Internet access - Documentation

Internet access is enabled in every sandbox by default, but you can disable it for isolated workloads. Services running inside a sandbox can also be exposed through a public URL.

Toggling internet access

When creating a sandbox, you can use the allowInternetAccess / allow_internet_access parameter to configure internet connectivity. Internet access is turned on by default, but it can be disabled for workloads with stricter security requirements.

import { Novita } from 'novita-sandbox'

const novita = new Novita()

// Create sandbox with internet access enabled (default).
const sandbox = await novita.sandbox.create({ allowInternetAccess: true })

// Create sandbox without internet access.
const isolatedSandbox = await novita.sandbox.create({ allowInternetAccess: false })

from novita_sandbox import Novita

novita = Novita()

# Create sandbox with internet access enabled (default).
sandbox = novita.sandbox.create(allow_internet_access=True)

# Create sandbox without internet access.
isolated_sandbox = novita.sandbox.create(allow_internet_access=False)

Fine-grained network control

Network configuration provides finer-grained control over outbound traffic by allowing you to define allowlists and denylists.

import { Novita } from 'novita-sandbox'

const novita = new Novita()

// Deny all traffic except specific IPs.
const sandbox = await novita.sandbox.create({
  network: {
    denyOut: ['0.0.0.0/0'],
    allowOut: ['1.1.1.1', '8.8.8.0/24'],
  },
})

// Allow only traffic to selected domains.
const domainSandbox = await novita.sandbox.create({
  network: {
    allowOut: ['api.example.com', '*.github.com'],
    denyOut: ['0.0.0.0/0'],
  },
})

from novita_sandbox import Novita

novita = Novita()

# Deny all traffic except specific IPs.
sandbox = novita.sandbox.create(
    network={
        'deny_out': ['0.0.0.0/0'],
        'allow_out': ['1.1.1.1', '8.8.8.0/24'],
    }
)

# Allow only traffic to selected domains.
domain_sandbox = novita.sandbox.create(
    network={
        'allow_out': ['api.example.com', '*.github.com'],
        'deny_out': ['0.0.0.0/0'],
    }
)

Sandbox public URL

Services in a sandbox can be accessed by using the sandbox’s public URL.

import { Novita } from 'novita-sandbox'

const novita = new Novita()
const sandbox = await novita.sandbox.create()

const host = sandbox.getHost(3000)
console.log(`https://${host}`)

from novita_sandbox import Novita

novita = Novita()
sandbox = novita.sandbox.create()

host = sandbox.get_host(3000)
print(f'https://{host}')

Connecting to a server running inside the sandbox

import { Novita } from 'novita-sandbox'

const novita = new Novita()
const sandbox = await novita.sandbox.create()

const process = await sandbox.commands.run('python -m http.server 3000', { background: true })
const url = `https://${sandbox.getHost(3000)}`
console.log('Server started at:', url)

const response = await fetch(url)
const data = await response.text()
console.log('Response from server inside sandbox:', data)

await process.kill()
await sandbox.kill()

import requests
from novita_sandbox import Novita

novita = Novita()
sandbox = novita.sandbox.create()

process = sandbox.commands.run('python -m http.server 3000', background=True)
url = f'https://{sandbox.get_host(3000)}'
print('Server started at:', url)

response = requests.get(url)
data = response.text
print('Response from server inside sandbox:', data)

process.kill()
sandbox.kill()

Masking request host headers

You can use the maskRequestHost / mask_request_host option to customize the Host header sent to services running inside the sandbox.

import { Novita } from 'novita-sandbox'

const novita = new Novita()
const sandbox = await novita.sandbox.create({
  network: {
    maskRequestHost: 'localhost:${PORT}',
  },
})

from novita_sandbox import Novita

novita = Novita()
sandbox = novita.sandbox.create(
    network={
        'mask_request_host': 'localhost:${PORT}',
    }
)

Last modified on August 5, 2026

⌘I