Egress + uploads together

Connecting data into the core and letting the sandbox reach out are two different doors — the egress flag only governs one of them.

Each project has an egress setting: restricted (default) or open. People sometimes assume that setting also controls uploads. It doesn't — and the asymmetry is on purpose.

The two directions

Direction	Mechanism	Affected by egress flag?
Inbound (user → sandbox via upload)	Pre-signed R2 PUT, FUSE mount surfaces the bytes in /workspace/	No. Uploads are always allowed for project members.
Outbound (sandbox → public internet)	The sandbox's network stack (Cloudflare's container egress)	Yes. restricted blocks; open allows.

Why the asymmetry

Uploads are explicitly authorized — they require a member-or-higher caller, a valid pre-signed URL, audited per row. The threat model for inbound is "did the project member intend to share this file?" — which they answered yes to by issuing the link.

Outbound is different. The threat model is "can the agent reach an attacker's exfiltration endpoint?" — which the project owner answers explicitly by flipping the flag.

What you can do with restricted

• All upload paths work (upload.create_link, upload.write, dashboard drop-zone, sh "cat >").
• The agent can read uploaded files (sh "cat /workspace/foo") — that's local-only.
• The agent can run anything on local files (sh "python analyze.py /workspace/data.csv") — same.
• The agent cannot apt-get install, pip install, curl https://example.com, etc.

What you unlock with open

• Public-internet outbound. Package managers work, third-party APIs work, the agent can git push to your remote, etc.
• Same inbound model — uploads are unchanged.

Common foot-guns

• "I uploaded a file but the analysis fails on dependency install." That's an outbound issue (pip can't reach PyPI), not an upload issue. Flip egress to open.
• "I set restricted and uploads stopped working." They didn't — check what's actually failing. Probably a pip install somewhere in the agent's recipe.
• "I want to allow uploads but deny outbound." That's the default restricted — it does exactly what you want.

Egress for the agent's outbound calls (future)

The Sandbox SDK supports a configurable per-request egress proxy. Today we only expose the binary flag (restricted / open). Future: per-host allowlist (e.g. "allow PyPI + GitHub, deny everything else") via a richer settings object. Not on the immediate roadmap.

Next steps

• What an upload link can and can't do.
• Why pre-signed URLs and not a proxy.

Where this fits

This is the Connect everything pillar of connect0 — the core that connects everything your company runs on. Uploads always connect data into the core; the egress flag is a separate control on the sandbox reaching back out. Start building → · All guides →