> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network access

> Choose and verify a sandbox's closed outbound-network profile.

A deployment can offer three closed outbound-network profiles. Creation starts at `public`; select
a closed profile on the running sandbox with
`hiloop sandbox update <sandbox> --network-access <profile>`. Closed updates are deployment-gated:
until the operator activates the complete policy bundle, the sandbox remains on the public
compatibility floor and the update returns `unsupported_capability`. Once enabled, the update
returns only after the policy controller selects the exact live Pod; its receipt names that Pod and
the selected policy objects. The API also verifies that those objects resolve only the live platform
Pods and Services the profile names. A non-public create, or any unsupported or unprovable profile,
fails closed.

## What a sandbox can reach

The dedicated workload namespace carries a network floor enforced outside the workload:

| Profile        | Reachable destinations                                                                                                                              |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `public`       | Cluster DNS, public IPv4 destinations, the proof-bound model gateway, the proof-bound HTTPS secret relay when configured, and the capture listener. |
| `gateway_only` | Cluster DNS, the proof-bound model gateway, and the capture listener.                                                                               |
| `none`         | Cluster DNS and the capture listener only.                                                                                                          |

Everything else is denied: other sandboxes, general cluster services, private address ranges, and
the cloud metadata endpoint. The workload has no capture proof and cannot use the capture listener
as an ordinary API. Kubernetes NetworkPolicy does not police a Pod's own loopback.

Generic HTTPS secret bindings require `public`. A secret-bound sandbox cannot switch to a closed
profile; use the proof-bound model gateway for model access under `gateway_only`.

Inbound, sandboxes expose no public ingress. Ports declared at create (`--port`) are recorded for
authenticated private session-plane endpoints, which are not served yet; see
[what's live today](/sandboxes/overview#whats-live-today).

## What is not available yet

Destination-level domain or CIDR allowlists and denylists are not part of the sandbox API. The
three profiles above are the complete supported choices; none silently degrades.

For locally captured runs (not sandboxes), the `hiloop run` wrapper has its own egress controls:
`--egress-deny` with `--allow-domain`/`--allow-cidr`, or default-allow with
`--deny-domain`/`--deny-cidr`. See [capturing telemetry](/guides/capturing-telemetry).

## Operator note

The floor is enforced with Kubernetes NetworkPolicy, which only bites when the cluster's CNI
enforces it. Hosted deployments run with enforcement enabled; self-managed operators should verify
their CNI enforces NetworkPolicy and probe from a sandbox that a private address and the metadata
endpoint are unreachable. See the [security model](/deployment/security-model#network-isolation).