Network policy you can verify

What you will build

A case ledger for a single disposable local sandbox. It will contain your intended result, active rule source, policy-check result, actual request result and matching log evidence. This is the first detailed security experiment in the book.

Read the mechanism

A default-deny policy blocks access that has no matching permission. It is not the same as an explicit deny of every destination: an agent kit can contribute an allowance. When an applicable allow and deny both match, the deny wins. Under organization governance, local and kit allows cannot widen the organization’s grants.

Destination checks and HTTP controls operate at different levels. A host-and-port check can report allowed while a particular method or path is blocked. Likewise, an allowed request can fail because DNS, TLS, an upstream proxy or the service itself is broken. “curl failed” is not enough evidence to attribute a denial.

Network policy is persistent configuration. Run this only where you are authorized to create sandbox-scoped rules. If first-run setup asks you to choose a global preset, make that machine-wide decision intentionally outside the exercise. Do not reset policies or weaken organization controls to obtain a green result.

Worked lab · allow, then deny

First record the baseline and create a mountless shell environment:

sbx version
sbx policy ls --include-inactive --wide
sbx create --name handbook-net --skills off shell
sbx policy ls handbook-net --wide
sbx policy check network --sandbox handbook-net example.com:443

Write down the predicted decision. Then add one narrowly scoped grant, if local policy administration is permitted:

sbx policy allow network --sandbox handbook-net example.com:443
sbx policy ls handbook-net --wide
sbx exec handbook-net curl --connect-timeout 5 --max-time 15 -I https://example.com
sbx policy log handbook-net --limit 20 --json

Record the created rule ID. If the allow is inactive under governance, preserve that observation and stop the permissive branch. An inactive rule is not an invitation to change global policy.

Now add a scoped explicit deny and repeat the same request:

sbx policy deny network --sandbox handbook-net example.com:443
sbx policy check network --sandbox handbook-net example.com:443
sbx exec handbook-net curl --connect-timeout 5 --max-time 15 -I https://example.com
sbx policy log handbook-net --limit 20 --json

Save the deny rule ID too. To demonstrate recovery, remove only that exercise deny using sbx policy rm network --sandbox handbook-net --id RECORDED_DENY_RULE_ID. Replace the uppercase token with the actual observed ID; it is not a literal runnable value. Recheck before sending another bounded request.

Finally use sbx policy check network --sandbox handbook-net policy-lab.invalid:443 as a policy-only no-match case. The reserved .invalid name is unsuitable for a real connectivity denial test because DNS failure would occur independently.

Expected observations

These are expectations, not completed results. Record actual results in your ledger only after running the lab. Correlate sandbox name, destination, timestamp and rule; a nearby log line from a different request is weak evidence.

Troubleshooting

An allowed destination plus failed request calls for transport diagnosis. A denied request with no matching explicit deny may be a no-permission/approval path. A hostname allow is not necessarily evaluated again against CIDR denies on its resolved address; inspect the current policy reference rather than inventing an IP precedence rule. When versions change, compare stored policy as well as the new binary.

Export the ledger before removing the named disposable sandbox. Do not use sbx policy reset as a refresh: it deletes local policy and restarts the daemon, stopping running sandboxes.

Interview practice

Completion check

Explain every row in your case ledger, restore only the exercise rule you created, and state the limits of the experiment. A single domain test does not validate all protocols, wildcard patterns or organization policy states.

Sources and version notes

Checked 6 October 2026; current baseline: sbx v0.46.0. Local policy · Policy concepts · sbx policy check · sbx policy allow · sbx policy deny · sbx policy log