networks//network egress

Network egress is traffic leaving a machine, workload or trust zone. Egress policy controls which destinations, protocols and ports that workload may reach.

Network egress is traffic leaving a machine, workload or trust zone. Egress policy controls which destinations, protocols and ports that workload may reach.

For an agent sandbox, inbound isolation is only half the boundary. Unrestricted outbound access can enable data exfiltration, arbitrary downloads, command-and-control traffic or contact with external services. Reachability is a capability, granted under minimum privilege with the same restraint as filesystem access, so a useful policy often begins with no network and adds narrowly scoped destinations as the task demonstrates need.

A workload with no public port can still have a path to the Internet. Direction matters.