Private networking

Private networking lets Inspect sandboxes reach private HTTP and HTTPS services through supported VPN tunnel software installed in the sandbox, such as Tailscale or WireGuard. An organization administrator controls this setting from Organization → Security.

Inspect reads the current setting whenever a sandbox starts, whether for a new session or as a replacement sandbox for an existing session. Turning it on or off does not change a sandbox that is already running. Start a new session when you need a new sandbox with the current setting immediately.

Before you startCopy Anchor Link

Install and authenticate the tunnel software your organization supports inside the sandbox. Inspect does not install VPN software or provision VPN credentials.

The tunnel must provide a specific route to the private destination. Tailscale peer routes, MagicDNS names, and advertised subnet routes work after Tailscale is connected and the relevant route is available. WireGuard and other supported tunnels likewise need an active route. Userspace-only tunnels without a kernel route are not supported.

How connections are routedCopy Anchor Link

Continue using the HTTP and HTTPS proxy environment that Inspect injects. You do not need to configure NO_PROXY, CIDR allowlists, Linux interface names, route tables, or another proxy. The correct routing happens automatically.

For each private connection, the local proxy resolves the destination inside the sandbox and checks the current tunnel routes. Once a safe, specific private route appears, later HTTP and HTTPS connections use it automatically; no session or proxy reconfiguration is required. Private DNS and MagicDNS must resolve inside the sandbox to the address covered by that route.

Public traffic continues through Inspect's authenticated standard egress. Tunnel default or exit-node routes do not authorize private connections. Cloud metadata, loopback, link-local, and other restricted or special-use destinations remain blocked.

Security considerationsCopy Anchor Link

Private networking lets the agent, tools, and repository code running in the sandbox make HTTP and HTTPS requests to services reachable through the authenticated tunnel. Use a dedicated, least-privilege tunnel identity and network ACLs that expose only the services the session needs. Private services should continue enforcing their own authentication and authorization.

Inspect verifies that each private connection uses a safe, specific tunnel route and keeps default routes and restricted targets blocked. These protections reduce accidental exposure, but they do not replace your VPN access policy or the destination service's controls. Review untrusted prompts and repository code before giving a session access to sensitive private services, just as you would for any other network-connected development environment.

Inspect does not record standard egress logs for requests sent from a sandbox to private destinations through the tunnel. Use your VPN and destination-service audit logs when you need visibility into private traffic, and do not rely on Inspect for private-network request history.