> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy reference

> Every field in a sandbox policy, with types, defaults, and validation rules.

This page documents every field in a sandbox policy. A policy is carried on a managed runner as the `policy` field, and because a cluster hosts at most one runner, one policy governs one cluster.

For the task-oriented walkthrough, see [Configure a sandbox policy](/products/sandboxes/profiles/configure). For worked examples, see [Policy examples](/products/sandboxes/profiles/profile-examples).

<Note>
  CoreWeave sandboxes are in public preview. For access, contact your CoreWeave account team, [CoreWeave Support](https://cloud.coreweave.com/contact), or email [support@coreweave.com](mailto:support@coreweave.com).
</Note>

## Top-level fields

| Field          | Type                | Description                                                                            |
| -------------- | ------------------- | -------------------------------------------------------------------------------------- |
| `display_name` | string              | Human-readable name for the posture this policy describes.                             |
| `base`         | object              | Runtime defaults and attachments applied before the sandbox spec. See [`base`](#base). |
| `constraints`  | `PolicyConstraints` | Typed clamps validated against the resolved spec. See [`constraints`](#constraints).   |

An empty policy is valid and declares a fully permissive posture. Both `base` and `constraints` are optional, so a cluster's posture is always stated rather than inherited by accident.

## Resolution order

A sandbox resolves in two stages:

1. **Base.** Runtime defaults, then `base`, then the sandbox spec. The sandbox wins for individual values. List attachments from `base` are always applied.
2. **Constraints.** Clamps are validated against the fully resolved spec. A violation is rejected, never silently rewritten.

Because constraints validate the resolved spec rather than the submitted one, a value that `base` supplied is checked on the same terms as a value the sandbox supplied.

## `base`

A fragment of runtime defaults and attachments. On a Kubernetes runner, this is a pod specification fragment.

`base` is where infrastructure settings live that a sandbox has no business declaring: the scheduler, node selectors, tolerations, priority class, topology spread, service accounts, image pull secrets, platform volumes, DNS configuration, and pod metadata such as pinned annotations. Security-sensitive fields are rejected outright, including `affinity`, pod and container `securityContext`, `runtimeClassName`, and `initContainers`.

## `constraints`

`PolicyConstraints` groups the typed clamps a policy enforces. Every group is optional, and an omitted group applies no restriction.

| Group       | Type                   | Governs                                          |
| ----------- | ---------------------- | ------------------------------------------------ |
| `resources` | `ResourceConstraints`  | CPU, memory, and GPU bounds and defaults.        |
| `image`     | `ImageConstraints`     | Which images a sandbox may run.                  |
| `network`   | `NetworkConstraints`   | Egress and ingress entitlements and defaults.    |
| `security`  | `SecurityConstraints`  | Privilege, capabilities, and isolation.          |
| `instance`  | `InstanceConstraints`  | Which node instance types a sandbox may land on. |
| `lifecycle` | `LifecycleConstraints` | How long a sandbox may live.                     |
| `metadata`  | `MetadataConstraints`  | Annotation keys and count.                       |
| `volumes`   | `VolumeConstraints`    | Storage media and per-volume size.               |

## `ResourceConstraints`

| Field            | Type   | Description                                                                    |
| ---------------- | ------ | ------------------------------------------------------------------------------ |
| `max_cpu`        | string | Maximum CPU a container may request, as a Kubernetes quantity.                 |
| `max_memory`     | string | Maximum memory a container may request.                                        |
| `min_cpu`        | string | Minimum CPU a container may request.                                           |
| `min_memory`     | string | Minimum memory a container may request.                                        |
| `default_cpu`    | string | CPU applied when the sandbox requests none.                                    |
| `default_memory` | string | Memory applied when the sandbox requests none.                                 |
| `max_gpu_count`  | int64  | Maximum GPUs a sandbox may request.                                            |
| `cpu_ceiling`    | string | Cap on the resolved total CPU for the sandbox.                                 |
| `memory_ceiling` | string | Cap on the resolved total memory for the sandbox.                              |
| `require_limits` | bool   | When true, rejects a sandbox that does not declare both CPU and memory limits. |

The ceilings differ from the maximums: `max_cpu` bounds one container's request, while `cpu_ceiling` bounds the resolved total, which matters when `base` contributes containers of its own.

