Sandbox guide

Access and network

Outbound network: egress, allowlists and static IP

What the agent can reach, what can be blocked, and whether the outside world sees a stable address. This is where an agent that browses meets a firewall that was designed for a web app.

12 providersEvery claim dated 2026-10-28Sources linked

The idea

Outbound access is usually open by default, because an agent that cannot reach a package registry is not much use. The interesting parts are the controls: can you deny everything, allow a list of hosts, and enforce it outside the machine so root inside cannot loosen it?

A static egress IP is a separate product. It matters when a third-party API allowlists your address, or when a rate limit is shared with every other sandbox on the host. Most providers here do not offer one; Runtime sells it for $5 a month, and E2B explicitly does not offer it on any plan.

The last question is billing. Egress is free at some providers, metered at others, and unpublished at a few. A generous free allowance can be the difference between a cheap agent and an expensive one.

Where providers split

The claim on the left, the provider's own words on the right

Open by default, closed on request

Runtime starts closed and makes you open a door; a sandbox can also be set to internet: false or an allowlist. Agent 37 offers allow-all, deny-all and an IPv4 allowlist, changeable live, and DNS counts as a connection. boxd's allowlist is enforced outside the machine, so root cannot loosen it.

Sandboxer, Lizard, InstaBox and Boat are open by default with no published allowlist. Boat has no API setting for network rules at all; its firewall is ufw inside the sandbox, and rules do not survive a snapshot.

A stable address is rare

Runtime sells a dedicated outbound address per account for $5 a month. Vercel's Secure Compute gives a private path to AWS, but the public path is billed as data transfer. Most others share an address: Sandboxer says outbound traffic shares the node's IP, and InstaBox's machines share one NAT address according to a third party.

E2B is explicit that there are no dedicated or static egress IPs on any plan, including Enterprise. A customer-operated proxy is the documented workaround. Morph charges egress as a billing component but publishes no rate, allowlist or static address.

Filtering is not the same as blocking

Blaxel's proxy can filter domains, but traffic from tools that ignore proxy environment variables is not filtered unless domain filter enforcement is enabled. Vercel's firewall matchers select requests for transformation and never block a request by themselves.

That distinction matters for an agent that runs arbitrary binaries: a proxy that only sees well-behaved HTTP clients is not a network boundary.

What to watch for

The details that decide the answer in practice

  1. 01

    Whether the default is open or closed, and whether a deny-all rule also blocks DNS.

  2. 02

    Whether the allowlist is enforced outside the machine, or by a proxy the agent can bypass.

  3. 03

    Whether there is a static egress IP, and what it costs.

  4. 04

    Whether egress is free, metered, or unpublished.

  5. 05

    Whether sandboxes can reach each other over a private network.

Compare all twelve

Docs read 28 October 2026

What the agent can reach, what can be blocked, and whether the outside world sees a stable address. This is where an agent that browses meets a firewall that was designed for a web app.
ProviderDoes it?What that means
Agent 37YesAllow-all, deny-all or an IPv4 allowlist of up to 100 entries, changeable live. DNS counts as a connection, and private ranges stay blocked. No static egress IP or published egress price.
“DNS counts as a connection. Under deny-all or a list, names do not resolve unless a resolver is on the list.”
Agent 37docs-confirmed
BlaxelPartlyA proxy can filter domains, but tools that ignore proxy environment variables are not filtered unless domain filter enforcement is enabled. Egress is included in the plan.
“Traffic from tools that ignore proxy environment variables will not be filtered unless”
Blaxeldocs-confirmed
BoatPartlyOutbound is open by default with no API for network rules; ufw inside the sandbox is the control, and firewall rules do not survive a snapshot. Egress is not billed.
“boat has no API setting for network rules.”
Boatdocs-confirmed
boxdYesA per-machine allowlist enforced outside the machine, so root inside cannot loosen it. Forks inherit it; a machine from a snapshot starts unrestricted.
“An allowlist of just none cuts the machine off from the internet entirely.”
boxddocs-confirmed
E2BYesOutbound is open by default with documented domain and IP allow and deny rules. No dedicated or static egress IP on any plan, including Enterprise.
“there are no dedicated or static egress IP addresses on any plan (including Enterprise).”
E2Bdocs-confirmed
InstaBoxPartlyNo general egress allowlist is published; host scoping applies to Secrets, not all sandbox traffic. Egress is metered at $0.02 per GiB, and machines share a NAT address.
“This scopes credential use, not all sandbox network access.”
InstaBoxdocs-confirmed
LizardPartlyOutbound is open with no documented allowlist. Sandbox egress has no per-GB charge, with 2 TB per account over a rolling 30 days included.
“Sandbox egress has no separate per-GB charge. The included allowance is 2 TB per account over a rolling 30 days”
Lizarddocs-confirmed
MorphNot publishedEgress is a chargeable component in the terms, but no per-GB rate, allowlist, static IP or filtering is published. Do not assume egress is free.
“Typical components may include but are not limited to compute, snapshot storage, and egress.”
Morphdocs-confirmed
RuntimeYesinternet: false refuses everything, an allow list is allow-list only, and deny always wins. A dedicated outbound address costs $5 a month, and sandboxes reach each other over a private name.
“internet: false refuses every outbound connection. With an allow list, it is allow-list only.”
Runtimedocs-confirmed
SandboxerPartlyOutbound is open by default with no allowlist product. Traffic shares the node's IPv4 and IPv6 with other sandboxes, so external rate limits are shared.
“outbound internet is open by default”
Sandboxerdocs-confirmed
SpritesYesOutbound is unrestricted by default, with an opt-in DNS allowlist applied from outside the Sprite. Bandwidth is not metered.
“Applying one is opt-in and done from outside the Sprite.”
Spritesdocs-confirmed
Vercel SandboxYesFirewall rules default to allow-all and can be set per sandbox. Matchers transform requests but never block them, so an allowlist needs an explicit rule.
“Firewall rules for sandbox egress traffic. Defaults to "allow-all".”
Vercel Sandboxdocs-confirmed

Part of Access and network. Next: put two or three providers side by side.