Egress

Egress rules control which external hosts a sandbox can reach. By default (empty rule list) all outbound traffic is allowed. Once you set any rules, only the listed destinations pass — everything else is dropped in-kernel.

Rules apply live with no sandbox restart required.

Get your API key from https://createos.nodeops.network/profile. Pass it as X-Api-Key: <token> on every request.

Base URL: https://api.sb.createos.sh

At a glance

• Base URL: https://api.sb.createos.sh
• Auth: X-Api-Key: <token> header — get a token
• Response envelope: JSend — {"status": "...", "data": ...}

Rule formats

Each rule is a string in one of these forms:

Empty list / null / ["*"] — all outbound traffic is allowed (no iptables chain installed).

There is no denylist token. To block one destination you must list all destinations you do want.

GET /v1/sandboxes/{id}/egress

Read the current egress allowlist for a sandbox.

Auth required: Yes

Path parameters

Example

Bash
Copy
1curl https://api.sb.createos.sh/v1/sandboxes/sb_01K.../egress \
2  -H "X-Api-Key: $CREATEOS_API_KEY"

Success response 200

JSON
Copy
1{
2  "status": "success",
3  "data": {
4    "id": "sb_01K…",
5    "egress": [
6      "pypi.org",
7      "*.pythonhosted.org",
8      "github.com:443"
9    ]
10  }
11}

Notable errors: 404 — sandbox not found or not owned by caller.

PUT /v1/sandboxes/{id}/egress

Replace the egress allowlist atomically. The new rules take effect immediately — the in-kernel iptables chain is flushed and rebuilt in a single update.

Auth required: Yes

Path parameters

Request body

Example — restrict to PyPI and GitHub

Bash
Copy
1curl -X PUT https://api.sb.createos.sh/v1/sandboxes/sb_01K.../egress \
2  -H "X-Api-Key: $CREATEOS_API_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "egress": [
6      "pypi.org",
7      "*.pythonhosted.org",
8      "github.com:443",
9      "1.1.1.1:53"
10    ]
11  }'

Success response 200

JSON
Copy
1{
2  "status": "success",
3  "data": {
4    "id": "sb_01K…",
5    "egress": [
6      "pypi.org",
7      "*.pythonhosted.org",
8      "github.com:443",
9      "1.1.1.1:53"
10    ]
11  }
12}

Example — restore allow-all

Bash
Copy
1curl -X PUT https://api.sb.createos.sh/v1/sandboxes/sb_01K.../egress \
2  -H "X-Api-Key: $CREATEOS_API_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{"egress": []}'

Notable errors: 404 — sandbox not found.

Setting egress at sandbox creation

You can also supply the initial egress list when creating a sandbox. Pass egress in the POST /v1/sandboxes body:

JSON
Copy
1{
2  "shape": "s-1vcpu-256mb",
3  "egress": ["pypi.org", "github.com:443"]
4}

See /createos/docs/Sandbox/REST-API/Sandboxes for the full create request shape.