Outbound network
Containers reach the internet through a controlled gateway rather than directly.
The order of checks
Two lists decide where a connection may go, and they are read in this order. The first match decides.
-
01
The hard allow-list
Package registries, source hosts and provider APIs.
Why Checked first, so a false positive cannot break a build.
Reachable
-
02
The harm blocklist
Roughly 3.5 million domains.
Cost Under two microseconds per connection.
Blocked
-
Else
Everything else
Named by neither list. The default is to reach it.
Reachable
If the filter cannot load
Nothing is blocked, and the status says so. The platform does not fail closed.
Nothing blocked
What is capped
Connection rateper container
Concurrencyper container
Generous enough for a build, low enough that the platform cannot be used to flood anyone.
When something you need is blocked
Ask.