Runtime configuration controls where the sandbox runs and which external hosts it can reach.

​
Region

Pin a deployment to a supported region: 
runtimeConfig:
  sandboxRegion: eu
Supported values are: 
us
eu
When omitted, the deployment inherits the workspace default captured when the deployment is created. The run Details view shows the resulting region and platform-selected machine specification.

​
Restricted egress

runtimeConfig:
  egressPolicyMode: restricted
  egressAllowlist:
    - api.openai.com
    - '*.githubusercontent.com'
Allowlist values:
  • contain a hostname or supported wildcard;
  • do not include https://;
  • do not include a path;
  • do not include a port.

​
Full-open egress

runtimeConfig:
  egressPolicyMode: full-open
Use full-open egress only when the integration cannot operate with a bounded host list. Restricted mode is easier to review and safer for sandbox-exposed credentials.

​
Managed proxy behavior

Managed sandbox HTTPS traffic uses the platform proxy and certificate authority. Salambo separately manages the service destinations required to operate the run; builders do not add or edit those destinations. Customer allowlists describe customer-required destinations. They do not replace platform networking policy. See sandbox security architecture for TLS inspection, sealed-secret substitution, and fail-closed destination checks.