Overview

await using sb = await Sandbox.builder("isolated")
    .image("python")
    .disableNetwork()
    .create();

let sb = Sandbox::builder("isolated")
    .image("python")
    .network(|n| n.enabled(false))
    .create()
    .await?;

from microsandbox import Network, Sandbox

sb = await Sandbox.create("isolated", image="python", network=Network.none())

sb, err := m.CreateSandbox(ctx, "isolated",
    m.WithImage("python"),
    m.WithNetwork(m.NetworkPolicy.None()),
)

sb = Microsandbox::Sandbox.create("isolated", image: "python", network: :none)

msb create python --name isolated --no-net

await using sb = await Sandbox.builder("shared-worker")
    .image("python")
    .deploymentProfile("multi-tenant")
    .create();

use microsandbox::sandbox::DeploymentProfile;

let sb = Sandbox::builder("shared-worker")
    .image("python")
    .deployment_profile(DeploymentProfile::MultiTenant)
    .create()
    .await?;

from microsandbox import DeploymentProfile, Sandbox

sb = await Sandbox.create(
    "shared-worker",
    image="python",
    deployment_profile=DeploymentProfile.MULTI_TENANT,
)

sb, err := m.CreateSandbox(ctx, "shared-worker",
    m.WithImage("python"),
    m.WithDeploymentProfile(m.DeploymentProfileMultiTenant),
)

msb create python --name shared-worker --deployment-profile multi-tenant

const policy = NetworkPolicy.fromProfiles(["public", "private"]);

let policy = NetworkPolicy::from_profiles([
    NetworkProfile::Public,
    NetworkProfile::Private,
]);

network = Network.from_profiles(NetworkProfile.PUBLIC, NetworkProfile.PRIVATE)

network := m.NetworkPolicy.FromProfiles(
    m.NetworkProfilePublic,
    m.NetworkProfilePrivate,
)

msb run alpine --net "public,private"

import { NetworkPolicy, Sandbox } from "microsandbox";

await using sb = await Sandbox.builder("restricted-worker")
    .image("alpine")
    .network((n) => n.policy(
        NetworkPolicy.builder()
            .defaultDeny()
            .egress((e) => e.tcp().port(443).allowPublic())
            .egress((e) => e.udp().tcp().port(53).allowHost())
            .build(),
    ))
    .create();

let policy = NetworkPolicy::builder()
    .default_deny()
    .egress(|e| e.tcp().port(443).allow_public())
    .egress(|e| e.udp().tcp().port(53).allow_host())
    .build()?;

let sb = Sandbox::builder("restricted-worker")
    .image("alpine")
    .network(|n| n.policy(policy))
    .create()
    .await?;

from microsandbox import Action, DestGroup, Destination, Network, NetworkPolicy, Protocol, Rule, Sandbox

sb = await Sandbox.create(
    "restricted-worker",
    image="alpine",
    network=Network(policy=NetworkPolicy(
        default_egress=Action.DENY,
        rules=(
            Rule.allow(destination=Destination.group(DestGroup.PUBLIC), protocol=Protocol.TCP, port=443),
            *Rule.allow_dns(),
        ),
    )),
)

sb, err := m.CreateSandbox(ctx, "restricted-worker",
    m.WithImage("alpine"),
    m.WithNetwork(&m.NetworkConfig{
        DefaultEgress: m.PolicyActionDeny,
        Rules: []m.PolicyRule{
            {Action: m.PolicyActionAllow, Direction: m.PolicyDirectionEgress, Destination: "public", Protocol: m.PolicyProtocolTCP, Port: "443"},
            m.Rule.AllowDNS(),
        },
    }),
)

msb create alpine --name restricted-worker \
  --net-default-egress deny \
  --net-rule "allow@public:tcp:443,allow@dns"

await using sb = await Sandbox.builder("api")
    .image("python")
    .port(8080, 80)
    .create();

let sb = Sandbox::builder("api")
    .image("python")
    .port(8080, 80)
    .create()
    .await?;

