Policy reference - CoreWeave Docs

This page documents every field in a sandbox policy. A policy is carried on a managed runner as the policy field, and because a cluster hosts at most one runner, one policy governs one cluster. For the task-oriented walkthrough, see Configure a sandbox policy. For worked examples, see Policy examples.

CoreWeave Serverless sandboxes are in public preview.

Top-level fields

Field	Type	Description
`display_name`	string	Human-readable name for the posture this policy describes.
`base`	object	Runtime defaults and attachments applied before the sandbox spec. See `base`.
`constraints`	`PolicyConstraints`	Typed clamps validated against the resolved spec. See `constraints`.

An empty policy is valid and declares a fully permissive posture. Both base and constraints are optional, so a cluster’s posture is always stated rather than inherited by accident.

Resolution order

A sandbox resolves in two stages:

Base. Runtime defaults, then base, then the sandbox spec. The sandbox wins for individual values. List attachments from base are always applied.
Constraints. Clamps are validated against the fully resolved spec. A violation is rejected, never silently rewritten.

Because constraints validate the resolved spec rather than the submitted one, a value that base supplied is checked on the same terms as a value the sandbox supplied.

`base`

A fragment of runtime defaults and attachments. On a Kubernetes runner, this is a pod specification fragment. base is where infrastructure settings live that a sandbox has no business declaring: the scheduler, node selectors, tolerations, priority class, topology spread, service accounts, image pull secrets, platform volumes, DNS configuration, and pod metadata such as pinned annotations. Security-sensitive fields are rejected outright, including affinity, pod and container securityContext, runtimeClassName, and initContainers.

`constraints`

PolicyConstraints groups the typed clamps a policy enforces. Every group is optional, and an omitted group applies no restriction.

Group	Type	Governs
`resources`	`ResourceConstraints`	CPU, memory, and GPU bounds and defaults.
`image`	`ImageConstraints`	Which images a sandbox may run.
`network`	`NetworkConstraints`	Egress and ingress allowlists and defaults.
`security`	`SecurityConstraints`	Privilege, capabilities, and isolation.
`instance`	`InstanceConstraints`	Which node instance types a sandbox may land on.
`lifecycle`	`LifecycleConstraints`	How long a sandbox may live.
`metadata`	`MetadataConstraints`	Annotation keys and count.
`volumes`	`VolumeConstraints`	Storage media and per-volume size.

`ResourceConstraints`

Field	Type	Description
`max_cpu`	string	Maximum CPU a container may request, as a Kubernetes quantity.
`max_memory`	string	Maximum memory a container may request.
`min_cpu`	string	Minimum CPU a container may request.
`min_memory`	string	Minimum memory a container may request.
`default_cpu`	string	CPU applied when the sandbox requests none.
`default_memory`	string	Memory applied when the sandbox requests none.
`max_gpu_count`	int64	Maximum GPUs a sandbox may request.
`cpu_ceiling`	string	Cap on the resolved total CPU for the sandbox.
`memory_ceiling`	string	Cap on the resolved total memory for the sandbox.
`require_limits`	bool	When true, rejects a sandbox that does not declare both CPU and memory limits.

The ceilings differ from the maximums: max_cpu bounds one container’s request, while cpu_ceiling bounds the resolved total, which matters when base contributes containers of its own.

`ImageConstraints`

Field	Type	Description
`allowed_registries`	string list	Registries a sandbox image may come from. Empty permits any.
`allowed_images`	string list	Exact images a sandbox may run. Empty permits any.

`NetworkConstraints`

Network constraints define allowlists for the access a sandbox can request. When a sandbox declares egress, the policy accepts or rejects that declaration without widening it. When the sandbox declares no egress, the policy applies default_egress, unless the sandbox sets deny_egress. Platform DNS and storage access are granted separately.

