Policy reference - CoreWeave Docs

This page documents every field in a sandbox policy. A policy is carried on a managed runner as the policy field, and because a cluster hosts at most one runner, one policy governs one cluster. For the task-oriented walkthrough, see Configure a sandbox policy. For worked examples, see Policy examples.

CoreWeave sandboxes are in public preview. For access, contact your CoreWeave account team, CoreWeave Support, or email support@coreweave.com.

Top-level fields

Field	Type	Description
`display_name`	string	Human-readable name for the posture this policy describes.
`base`	object	Runtime defaults and attachments applied before the sandbox spec. See `base`.
`constraints`	`PolicyConstraints`	Typed clamps validated against the resolved spec. See `constraints`.

An empty policy is valid and declares a fully permissive posture. Both base and constraints are optional, so a cluster’s posture is always stated rather than inherited by accident.

Resolution order

A sandbox resolves in two stages:

Base. Runtime defaults, then base, then the sandbox spec. The sandbox wins for individual values. List attachments from base are always applied.
Constraints. Clamps are validated against the fully resolved spec. A violation is rejected, never silently rewritten, with one exception: max_lifetime_seconds is clamped to the policy maximum and the applied value echoed.

Because constraints validate the resolved spec rather than the submitted one, a value that base supplied is checked on the same terms as a value the sandbox supplied.

`base`

A fragment of runtime defaults and attachments. On a Kubernetes runner, this is a pod specification fragment. base is where infrastructure settings live that a sandbox has no business declaring: the scheduler, node selectors, tolerations, affinity, priority class, topology spread, service accounts, image pull secrets, platform volumes, DNS configuration, and pod metadata such as pinned annotations.

base is not applied today. The policy engine passes it through untouched, and enforcement is left to the runtime, so a base fragment you set on a runner has no effect on the sandboxes it places. Do not rely on it to enforce infrastructure settings. To pin a scheduler, selectors, or tolerations today, use a profile template on the v1beta2 surface.

`constraints`

PolicyConstraints groups the typed clamps a policy enforces. Every group is optional, and an omitted group applies no restriction.

Group	Type	Governs
`resources`	`ResourceConstraints`	CPU, memory, and GPU bounds and defaults.
`image`	`ImageConstraints`	Which images a sandbox may run.
`network`	`NetworkConstraints`	Egress and ingress entitlements and defaults.
`security`	`SecurityConstraints`	Privilege, capabilities, and isolation.
`instance`	`InstanceConstraints`	Which node instance types a sandbox may land on.
`lifecycle`	`LifecycleConstraints`	How long a sandbox may live.
`metadata`	`MetadataConstraints`	Annotation keys and count.
`volumes`	`VolumeConstraints`	Storage media and per-volume size.

`ResourceConstraints`

Field	Type	Description
`max_cpu`	string	Maximum CPU a container may request, as a Kubernetes quantity.
`max_memory`	string	Maximum memory a container may request.
`min_cpu`	string	Minimum CPU a container may request.
`min_memory`	string	Minimum memory a container may request.
`default_cpu`	string	CPU applied when the sandbox requests none.
`default_memory`	string	Memory applied when the sandbox requests none.
`max_gpu_count`	int64	Maximum GPUs a sandbox may request.
`cpu_ceiling`	string	Cap on the resolved total CPU for the sandbox.
`memory_ceiling`	string	Cap on the resolved total memory for the sandbox.
`require_limits`	bool	When true, rejects a sandbox that does not declare both CPU and memory limits.

The ceilings differ from the maximums: max_cpu bounds one container’s request, while cpu_ceiling bounds the resolved total, which matters when base contributes containers of its own.

`ImageConstraints`

Field	Type	Description
`allowed_registries`	string list	Registries a sandbox image may come from. Empty permits any.
`allowed_images`	string list	Exact images a sandbox may run. Empty permits any.

`NetworkConstraints`

Network constraints work as an envelope. A sandbox declares the access it needs, and the policy decides whether the request fits. The policy never adds access a sandbox did not request.

Field	Type	Description
`allowed_egress`	`EgressRule` list	Entitlement envelope, validated at create. When non-empty, every declared rule must fit inside it. Empty permits anything declarable.
`default_egress`	`EgressRule` list	Applied when the sandbox declares no egress. Displaced entirely by any declaration.
`allowed_ingress`	`IngressRule` list	Entitlement envelope for inbound access to exposed ports. Not enforced yet.
`default_ingress`	`IngressRule` list	Applied when the sandbox declares no ingress. Not enforced yet.
`deny_dns`	bool	When true, forbids carving egress by DNS name. Does not affect name resolution. Has no practical effect while DNS-name rules are rejected.

Containment is checked by type. A declared CIDR must fit an allowed CIDR, a declared tenant scope must appear as an allowed scope, and declaring any requires an any entitlement.

`EgressRule`

Each rule names exactly one destination, optionally narrowed by port.

Field	Type	Description
`cidr`	`CidrBlock`	An address range, with optional carve-outs.
`dns_name`	string	A DNS name, exact or with a single leftmost wildcard label. A sandbox that declares one is rejected today.
`tenant`	`TenantScope`	Other sandboxes, selected by relationship.
`any`	bool	Any destination.
`selector`	`SelectorBlock`	Workloads selected by label.
`ports`	`PortRange` list	Ports the rule applies to. Omit for all ports.

