" theme={"system"}
  import { Novita } from 'novita-sandbox'

  const novita = new Novita()

  // Create sandbox with internet access enabled (default).
  const sandbox = await novita.sandbox.create({ allowInternetAccess: true })

  // Create sandbox without internet access.
  const isolatedSandbox = await novita.sandbox.create({ allowInternetAccess: false })
  ```

  ```python Python icon="python" theme={"system"}
  from novita_sandbox import Novita

  novita = Novita()

  # Create sandbox with internet access enabled (default).
  sandbox = novita.sandbox.create(allow_internet_access=True)

  # Create sandbox without internet access.
  isolated_sandbox = novita.sandbox.create(allow_internet_access=False)
  ```
</CodeGroup>

## Fine-grained network control

Network configuration provides finer-grained control over outbound traffic by allowing you to define allowlists and denylists.

<CodeGroup>
  ```js JavaScript & TypeScript icon="js" theme={"system"}
  import { Novita } from 'novita-sandbox'

  const novita = new Novita()

  // Deny all traffic except specific IPs.
  const sandbox = await novita.sandbox.create({
    network: {
      denyOut: ['0.0.0.0/0'],
      allowOut: ['1.1.1.1', '8.8.8.0/24'],
    },
  })

  // Allow only traffic to selected domains.
  const domainSandbox = await novita.sandbox.create({
    network: {
      allowOut: ['api.example.com', '*.github.com'],
      denyOut: ['0.0.0.0/0'],
    },
  })
  ```

  ```python Python icon="python" theme={"system"}
  from novita_sandbox import Novita

  novita = Novita()

  # Deny all traffic except specific IPs.
  sandbox = novita.sandbox.create(
      network={
          'deny_out': ['0.0.0.0/0'],
          'allow_out': ['1.1.1.1', '8.8.8.0/24'],
      }
  )

  # Allow only traffic to selected domains.
  domain_sandbox = novita.sandbox.create(
      network={
          'allow_out': ['api.example.com', '*.github.com'],
          'deny_out': ['0.0.0.0/0'],
      }
  )
  ```
</CodeGroup>

## Sandbox public URL

Services in a sandbox can be accessed by using the sandbox's public URL.

<CodeGroup>
  ```js JavaScript & TypeScript icon="js" theme={"system"}
  import { Novita } from 'novita-sandbox'

  const novita = new Novita()
  const sandbox = await novita.sandbox.create()

  const host = sandbox.getHost(3000)
  console.log(`https://${host}`)
  ```

  ```python Python icon="python" theme={"system"}
  from novita_sandbox import Novita

  novita = Novita()
  sandbox = novita.sandbox.create()

  host = sandbox.get_host(3000)
  print(f'https://{host}')
  ```
</CodeGroup>

## Connecting to a server running inside the sandbox

<CodeGroup>
  ```js JavaScript & TypeScript icon="js" theme={"system"}
  import { Novita } from 'novita-sandbox'

  const novita = new Novita()
  const sandbox = await novita.sandbox.create()

  const process = await sandbox.commands.run('python -m http.server 3000', { background: true })
  const url = `https://${sandbox.getHost(3000)}`
  console.log('Server started at:', url)

  const response = await fetch(url)
  const data = await response.text()
  console.log('Response from server inside sandbox:', data)

  await process.kill()
  await sandbox.kill()
  ```

  ```python Python icon="python" theme={"system"}
  import requests
  from novita_sandbox import Novita

  novita = Novita()
  sandbox = novita.sandbox.create()

  process = sandbox.commands.run('python -m http.server 3000', background=True)
  url = f'https://{sandbox.get_host(3000)}'
  print('Server started at:', url)

  response = requests.get(url)
  data = response.text
  print('Response from server inside sandbox:', data)

  process.kill()
  sandbox.kill()
  ```
</CodeGroup>

## Masking request host headers

You can use the `maskRequestHost` / `mask_request_host` option to customize the Host header sent to services running inside the sandbox.

<CodeGroup>
  ```js JavaScript & TypeScript icon="js" theme={"system"}
  import { Novita } from 'novita-sandbox'

  const novita = new Novita()
  const sandbox = await novita.sandbox.create({
    network: {
      maskRequestHost: 'localhost:${PORT}',
    },
  })
  ```

  ```python Python icon="python" theme={"system"}
  from novita_sandbox import Novita

  novita = Novita()
  sandbox = novita.sandbox.create(
      network={
          'mask_request_host': 'localhost:${PORT}',
      }
  )
  ```
</CodeGroup>