Enum SandboxEgress 

pub enum SandboxEgress {
    Deny,
    Allow,
    AllowDomains {
        domains: Vec<String>,
    },
}

Outbound network policy for a sandbox.

Variants

Deny

No outbound network access.

Routed traffic only. Link-local is not outbound and no backend’s egress control reaches it, so this is not a boundary against instance metadata.

Nor, on AWS, against DNS: while the connector VPC has DNS support on, a session resolves names through that VPC’s resolver, which no security group filters, so a query name can carry data out.

Allow

Unrestricted outbound access to the public internet, and none to private ranges or the deployment’s own network.

Link-local carries the same exception as Deny. AWS and Kubernetes deliver both halves. Azure and GCP deliver the first only: one matches host patterns and the other is a single switch, so neither can name an address range to exclude.

AllowDomains

Outbound access only to the listed hostnames.

Azure alone expresses it: its egress proxy matches on host pattern. The others filter by CIDR or carry a single switch, and both would approximate the list rather than keep it.

Fields

domains: Vec<String>

Hostnames the sandbox may reach

Implementations

impl SandboxEgress

pub fn internet_access_switch(&self) -> Option<bool>

The single outbound switch for a backend that has no host matcher, or None for a mode a boolean cannot carry.

AllowDomains needs a host list, so it maps to nothing and each caller refuses it in its own error naming the sandbox. One source for what a mode means, so a template and a sandbox cannot disagree on it.

Trait Implementations

impl Clone for SandboxEgress

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxEgress

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SandboxEgress

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SandboxEgress

impl PartialEq for SandboxEgress

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SandboxEgress

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SandboxEgress