Overview
Daytona provides flexible network configuration options including network isolation, allow lists, and port preview functionality for accessing services running in sandboxes.Network Security
Block All Network Access
Prevent sandboxes from accessing external networks:Network Allow List
Allow access to specific CIDR network ranges:Default Network Behavior
By default, sandboxes have full network access:Port Previews
Port previews allow you to access web services running inside sandboxes through secure URLs.Get Preview URL
Public vs Private Previews
Control whether preview links are publicly accessible:Set Sandbox Visibility
Change the public/private status after creation:Network Configuration Examples
Isolated Development Environment
Create a completely isolated sandbox for secure code execution:Internal API Access
Allow access only to internal services:Web Application with Preview
Develop and preview a web application:Advanced Port Management
Multiple Port Previews
Security Best Practices
-
Use network isolation for untrusted code: Set
networkBlockAll: truewhen running untrusted or user-submitted code. -
Restrict API access: Use
networkAllowListto limit access to only required internal services. -
Private by default: Create sandboxes with
public: falseunless public access is required. - Secure preview tokens: For private sandboxes, treat preview tokens as sensitive credentials.
- Monitor network usage: Use labels to track and organize sandboxes by network configuration.
Network Configuration Reference
| Parameter | Type | Default | Description |
|---|---|---|---|
networkBlockAll | boolean | false | Block all outbound network access |
networkAllowList | string | undefined | Comma-separated CIDR ranges to allow |
public | boolean | false | Make preview links publicly accessible |
Related
- Custom Images - Configure sandbox images
- Auto Lifecycle - Automatic sandbox cleanup
- Monitoring - Track sandbox metrics