mirror of
https://github.com/docker/docs.git
synced 2026-11-04 10:01:00 +00:00
David Karlsson
1773367159
Vendor the checked-in CLI YAML from Docker Sandboxes release/v0.51 at 7d55286de0c7. This updates command help, adds `sbx policy check http`, and replaces seven agent-specific create pages with redirects to `sbx create`. Validation: full site build with Hugo 0.169.0; upstream byte-for-byte comparison; all 115 command pages, reference links, and seven redirects checked; template formatting and whitespace checks passed.
104 lines
4.3 KiB
YAML
104 lines
4.3 KiB
YAML
name: sbx policy deny network
|
|
synopsis: Deny network access to specified hosts
|
|
description: |-
|
|
Block sandbox network access to the specified hosts.
|
|
|
|
RESOURCES takes the same forms as "sbx policy allow network": exact domains,
|
|
wildcard subdomains, IP addresses, and CIDR prefixes, with optional port
|
|
suffixes. Rules apply to TCP and UDP by default; use --protocol to restrict a
|
|
rule to one transport.
|
|
|
|
Deny rules take precedence over allow rules for the same hostname or CIDR. A
|
|
direct connection to an allowed hostname is also checked against CIDR rules for
|
|
its resolved IP address, and a deny on either takes precedence. Connections
|
|
through an upstream proxy that resolves the hostname are checked by hostname
|
|
only.
|
|
|
|
The rule applies globally to all sandboxes by default. Use --sandbox to add
|
|
the rule to policy "local" scoped to a single sandbox instead.
|
|
|
|
Without --cloud, a rule is refused, and nothing is added, when the same scope
|
|
already holds the opposite decision for the same resource on any of the same
|
|
protocols (for HTTP rules, the same methods, path, and query constraints).
|
|
Remove the existing rule with "sbx policy rm network --id RULE_ID" first, adding
|
|
--sandbox SANDBOX if the rule is sandbox-scoped. Rules in different scopes, such
|
|
as a global allow and a sandbox-scoped deny, can coexist, and the deny rule
|
|
takes precedence. Rules from your organization's policy never cause this
|
|
refusal. With --cloud, the new rule replaces the opposite rule in the same scope
|
|
instead.
|
|
|
|
Use --method to add an HTTP rule. --method accepts comma-separated HTTP
|
|
methods or ANY; --path defaults to /**. Repeat --query name=value to require
|
|
query parameters.
|
|
|
|
With --cloud:
|
|
Block cloud sandbox network access to the specified hosts.
|
|
|
|
A matching allow entry in the same scope is replaced by the deny entry.
|
|
|
|
RESOURCES is a comma-separated list of network patterns, such as api.example.com,
|
|
*.example.com, 10.0.0.0/8, or api.example.com:443. HTTP method, path, query, and
|
|
transport protocol selectors are not supported.
|
|
|
|
Rules apply to the account by default. Use --sandbox with a sandbox name or ID
|
|
to change one sandbox's policy. Use "sbx --cloud policy ls" to list the rules.
|
|
usage: sbx policy deny network [--sandbox SANDBOX] RESOURCES [flags]
|
|
options:
|
|
- name: help
|
|
shorthand: h
|
|
default_value: "false"
|
|
usage: help for network
|
|
- name: method
|
|
default_value: '[]'
|
|
usage: |
|
|
Restrict the rule to these HTTP methods (comma-separated); use ANY to match all methods
|
|
- name: path
|
|
usage: |
|
|
Restrict the rule to this HTTP path glob (e.g. /repos/**); defaults to /**
|
|
- name: protocol
|
|
usage: |
|
|
Restrict the rule to one protocol: tcp or udp (default tcp,udp)
|
|
- name: query
|
|
default_value: '[]'
|
|
usage: |
|
|
Require an HTTP query parameter (name=value pattern); repeatable
|
|
- name: sandbox
|
|
usage: |
|
|
Scope the rule to a specific sandbox (default: all sandboxes)
|
|
inherited_options:
|
|
- name: cloud
|
|
default_value: "false"
|
|
usage: |
|
|
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
|
|
- name: debug
|
|
shorthand: D
|
|
default_value: "false"
|
|
usage: Enable debug logging
|
|
- name: no-input
|
|
default_value: "false"
|
|
usage: |
|
|
Never prompt; commands that need an answer fail with the command to run instead
|
|
example: |4-
|
|
# Block access to a host (all sandboxes)
|
|
sbx policy deny network ads.example.com
|
|
|
|
# Block a host only for a specific sandbox
|
|
sbx policy deny network --sandbox my-sandbox ads.example.com
|
|
|
|
# Block all outbound traffic, TCP and UDP
|
|
sbx policy deny network "**"
|
|
|
|
# Block only UDP to a host
|
|
sbx policy deny network --protocol udp media.example.com
|
|
|
|
# Block POST requests to a path
|
|
sbx policy deny network api.example.com --method POST --path '/admin/**'
|
|
|
|
# Block a host in the account policy
|
|
sbx --cloud policy deny network ads.example.com
|
|
|
|
# Block a host for one sandbox
|
|
sbx --cloud policy deny network --sandbox my-sandbox ads.example.com
|
|
see_also:
|
|
- sbx policy deny - Add a deny rule for sandboxes
|