# Internet access Container connections are protected by ZeroLog's network safeguards. ## What you can expect Most common software sources and websites work without extra setup. 1. Usually ### Common destinations Package sources and websites your work depends on. Available 2. Sometimes ### A destination may be unavailable Some connections are restricted to reduce safety and abuse risks. Restricted 3. Always ### A few service ports stay closed Mail delivery, Windows file sharing and a handful of old services that outbound traffic only ever uses for spam or password guessing. **No setting opens them**Not a permission level, not an allow-list entry. Closed 4. Watched ### Unusual patterns slow down Many different destinations in a short time, many ports on one host, or the same service tried over and over. **Ordinary work is untouched**Installing packages, cloning a repository, pushing a large commit. Throttled 5. Error ### Check the command output A failed connection can also come from the destination or a temporary network problem. Retry later ### Still cannot connect? Include the destination and the error message when you contact ZeroLog support. Get help ## Testing your own servers Scanning is allowed inside a scope you have proven you own: verify the domain, and the scan may reach it and its subdomains. A load test needs a separate, time-boxed allowance — from the outside it looks exactly like an attack, so it is granted per target and expires on its own. Ask support with the target and the window you need. ## Container credentials Each container reaches the internet with a network credential that belongs to that one container. A credential presented from another container, from an unknown container type, or for a deleted or offloaded container is rejected. Support can rotate the credential of a single workspace: the old one stops working at once and the workspace gets the new one when its runtime is recreated. One limit remains: containers on worker nodes reach the gateway through a tunnel that does not reveal their name, so this name check does not apply to them yet. ## When a request fails Read the error from your command first. If the same destination keeps failing, share that error with support so they can help identify the cause.