Package com.tnsai.quality.sandbox

Interface NetPolicy

All Known Implementing Classes:
NetPolicy.AllowList, NetPolicy.DenyAll, NetPolicy.Inherit
public sealed interface NetPolicy permits NetPolicy.DenyAll, NetPolicy.AllowList, NetPolicy.Inherit
Network access policy applied to a sandbox (TNS-296).

Sealed so the framework can pattern-match on policy choice when translating to backend-specific arguments (Docker --network, Linux netns, WASM capability gates, …) and so an exhaustive switch surfaces a build error if a new policy is added without backend support.

Default = deny

The recommended sandbox stance is "no network". Most code-execution use cases (LLM-generated python, untrusted shell) don't need network access; granting it by default would silently widen the blast radius of a compromise.

Use NetPolicy.AllowList to whitelist specific hosts, or NetPolicy.Inherit when the sandbox runs trusted code that needs unrestricted network (the caller still records the choice on the SandboxSpec so audit consumers can flag it).

Since:
0.10.0 (TNS-296)

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Interface
    Description
    static final record 
    NetPolicy.AllowList
    Allow only the listed hosts.
    static final record 
    NetPolicy.DenyAll
    No network access.
    static final record 
    NetPolicy.Inherit
    Sandbox inherits the host's network.

  • Method Summary

    Static Methods
    Modifier and Type
    Method
    Description
    static NetPolicy
    allow(List<String> hosts)
    Allow access only to the listed hosts ("github.com", "api.openai.com:443", …).
    static NetPolicy
    denyAll()
    No outbound or inbound network access.
    static NetPolicy
    inherit()
    Sandbox inherits the host's network.

  • Method Details

    • denyAll

      static NetPolicy denyAll()
      No outbound or inbound network access. The recommended default.

    • allow

      static NetPolicy allow(List<String> hosts)
      Allow access only to the listed hosts ("github.com", "api.openai.com:443", …). Empty list means deny-all (callers that want deny-all should use denyAll() explicitly for clarity).

    • inherit

      static NetPolicy inherit()
      Sandbox inherits the host's network. Use sparingly — bypasses the framework's deny-by-default safety stance.