mirror of
https://github.com/docker/docs.git
synced 2026-11-04 10:01:00 +00:00
David Karlsson
1773367159
Vendor the checked-in CLI YAML from Docker Sandboxes release/v0.51 at 7d55286de0c7. This updates command help, adds `sbx policy check http`, and replaces seven agent-specific create pages with redirects to `sbx create`. Validation: full site build with Hugo 0.169.0; upstream byte-for-byte comparison; all 115 command pages, reference links, and seven redirects checked; template formatting and whitespace checks passed.
107 lines
4.6 KiB
YAML
107 lines
4.6 KiB
YAML
name: sbx policy allow network
|
|
synopsis: Allow network access to specified hosts
|
|
description: |-
|
|
Allow sandbox network access to the specified hosts.
|
|
|
|
RESOURCES is a comma-separated list of hostnames, domains, IP addresses, or
|
|
CIDR prefixes. Rules apply to TCP by default; use --protocol to select UDP or
|
|
both transports. Supports exact domains (example.com), wildcard subdomains
|
|
(*.example.com), multi-label wildcards (**.example.com), single-character
|
|
globs (api?.example.com), character classes (api[12].example.com,
|
|
api[!1].example.com), and optional port suffixes (example.com:443). An IPv6
|
|
address takes a port in brackets ([2001:db8::1]:443) or a CIDR prefix
|
|
(2001:db8::1/128); a bare one is refused. Use "**" to allow all hosts. A bare
|
|
"*", an escaped glob character such as "\*", and any other pattern outside
|
|
these forms are rejected rather than stored as a rule that matches nothing.
|
|
|
|
The rule applies globally to all sandboxes by default. Use --sandbox to add
|
|
the rule to policy "local" scoped to a single sandbox instead.
|
|
|
|
Without --cloud, a rule is refused, and nothing is added, when the same scope
|
|
already holds the opposite decision for the same resource on any of the same
|
|
protocols (for HTTP rules, the same methods, path, and query constraints).
|
|
Remove the existing rule with "sbx policy rm network --id RULE_ID" first, adding
|
|
--sandbox SANDBOX if the rule is sandbox-scoped. Rules in different scopes, such
|
|
as a global allow and a sandbox-scoped deny, can coexist, and the deny rule
|
|
takes precedence. Rules from your organization's policy never cause this
|
|
refusal. With --cloud, the new rule replaces the opposite rule in the same scope
|
|
instead.
|
|
|
|
Use --method to add an HTTP rule. --method accepts comma-separated HTTP
|
|
methods or ANY; --path defaults to /**. Repeat --query name=value to require
|
|
query parameters.
|
|
|
|
With --cloud:
|
|
Allow cloud sandbox network access to the specified hosts.
|
|
|
|
A matching deny entry in the same scope is replaced by the allow entry.
|
|
|
|
RESOURCES is a comma-separated list of network patterns, such as api.example.com,
|
|
*.example.com, 10.0.0.0/8, or api.example.com:443. HTTP method, path, query, and
|
|
transport protocol selectors are not supported.
|
|
|
|
Rules apply to the account by default. Use --sandbox with a sandbox name or ID
|
|
to change one sandbox's policy. Use "sbx --cloud policy ls" to list the rules.
|
|
usage: sbx policy allow network [--sandbox SANDBOX] RESOURCES [flags]
|
|
options:
|
|
- name: help
|
|
shorthand: h
|
|
default_value: "false"
|
|
usage: help for network
|
|
- name: method
|
|
default_value: '[]'
|
|
usage: |
|
|
Restrict the rule to these HTTP methods (comma-separated); use ANY to match all methods
|
|
- name: path
|
|
usage: |
|
|
Restrict the rule to this HTTP path glob (e.g. /repos/**); defaults to /**
|
|
- name: protocol
|
|
usage: |
|
|
Network protocol: tcp or udp; repeat or comma-separate for both
|
|
- name: query
|
|
default_value: '[]'
|
|
usage: |
|
|
Require an HTTP query parameter (name=value pattern); repeatable
|
|
- name: sandbox
|
|
usage: |
|
|
Scope the rule to a specific sandbox (default: all sandboxes)
|
|
inherited_options:
|
|
- name: cloud
|
|
default_value: "false"
|
|
usage: |
|
|
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
|
|
- name: debug
|
|
shorthand: D
|
|
default_value: "false"
|
|
usage: Enable debug logging
|
|
- name: no-input
|
|
default_value: "false"
|
|
usage: |
|
|
Never prompt; commands that need an answer fail with the command to run instead
|
|
example: |4-
|
|
# Allow access to a single host (all sandboxes)
|
|
sbx policy allow network api.example.com
|
|
|
|
# Allow access to multiple hosts
|
|
sbx policy allow network "api.example.com,cdn.example.com"
|
|
|
|
# Allow a host only for a specific sandbox
|
|
sbx policy allow network --sandbox my-sandbox api.example.com
|
|
|
|
# Allow all subdomains of a host
|
|
sbx policy allow network "*.npmjs.org"
|
|
|
|
# Allow all outbound traffic on both transports
|
|
sbx policy allow network --protocol tcp,udp "**"
|
|
|
|
# Allow GET and HEAD requests to a path
|
|
sbx policy allow network api.example.com --method GET,HEAD --path '/v1/**'
|
|
|
|
# Allow a host in the account policy
|
|
sbx --cloud policy allow network api.example.com
|
|
|
|
# Allow a host for one sandbox
|
|
sbx --cloud policy allow network --sandbox my-sandbox api.example.com
|
|
see_also:
|
|
- sbx policy allow - Add an allow rule for sandboxes
|