DNS-name egress is not enforced yet. A sandbox that declares a dns_name destination is rejected. Grant access by address range instead.A policy’s default_egress may carry DNS names, because its validity is established when the policy is loaded rather than per request, and enforcement requires a runner whose network layer can match names.

`IngressRule`

Field	Type	Description
`cidr`	`CidrBlock`	An address range, with optional carve-outs.
`tenant`	`TenantScope`	Other sandboxes, selected by relationship.
`any`	bool	Any source.
`ports`	`PortRange` list	Ports the rule applies to.

Ingress rules never name a source, because inbound packets carry no name.

`CidrBlock`

Field	Type	Description
`cidr`	string	Required. The address range, such as `10.0.0.0/8`.
`except`	string list	Ranges carved out of `cidr`. A carve-out narrows only its own rule.

`PortRange`

Field	Type	Description
`protocol`	string	Optional. Defaults to TCP.
`port`	int32	Required. The port, or the start of a range.
`end_port`	int32	Optional. The end of a range.

`TenantScope`

Value	Selects
`TENANT_SCOPE_SAME_USER`	Sandboxes owned by the same user.
`TENANT_SCOPE_SAME_ORG`	Sandboxes in the same organization.
`TENANT_SCOPE_SANDBOX_NETWORK`	Sandboxes on the same sandbox network. Not supported yet; an egress rule using it is rejected.

`SelectorBlock`

Field	Type	Description
`pod_labels`	string map	Required. Labels matched on the destination pod.
`namespace_labels`	string map	Optional. Labels matched on the destination namespace.

Matching is by exact label pairs. A selector entitlement is required for a declared selector: an any entitlement covers address-shaped destinations but never selectors, so an open egress policy does not silently grant label-based selection of co-located workloads.

`SecurityConstraints`

Field	Type	Description
`allow_privileged`	bool	Whether a container may run privileged.
`allowed_capabilities`	string list	Linux capabilities a container may add.
`allowed_seccomp_profiles`	string list	Permitted seccomp profiles, such as `RuntimeDefault` or `Unconfined`.
`allow_host_network`	bool	Whether a sandbox may use the host network namespace. Deprecated and being removed.
`allow_host_pid`	bool	Whether a sandbox may use the host PID namespace. Deprecated and being removed.
`allowed_runtime_classes`	string list	Runtime classes a sandbox may pin. Fails closed: empty permits no pin at all.
`default_cpu_runtime_class`	string	Runtime class applied to a CPU sandbox that pins none.
`default_gpu_runtime_class`	string	Runtime class applied to a GPU sandbox that pins none.

allowed_runtime_classes is the one list where empty means “nothing,” not “anything.” A sandbox can only select a runtime class you name explicitly. Host-reaching settings are policy-only and never appear on a sandbox spec, whatever the isolation in use.

`InstanceConstraints`

Field	Type	Description
`allowed_instance_types`	string list	Node instance types a sandbox may land on. Empty permits any.

`LifecycleConstraints`

Field	Type	Description
`max_lifetime_seconds`	int32	Maximum sandbox lifetime. Required, and must be greater than zero. A sandbox requesting more is clamped to this value, not rejected.
`default_lifetime_seconds`	int32	Lifetime applied when the sandbox requests none.

A policy without a lifetime bound is rejected. Lifetime is the one field the policy clamps. A sandbox that requests more than max_lifetime_seconds receives the maximum, and the applied value is echoed on the result. Every other constraint rejects a violation instead of narrowing it.

`MetadataConstraints`

Field	Type	Description
`denied_annotation_prefixes`	string list	Annotation key prefixes that are rejected.
`max_annotation_count`	int32	Maximum annotations a sandbox may set. `0` means no limit.

`VolumeConstraints`

Field	Type	Description
`allowed_media`	`StorageMedium` list	Permitted storage media. Empty permits any.
`max_size`	string	Maximum size per volume, such as `100Gi`.

`StorageMedium`

Value	Description
`STORAGE_MEDIUM_UNSPECIFIED`	Platform default, which is disk-backed.
`STORAGE_MEDIUM_DISK`	Disk-backed.
`STORAGE_MEDIUM_MEMORY`	RAM-backed, counting against the container’s memory.

Omit STORAGE_MEDIUM_MEMORY from allowed_media to forbid RAM-backed volumes.

Validation rules

A policy is rejected when any of the following hold:

constraints.lifecycle.max_lifetime_seconds is absent or not greater than zero.
The encoded document exceeds 256 KiB.
The policy is null. A configured policy cannot be cleared, only replaced.
default_egress carries DNS names on a runner that cannot enforce them.

​Top-level fields

​Resolution order

​base

​constraints

​ResourceConstraints

​ImageConstraints

​NetworkConstraints

​EgressRule

​IngressRule

​CidrBlock

​PortRange

​TenantScope

​SelectorBlock

​SecurityConstraints

​InstanceConstraints

​LifecycleConstraints

​MetadataConstraints

​VolumeConstraints

​StorageMedium

​Validation rules

​See also

Top-level fields

Resolution order

`base`

`constraints`

`ResourceConstraints`

`ImageConstraints`

`NetworkConstraints`

`EgressRule`

`IngressRule`

`CidrBlock`

`PortRange`

`TenantScope`

`SelectorBlock`

`SecurityConstraints`

`InstanceConstraints`

`LifecycleConstraints`

`MetadataConstraints`

`VolumeConstraints`

`StorageMedium`

Validation rules

See also