Egress policy

An egress policy is a set of rules that limits which outbound network connections a workload may open: which addresses, which ports, or none at all. It's the network half of a sandbox.

What it is

In Kubernetes, egress rules are written as a NetworkPolicy. By default a pod may connect anywhere. Once a policy that selects the pod lists Egress in its policy types, the pod may make only the connections some policy allows. An ipBlock can allow a range while carving out exceptions, for example "the internet, except private networks". Policies only take effect if the cluster's network plugin enforces them.

Applications add a second layer for URLs users supply: before calling a webhook or a remote server, they check that the address isn't private, loopback or a metadata endpoint. That guards against server-side request forgery (SSRF).

Why it matters

Code that can't connect out can't send secrets or source code anywhere, can't download a second-stage payload, and can't probe internal services. For agent-written code and freshly installed packages, that removes most of what an attack would need.

In AI CodeOps

Sandbox pods have no inbound access. Outbound, they can resolve DNS and reach the public internet on TCP ports 80 and 443 only. Private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10), loopback, link-local and metadata addresses (169.254.0.0/16) and the cluster's node addresses are blocked. A test run switches to a deny-all policy before your tests start.

URLs you configure, such as webhooks, MCP servers, model provider addresses and Git remotes, are checked to reject private, loopback and metadata addresses.