> ## Documentation Index
> Fetch the complete documentation index at: https://docs.primeintellect.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Isolation

> Restrict where a sandbox can send traffic

Restrict outbound traffic with an allowlist or a denylist. The two are mutually exclusive.

<CodeGroup>
  ```bash CLI theme={null}
  # Deny all egress, including DNS
  prime sandbox create python:3.11-slim --network-deny 0.0.0.0/0

  # Allow only specific destinations
  prime sandbox create python:3.11-slim --network-allow api.openai.com

  # Deny specific destinations, allow everything else
  prime sandbox create python:3.11-slim --network-deny evil.example.com
  ```

  ```python Python theme={null}
  # Deny all egress, including DNS
  CreateSandboxRequest(name="isolated", docker_image="python:3.11-slim", network_allowlist=[])

  # Allow only specific destinations
  CreateSandboxRequest(name="allow", docker_image="python:3.11-slim", network_allowlist=["api.openai.com"])

  # Deny specific destinations, allow everything else
  CreateSandboxRequest(name="deny", docker_image="python:3.11-slim", network_denylist=["evil.example.com"])
  ```
</CodeGroup>

Entries are domains (`example.com`, `*.example.com`) or IPv4 addresses/CIDRs; IPv6 is not supported. The CLI flags are repeatable. Blocked outbound calls fail with a network error.

## Change rules on a running sandbox

```bash theme={null}
# Replace the allowlist with two hosts
prime sandbox network sbx_123 --allow api.openai.com,*.example.com

# Replace the denylist; '*' blocks all outbound traffic
prime sandbox network sbx_123 --deny '*'

# Show current state
prime sandbox network sbx_123
```

Each call **replaces** the whole list, and each flag takes a single comma-separated value. Rules can be saved but not yet active on the running sandbox; the CLI keeps retrying until they apply.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.