from microsandbox import PortBinding, Sandbox

sb = await Sandbox.create("api", image="python", ports=[PortBinding.tcp(8080, 80)])

sb, err := m.CreateSandbox(ctx, "api",
    m.WithImage("python"),
    m.WithPorts(map[uint16]uint16{8080: 80}),
)

msb create python --name api -p 8080:80

await using sb = await Sandbox.builder("throttled")
    .image("python")
    .network((n) => n.rateLimiter((r) => r.egress((r) => r
        .bandwidth(1_048_576, 1_000)
        .bandwidthBurst(524_288)
        .ops(1_000, 1_000))))
    .create();

use std::time::Duration;
use microsandbox::size::SizeExt;

let sb = Sandbox::builder("throttled")
    .image("python")
    .network(|n| n.rate_limiter(|r| r.egress(|r| r
        .bandwidth(1.mib(), Duration::from_secs(1))
        .bandwidth_burst(512.kib())
        .ops(1_000, Duration::from_secs(1)))))
    .create()
    .await?;

from microsandbox import Network, NetworkRateLimiter, RateLimiter, Sandbox, TokenBucket

sb = await Sandbox.create(
    "throttled",
    image="python",
    network=Network(
        rate_limiter=NetworkRateLimiter(
            egress=RateLimiter(
                bandwidth=TokenBucket(size=1_048_576, refill_time_ms=1_000, one_time_burst=524_288),
                ops=TokenBucket(size=1_000, refill_time_ms=1_000),
            ),
        ),
    ),
)

sb, err := m.CreateSandbox(ctx, "throttled",
    m.WithImage("python"),
    m.WithNetwork(&m.NetworkConfig{
        RateLimiter: &m.NetworkRateLimiterConfig{
            Egress: &m.RateLimiterConfig{
                Bandwidth: &m.TokenBucketConfig{Size: 1 << 20, RefillTime: time.Second, OneTimeBurst: 512 << 10},
                Ops:       &m.TokenBucketConfig{Size: 1000, RefillTime: time.Second},
            },
        },
    }),
)

msb create python --name throttled \
  --net-egress-bandwidth 1M/1s \
  --net-egress-bandwidth-burst 512K \
  --net-egress-ops 1000/1s

await using sb = await Sandbox.builder("agent")
    .image("python")
    .network((n) => n
        .policy(policy)
        .tls((t) => t)
        .http((h) => h.denyResponse(true).denyMessage("{host} is blocked. Call the `RequestHostAccess` tool to ask the user for it.")))
    .create();

let sb = Sandbox::builder("agent")
    .image("python")
    .network(|n| n
        .policy(policy)
        .tls(|t| t.enabled(true))
        .http(|h| h.deny_response(true).deny_message("{host} is blocked. Call the `RequestHostAccess` tool to ask the user for it.")))
    .create()
    .await?;

from microsandbox import HttpConfig, Network, Sandbox, TlsConfig

sb = await Sandbox.create(
    "agent",
    image="python",
    network=Network(
        policy=policy,
        tls=TlsConfig(),
        http=HttpConfig(deny_response=True, deny_message="{host} is blocked. Call the `RequestHostAccess` tool to ask the user for it."),
    ),
)

sb, err := m.CreateSandbox(ctx, "agent",
    m.WithImage("python"),
    m.WithNetwork(&m.NetworkConfig{
        Rules:           rules,
        TLS:             &m.TLSConfig{},
        HTTP: &m.HTTPConfig{DenyResponse: true, DenyMessage: "{host} is blocked. Call the `RequestHostAccess` tool to ask the user for it."},
    }),
)

sb = Microsandbox::Sandbox.create(
  "agent",
  image: "python",
  network: { allowed_hosts: ["example.com"], allowed_ports: [80, 443] },
  http: { deny_response: true, deny_message: "{host} is blocked. Ask the user to allow it." }
)

network:
  policy: none
  allow: [github.com]
  http:
    deny_response: true
    deny_message: "{host} is blocked. Call the `RequestHostAccess` tool to ask the user for it."