public; select
a closed profile on the running sandbox with
hiloop sandbox update <sandbox> --network-access <profile>. Closed updates are deployment-gated:
until the operator activates the complete policy bundle, the sandbox remains on the public
compatibility floor and the update returns unsupported_capability. Once enabled, the update
returns only after the policy controller selects the exact live Pod; its receipt names that Pod and
the selected policy objects. The API also verifies that those objects resolve only the live platform
Pods and Services the profile names. A non-public create, or any unsupported or unprovable profile,
fails closed.
What a sandbox can reach
The dedicated workload namespace carries a network floor enforced outside the workload:
Everything else is denied: other sandboxes, general cluster services, private address ranges, and
the cloud metadata endpoint. The workload has no capture proof and cannot use the capture listener
as an ordinary API. Kubernetes NetworkPolicy does not police a Pod’s own loopback.
Generic HTTPS secret bindings require
public. A secret-bound sandbox cannot switch to a closed
profile; use the proof-bound model gateway for model access under gateway_only.
Inbound, sandboxes expose no public ingress. Ports declared at create (--port) are recorded for
authenticated private session-plane endpoints, which are not served yet; see
what’s live today.
What is not available yet
Destination-level domain or CIDR allowlists and denylists are not part of the sandbox API. The three profiles above are the complete supported choices; none silently degrades. For locally captured runs (not sandboxes), thehiloop run wrapper has its own egress controls:
--egress-deny with --allow-domain/--allow-cidr, or default-allow with
--deny-domain/--deny-cidr. See capturing telemetry.