Internet access

Container connections are protected by ZeroLog's network safeguards.

What you can expect

Most common software sources and websites work without extra setup.

How one outbound connection is judgedA container has no route to the internet except through the egress broker, which knows which container and which owner a connection belongs to. The broker first refuses connections to closed ports such as mail, SMB and telnet, whatever your settings. Then it allows destinations on your allow-list. Otherwise it allows public hosts that are on no blocklist and refuses internal addresses. Unusual traffic patterns are slowed.closedopenyesnoyes (slowed if the pattern isunusual)noYour containerno route to the internetexcept through the brokerEgress brokerknows which containerand which owner1. Is the port closed?mail, SMB, telnet and otherold services: refused, always2. Is the destinationon your allow-list?3. A public host that is onno blocklist? Allowed bydefault.Internal addresses stayrefusedInternetRefused and recorded
The default path lets public sites through; closed ports are refused before anything else is checked.
Diagram as text
  1. A container has no route to the internet except through the egress broker. The broker knows which container and which owner each connection belongs to.
  2. First, the port. Mail, Windows file sharing and a handful of old services are closed for every workspace. No setting, permission level or allow-list entry opens them.
  3. Next, your allow-list. A destination you allowed is let through.
  4. Otherwise the default applies: a public host that is on no blocklist is allowed. Internal addresses and blocklisted hosts are refused.
  5. Unusual patterns, such as many different destinations in a short time or many ports on one host, are slowed. Ordinary work is not affected.
  6. Every decision is recorded.
  1. Usually

    Common destinations

    Package sources and websites your work depends on.

    Available

  2. Sometimes

    A destination may be unavailable

    Some connections are restricted to reduce safety and abuse risks. Internal and private addresses are never reachable from a workspace.

    Restricted

  3. Always

    A few service ports stay closed

    Mail delivery, Windows file sharing and a handful of old services that outbound traffic only ever uses for spam or password guessing.

    No setting opens themNot a permission level, not an allow-list entry.

    Closed

  4. Watched

    Unusual patterns slow down

    Many different destinations in a short time, many ports on one host, or the same service tried over and over.

    Ordinary work is untouchedInstalling packages, cloning a repository, pushing a large commit.

    Throttled

  5. Error

    Check the command output

    A failed connection can also come from the destination or a temporary network problem.

    Retry later

Still cannot connect?

Include the destination and the error message when you contact ZeroLog support.

Get help

Testing your own servers

Scanning is allowed inside a scope you have proven you own: verify the domain, and the scan may reach it and its subdomains. A load test needs a separate, time-boxed allowance — from the outside it looks exactly like an attack, so it is granted per target and expires on its own. Ask support with the target and the window you need.

Container credentials

Each container reaches the internet with a network credential that belongs to that one container. A credential presented from another container, from an unknown container type, or for a deleted or offloaded container is rejected. Support can rotate the credential of a single workspace: the old one stops working at once and the workspace gets the new one when its runtime is recreated. One limit remains: containers on worker nodes reach the gateway through a tunnel that does not reveal their name, so this name check does not apply to them yet.