Struct NetworkConfig 

pub struct NetworkConfig {
    pub enabled: bool,
    pub interface: InterfaceOverrides,
    pub ports: Vec<PublishedPort>,
    pub policy: NetworkPolicy,
    pub dns: DnsConfig,
    pub tls: TlsConfig,
    pub secrets: SecretsConfig,
    pub max_connections: Option<usize>,
    pub rate_limiter: Option<NetworkRateLimiterConfig>,
    pub trust_host_cas: bool,
    pub outbound_proxy: Option<OutboundProxy>,
}

Complete network configuration for a sandbox.

Narrowed for the smoltcp in-process engine. Gateway, prefix length, and other host-backend details are engine internals derived from the sandbox slot — the user only specifies what matters: interface overrides, ports, policy, DNS, TLS, and connection limits.

Fields

enabled: bool

Whether networking is enabled for this sandbox.

interface: InterfaceOverrides

Guest interface overrides. Unset fields derived from sandbox slot.

ports: Vec<PublishedPort>

Host → guest port mappings.

policy: NetworkPolicy

Egress/ingress policy rules.

dns: DnsConfig

DNS interception and filtering settings.

tls: TlsConfig

TLS interception settings.

secrets: SecretsConfig

Secret injection settings.

max_connections: Option<usize>

Max concurrent guest connections. Default: 256, maximum: 4096.

rate_limiter: Option<NetworkRateLimiterConfig>

Egress and ingress rate limits. None means unlimited in both directions.

trust_host_cas: bool

Ship the host’s trusted root CAs into the guest at boot so outbound TLS works behind corporate MITM proxies (Cloudflare Warp Zero Trust, Zscaler, Netskope, etc.) whose gateway CA is installed on the host but not shipped in the Mozilla root bundle the guest OS uses. Opt-in: host trust is not copied into the guest unless this is explicitly enabled. Default: false.

outbound_proxy: Option<OutboundProxy>

Proxy that all outbound sandbox connections are dialed through.

Applies to TLS-intercepted and bypassed/plain TCP traffic. SOCKS5 also relays non-DNS UDP; SOCKS4 blocks it because that protocol has no UDP command.

Trait Implementations

impl Clone for NetworkConfig

fn clone(&self) -> NetworkConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetworkConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NetworkConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for NetworkConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.