> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novita.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Internet access

Internet access is enabled in every sandbox by default, but you can disable it for isolated workloads.

Services running inside a sandbox can also be exposed through a public URL.

## Toggling internet access

When creating a sandbox, you can use the `allowInternetAccess` / `allow_internet_access` parameter to configure internet connectivity. Internet access is turned on by default, but it can be disabled for workloads with stricter security requirements.

```js JavaScript & TypeScript icon="js" theme={"system"}
import { Novita } from 'novita-sandbox'

const novita = new Novita()

// Create sandbox with internet access enabled (default).
const sandbox = await novita.sandbox.create({ allowInternetAccess: true })

// Create sandbox without internet access.
const isolatedSandbox = await novita.sandbox.create({ allowInternetAccess: false })
```

```python Python icon="python" theme={"system"}
from novita_sandbox import Novita

novita = Novita()

# Create sandbox with internet access enabled (default).
sandbox = novita.sandbox.create(allow_internet_access=True)

# Create sandbox without internet access.
isolated_sandbox = novita.sandbox.create(allow_internet_access=False)
```

```bash CLI icon="terminal" theme={"system"}
# Create a sandbox with internet access enabled (default behavior, no extra arguments)
novita sandbox create base -d

# Create a sandbox without internet access
novita sandbox create base --no-internet -d
```

## Fine-grained network control

Network configuration provides finer-grained control over outbound traffic by allowing you to define allowlists and denylists.

```js JavaScript & TypeScript icon="js" theme={"system"}
import { Novita } from 'novita-sandbox'

const novita = new Novita()

// Deny all traffic except specific IPs.
const sandbox = await novita.sandbox.create({
  network: {
    denyOut: ['0.0.0.0/0'],
    allowOut: ['1.1.1.1', '8.8.8.0/24'],
  },
})

// Allow only traffic to selected domains.
const domainSandbox = await novita.sandbox.create({
  network: {
    allowOut: ['api.example.com', '*.github.com'],
    denyOut: ['0.0.0.0/0'],
  },
})
```

```python Python icon="python" theme={"system"}
from novita_sandbox import Novita

novita = Novita()

# Deny all traffic except specific IPs.
sandbox = novita.sandbox.create(
    network={
        'deny_out': ['0.0.0.0/0'],
        'allow_out': ['1.1.1.1', '8.8.8.0/24'],
    }
)

# Allow only traffic to selected domains.
domain_sandbox = novita.sandbox.create(
    network={
        'allow_out': ['api.example.com', '*.github.com'],
        'deny_out': ['0.0.0.0/0'],
    }
)
```

```bash CLI icon="terminal" theme={"system"}
# Deny all traffic except the allowed IPs
# (--allow-out / --deny-out accept comma-separated CIDR lists and can be repeated)
novita sandbox create base -d \
  --deny-out 0.0.0.0/0 \
  --allow-out 1.1.1.1,8.8.8.0/24
```

## Sandbox public URL

Services in a sandbox can be accessed by using the sandbox's public URL.

```js JavaScript & TypeScript icon="js" theme={"system"}
import { Novita } from 'novita-sandbox'

const novita = new Novita()
const sandbox = await novita.sandbox.create()

const host = sandbox.getHost(3000)
console.log(`https://${host}`)
```

```python Python icon="python" theme={"system"}
from novita_sandbox import Novita

novita = Novita()
sandbox = novita.sandbox.create()

host = sandbox.get_host(3000)
print(f'https://{host}')
```

```bash CLI icon="terminal" theme={"system"}
# Create a sandbox and allow public traffic to access its URL directly
# (--public-traffic makes the sandbox URL accessible without an access token)
novita sandbox create base --public-traffic -d
```

## Connecting to a server running inside the sandbox

```js JavaScript & TypeScript icon="js" theme={"system"}
import { Novita } from 'novita-sandbox'

const novita = new Novita()
const sandbox = await novita.sandbox.create()

const process = await sandbox.commands.run('python -m http.server 3000', { background: true })
const url = `https://${sandbox.getHost(3000)}`
console.log('Server started at:', url)

const response = await fetch(url)
const data = await response.text()
console.log('Response from server inside sandbox:', data)

await process.kill()
await sandbox.kill()
```

```python Python icon="python" theme={"system"}
import requests
from novita_sandbox import Novita

novita = Novita()
sandbox = novita.sandbox.create()

process = sandbox.commands.run('python -m http.server 3000', background=True)
url = f'https://{sandbox.get_host(3000)}'
print('Server started at:', url)

response = requests.get(url)
data = response.text
print('Response from server inside sandbox:', data)

process.kill()
sandbox.kill()
```

## Masking request host headers

You can use the `maskRequestHost` / `mask_request_host` option to customize the Host header sent to services running inside the sandbox.

```js JavaScript & TypeScript icon="js" theme={"system"}
import { Novita } from 'novita-sandbox'

const novita = new Novita()
const sandbox = await novita.sandbox.create({
  network: {
    maskRequestHost: 'localhost:${PORT}',
  },
})
```

```python Python icon="python" theme={"system"}
from novita_sandbox import Novita

novita = Novita()
sandbox = novita.sandbox.create(
    network={
        'mask_request_host': 'localhost:${PORT}',
    }
)
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.