Network Access

Sandbox network behavior depends on the underlying service run, agent configuration, Kubernetes networking, and organization policy.

This page continues from the Sandbox Quick Start and uses its quick-start project and RUN_UUID variable.

Service Ports

Declare run.ports for services that expose HTTP applications such as notebooks, dashboards, or custom apps. Sandbox and SSH plugin ports are injected automatically; do not add them to this list:

run:
  kind: service
  ports:
    - 8888
  container:
    image: jupyter/scipy-notebook
    command: ["start-notebook.py"]

For service workload details, see services.

SSH Tunnels

Use SSH tunnels when a local tool needs access to a service port. The run must have plugins.ssh: true:

polyaxon ssh connect -p quick-start -uid $RUN_UUID -- -L 8888:127.0.0.1:8888 -N

Outbound Access

Outbound network access is controlled by your cluster, agent, and network policies. If a command cannot reach a package index, Git host, model provider, or data service, check with the platform team before changing the workload.

Access Model

Polyaxon routes sandbox and SSH access through authenticated project permissions. Do not expose debug services directly unless your deployment and security policy allow it.