CapabilitiesOutbound network
Turn the internet off
Run a machine with no internet access at all.
Short answer: 9 of 16 providers offer it fully: Agent 37, Cloudflare Sandbox, Daytona, E2B, Modal, Runtime, Tensorlake, Vercel Sandbox and boxd. With a catch: Boat, Sandboxer and Sprites. Checked 29 October 2026.
Who offers it
Part of Outbound network: egress, allowlists and static IP, which explains why it matters.
Fully: Agent 37, boxd, Cloudflare Sandbox, Daytona, E2B, Modal, Runtime, Tensorlake and Vercel Sandbox. With a catch: Boat, Sandboxer and Sprites.
One setting refuses every outbound connection, including name lookups.
docs-confirmed “Nothing, including DNS.” Source
One allowlist value cuts the machine off from the internet completely.
docs-confirmed “An allowlist of just `none` cuts the machine off from the internet entirely.” Source
The machine starts with no internet access unless you switch it on.
docs-confirmed “A Container starts with `enableInternet: false` by default, so it cannot reach the Internet.” Source
A machine can be set to block every outbound connection.
docs-confirmed “setting an allow list or `networkBlockAll` at create time applies that policy for the sandbox” Source
Internet access can be switched off entirely for a machine.
docs-confirmed “Control and restrict it with a simple on/off switch or fine-grained allow and deny lists.” Source
One setting drops all outbound traffic.
docs-confirmed “Drops all outbound traffic.” Source
One setting refuses every outbound connection.
docs-confirmed “`internet: false` refuses every outbound connection.” Source
One setting blocks all outbound traffic, including name lookups.
docs-confirmed “Setting `allow_internet_access=false` with an empty `allow_out` blocks all outbound traffic, including DNS requests.” Source
A firewall policy can be set to block all outbound traffic.
docs-confirmed “Use the explicit `deny-all` mode when you intend to block all traffic” Source
The catch: You can block traffic with the machine's own firewall, but the agent has administrator rights there and the rules are lost on restore.
docs-confirmed “You have root in the sandbox, so you add rules with ufw or iptables” Source
The catch: There is no provider setting; you block traffic with the machine's own firewall, which the agent can undo.
docs-confirmed “Sandboxer has no egress allowlist; restrict outbound yourself with ufw inside the VM.” Source
The catch: You can deny every domain by policy, but the machine keeps its network and the rule works by refusing name lookups.
docs-confirmed “a DNS-based allowlist that decides which domains a Sprite is allowed to reach” Source
- BlaxelNot published
No setting that removes internet access entirely is documented; the proxy can filter but not necessarily cut it off.
inferred “Restrict which external domains, HTTP methods, and URL paths a Blaxel sandbox can reach” Source
- InstaBoxNot published
No setting that removes internet access entirely is documented.
inferred “Outbound bandwidth” Source
- LizardNot published
No setting that removes internet access entirely is documented.
inferred “Sandbox egress has no separate per-GB charge.” Source
- MorphNot published
No setting that removes internet access entirely is published.
inferred “Every devbox is created from a template that integrates with our secrets manager” Source
Related
Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.