Field	Type	Description
`allowed_egress`	`EgressRule` list	Egress allowlist, checked when a sandbox is created. When non-empty, every declared rule must fit inside it. Empty permits anything declarable.
`default_egress`	`EgressRule` list	Applied when the sandbox declares no egress, unless it sets `deny_egress`. Displaced entirely by any declaration. Must fit `allowed_egress` and must not contain `https_hostname` rules.
`allowed_ingress`	`IngressRule` list	Ingress allowlist for `CUSTOM`-visibility ports, checked when a sandbox is created. When non-empty, every declared rule must fit inside it. Empty permits anything declarable.
`default_ingress`	`IngressRule` list	Applied when a sandbox exposes a `CUSTOM`-visibility port and declares no ingress, unless it sets `deny_ingress`. Displaced entirely by explicit ingress rules. Must fit `allowed_ingress`.
`deny_https_hostname_rules`	bool	When true, rejects `https_hostname` rules in `allowed_egress` and sandbox requests. Does not block DNS queries or HTTPS permitted by CIDR rules.
`dns_egress`	`DNSEgressMode`	Controls outbound DNS traffic on UDP/TCP port 53. Unspecified defaults to `DNS_EGRESS_MODE_ALLOW`. A sandbox can choose `DNS_EGRESS_MODE_DENY`, but cannot request `ALLOW` when the policy requires `DENY`.

When an allowlist is non-empty, containment is checked by destination or source type and port. A declared CIDR must fit the combined allowed CIDR ranges or an any rule. A declared tenant scope requires a matching tenant rule or an any rule, while declaring any requires an any rule.

`EgressRule`

Each rule names exactly one destination, optionally narrowed by port.

Field	Type	Description
`cidr`	`CidrBlock`	An address range, with optional carve-outs.
`https_hostname`	string	An HTTPS hostname, exact or with a single leftmost wildcard label, such as `.example.com`. Requires a runner that supports hostname-based HTTPS rules. In `allowed_egress`, `` permits any hostname declaration.
`https_hostname_except`	string list	Hostnames excluded from this rule. Valid only with `https_hostname` in `allowed_egress`. Uses the same hostname patterns, except `*`.
`tenant`	`TenantScope`	Other sandboxes, selected by relationship.
`any`	bool	All reachable destinations except platform-internal ranges. Use tenant or selector rules to reach other sandboxes or cluster workloads.
`selector`	`SelectorBlock`	Workloads selected by label.
`ports`	`PortRange` list	Ports the rule applies to. Omit for all ports, except for `https_hostname` rules, which permit only TCP 443.

Hostname rules authorize HTTPS access, not DNS queries. When allowed_egress is non-empty, a declared hostname must fit an allowed hostname pattern, after its exclusions, or an any rule. A CIDR-only allowlist does not permit hostname declarations. Put reusable hostname grants in a sandbox template, not in default_egress. dns_egress controls outbound UDP/TCP port 53 independently. DNS_EGRESS_MODE_ALLOW permits access to the platform resolver; other resolvers require an egress rule. DNS_EGRESS_MODE_DENY blocks outbound port 53 even when another rule permits it. It does not block locally answered lookups or DNS over other permitted transports, such as HTTPS.

`IngressRule`

Field	Type	Description
`cidr`	`CidrBlock`	An address range, with optional carve-outs.
`tenant`	`TenantScope`	Other sandboxes, selected by relationship.
`any`	bool	Any source.
`ports`	`PortRange` list	Ports the rule applies to. Omit for all `CUSTOM`-visibility ports.

Ingress rules never name a source, because inbound packets carry no name.

`CidrBlock`

Field	Type	Description
`cidr`	string	Required. The address range, such as `10.0.0.0/8`.
`except`	string list	Ranges carved out of `cidr`. A carve-out narrows only its own rule.

`PortRange`

Field	Type	Description
`protocol`	string	Optional. Defaults to TCP.
`port`	int32	Required. The port, or the start of a range.
`end_port`	int32	Optional. The end of a range.

`TenantScope`

Value	Selects
`TENANT_SCOPE_SAME_USER`	Sandboxes owned by the same user.
`TENANT_SCOPE_SAME_ORG`	Sandboxes in the same organization.
`TENANT_SCOPE_SANDBOX_NETWORK`	Sandboxes on the same sandbox network. Not supported yet; an egress rule using it is rejected.

