Restrict public access

Public URLs accept requests without authentication by default. Set allowPublicTraffic in JavaScript, allow_public_traffic in Python, or AllowPublicTraffic in Go to false when you create a sandbox to require its traffic access token. This requires secure controller access; in Go, also enable Secure explicitly as shown below.

mjs

import { Sandbox } from "@abox-dev/sdk";

const sandbox = await Sandbox.create({
  network: { allowPublicTraffic: false },
});

try {
  await sandbox.commands.run("python3 -m http.server 8080", {
    background: true,
  });
  await sandbox.commands.run(
    "until curl -fsS http://127.0.0.1:8080/ >/dev/null; do sleep 0.1; done",
  );

  const url = `https://${sandbox.getHost(8080)}`;
  const anonymousResponse = await fetch(url);
  console.log(`Without token: ${anonymousResponse.status}`);

  const authorizedResponse = await fetch(url, {
    headers: {
      "Agentbox-Traffic-Access-Token": sandbox.trafficAccessToken,
    },
  });
  console.log(`With token: ${authorizedResponse.status}`);
} finally {
  await sandbox.kill();
}

from urllib.error import HTTPError
from urllib.request import Request, urlopen

from agentbox import Sandbox


sandbox = Sandbox.create(network={"allow_public_traffic": False})

try:
    sandbox.commands.run("python3 -m http.server 8080", background=True)
    sandbox.commands.run(
        "until curl -fsS http://127.0.0.1:8080/ >/dev/null; do sleep 0.1; done"
    )

    url = f"https://{sandbox.get_host(8080)}"
    try:
        urlopen(url)
    except HTTPError as error:
        print(f"Without token: {error.code}")

    request = Request(
        url,
        headers={
            "Agentbox-Traffic-Access-Token": sandbox.traffic_access_token,
        },
    )
    with urlopen(request) as response:
        print(f"With token: {response.status}")
finally:
    sandbox.kill()

package main

import (
	"context"
	"fmt"
	"log"
	"net/http"

	"github.com/abox-dev/sdk/packages/go-sdk"
)

func kill(sandbox *agentbox.Sandbox) {
	if _, err := sandbox.Kill(context.Background()); err != nil {
		log.Printf("cleanup sandbox: %v", err)
	}
}

func run() (err error) {
	ctx := context.Background()
	client, err := agentbox.NewClient()
	if err != nil {
		return err
	}
	public := false
	secure := true
	sandbox, err := client.Sandboxes.Create(ctx, &agentbox.CreateSandboxOptions{
		Secure:  &secure,
		Network: &agentbox.SandboxNetworkConfig{AllowPublicTraffic: &public},
	})
	if err != nil {
		return err
	}
	defer kill(sandbox)
	if _, err := sandbox.Commands.Start(ctx, "python3", &agentbox.CommandOptions{
		Args: []string{"-m", "http.server", "8080"},
	}); err != nil {
		return err
	}
	if _, err := sandbox.Commands.Run(ctx, "sh", &agentbox.CommandOptions{
		Args: []string{"-lc", "until curl -fsS http://127.0.0.1:8080/ >/dev/null; do sleep 0.1; done"},
	}); err != nil {
		return err
	}
	request, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+sandbox.Host(8080), nil)
	if err != nil {
		return err
	}
	unauthenticated, err := http.DefaultClient.Do(request)
	if err != nil {
		return err
	}
	unauthenticated.Body.Close()
	fmt.Println("Without token:", unauthenticated.StatusCode)
	authenticated, err := sandbox.Request(ctx, 8080, http.MethodGet, "/", nil, false)
	if err != nil {
		return err
	}
	defer authenticated.Body.Close()
	fmt.Println("With token:", authenticated.StatusCode)
	return nil
}

func main() {
	if err := run(); err != nil {
		log.Fatal(err)
	}
}

A request without the token receives 403. Send the token in the Agentbox-Traffic-Access-Token header. Read it from sandbox.trafficAccessToken or sandbox.traffic_access_token; do not print or store it in application logs. In Go, use sandbox.Request: it adds the token automatically without exposing it to the caller.

This setting protects incoming requests to every public URL of the sandbox. It does not disable outbound internet access or SDK commands. Configure outbound connections separately in Internet access.

Restrict public access ​

Restrict public access