`SelectorBlock`

Field	Type	Description
`pod_labels`	string map	Required. Labels matched on the destination pod.
`namespace_labels`	string map	Optional. Labels matched on the destination namespace.

Matching uses exact label pairs, but declarations may add labels. When the egress allowlist is non-empty, a declared selector must carry every label pair in a matching selector rule. Both selectors must omit namespace labels, or both must include them, with the declaration carrying every required namespace label pair. An any rule never covers selectors, but an empty allowlist permits selector declarations.

`SecurityConstraints`

Field	Type	Description
`allow_privileged`	bool	Whether a container may run privileged.
`allowed_capabilities`	string list	Linux capabilities a container may add.
`allowed_seccomp_profiles`	string list	Permitted seccomp profiles, such as `RuntimeDefault` or `Unconfined`.
`allow_host_network`	bool	Whether a sandbox may use the host network namespace. Deprecated and being removed.
`allow_host_pid`	bool	Whether a sandbox may use the host PID namespace. Deprecated and being removed.
`allowed_runtime_classes`	string list	Runtime classes a sandbox may pin. Fails closed: empty permits no pin at all.
`default_cpu_runtime_class`	string	Runtime class applied to a CPU sandbox that pins none.
`default_gpu_runtime_class`	string	Runtime class applied to a GPU sandbox that pins none.

allowed_runtime_classes is the one list where empty means “nothing,” not “anything.” A sandbox can only select a runtime class you name explicitly. Host-reaching settings are policy-only and never appear on a sandbox spec, whatever the isolation in use.

`InstanceConstraints`

Field	Type	Description
`allowed_instance_types`	string list	Node instance types a sandbox may land on. Empty permits any.

`LifecycleConstraints`

Field	Type	Description
`default_lifetime_seconds`	int32	Lifetime applied when the sandbox requests none.

The policy carries no lifetime cap. The platform maximum, currently 30 days, bounds every sandbox: a create request above it is rejected. The max_lifetime_seconds field was removed from the policy document, and cwic rejects a policy that still carries it.

`MetadataConstraints`

Field	Type	Description
`denied_annotation_prefixes`	string list	Annotation key prefixes that are rejected.
`max_annotation_count`	int32	Maximum annotations a sandbox may set. `0` means no limit.

`VolumeConstraints`

Field	Type	Description
`allowed_media`	`StorageMedium` list	Permitted storage media. Empty permits any.
`max_size`	string	Maximum size per volume, such as `100Gi`.

`StorageMedium`

Value	Description
`STORAGE_MEDIUM_UNSPECIFIED`	Platform default, which is disk-backed.
`STORAGE_MEDIUM_DISK`	Disk-backed.
`STORAGE_MEDIUM_MEMORY`	RAM-backed, counting against the container’s memory.

Omit STORAGE_MEDIUM_MEMORY from allowed_media to forbid RAM-backed volumes.

Validation rules

A policy is rejected when any of the following hold:

The encoded document exceeds 256 KiB.
The policy is null. A configured policy cannot be cleared, only replaced.
default_egress contains https_hostname rules.
Default egress or ingress rules fall outside the corresponding allowlist.

​Top-level fields

​Resolution order

​base

​constraints

​ResourceConstraints

​ImageConstraints

​NetworkConstraints

​EgressRule

​IngressRule

​CidrBlock

​PortRange

​TenantScope

​SelectorBlock

​SecurityConstraints

​InstanceConstraints

​LifecycleConstraints

​MetadataConstraints

​VolumeConstraints

​StorageMedium

​Validation rules

​See also

Top-level fields

Resolution order

`base`

`constraints`

`ResourceConstraints`

`ImageConstraints`

`NetworkConstraints`

`EgressRule`

`IngressRule`

`CidrBlock`

`PortRange`

`TenantScope`

`SelectorBlock`

`SecurityConstraints`

`InstanceConstraints`

`LifecycleConstraints`

`MetadataConstraints`

`VolumeConstraints`

`StorageMedium`

Validation rules

See also