## `ImageConstraints`

| Field                | Type        | Description                                                  |
| -------------------- | ----------- | ------------------------------------------------------------ |
| `allowed_registries` | string list | Registries a sandbox image may come from. Empty permits any. |
| `allowed_images`     | string list | Exact images a sandbox may run. Empty permits any.           |

## `NetworkConstraints`

Network constraints work as an envelope. A sandbox declares the access it needs, and the policy decides whether the request fits. The policy never adds access a sandbox did not request.

| Field             | Type               | Description                                                                                                                                |
| ----------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
| `allowed_egress`  | `EgressRule` list  | Entitlement envelope, validated at create. When non-empty, every declared rule must fit inside it. Empty permits anything declarable.      |
| `default_egress`  | `EgressRule` list  | Applied when the sandbox declares no egress. Displaced entirely by any declaration.                                                        |
| `allowed_ingress` | `IngressRule` list | Entitlement envelope for inbound access to exposed ports. Not enforced yet.                                                                |
| `default_ingress` | `IngressRule` list | Applied when the sandbox declares no ingress. Not enforced yet.                                                                            |
| `deny_dns`        | bool               | When true, forbids carving egress by DNS name. Does not affect name resolution. Has no practical effect while DNS-name rules are rejected. |

Containment is checked by type. A declared CIDR must fit an allowed CIDR, a declared tenant scope must appear as an allowed scope, and declaring `any` requires an `any` entitlement.

### `EgressRule`

Each rule names exactly one destination, optionally narrowed by port.

| Field      | Type             | Description                                                                                                |
| ---------- | ---------------- | ---------------------------------------------------------------------------------------------------------- |
| `cidr`     | `CidrBlock`      | An address range, with optional carve-outs.                                                                |
| `dns_name` | string           | A DNS name, exact or with a single leftmost wildcard label. A sandbox that declares one is rejected today. |
| `tenant`   | `TenantScope`    | Other sandboxes, selected by relationship.                                                                 |
| `any`      | bool             | Any destination.                                                                                           |
| `selector` | `SelectorBlock`  | Workloads selected by label.                                                                               |
| `ports`    | `PortRange` list | Ports the rule applies to. Omit for all ports.                                                             |

<Warning>
  DNS-name egress is not enforced yet. A sandbox that declares a `dns_name` destination is rejected. Grant access by address range instead.

  A policy's `default_egress` may carry DNS names, because its validity is established when the policy is loaded rather than per request, and enforcement requires a runner whose network layer can match names.
</Warning>

### `IngressRule`

| Field    | Type             | Description                                 |
| -------- | ---------------- | ------------------------------------------- |
| `cidr`   | `CidrBlock`      | An address range, with optional carve-outs. |
| `tenant` | `TenantScope`    | Other sandboxes, selected by relationship.  |
| `any`    | bool             | Any source.                                 |
| `ports`  | `PortRange` list | Ports the rule applies to.                  |

Ingress rules never name a source, because inbound packets carry no name.

### `CidrBlock`

| Field    | Type        | Description                                                         |
| -------- | ----------- | ------------------------------------------------------------------- |
| `cidr`   | string      | Required. The address range, such as `10.0.0.0/8`.                  |
| `except` | string list | Ranges carved out of `cidr`. A carve-out narrows only its own rule. |

### `PortRange`

| Field      | Type   | Description                                  |
| ---------- | ------ | -------------------------------------------- |
| `protocol` | string | Optional. Defaults to TCP.                   |
| `port`     | int32  | Required. The port, or the start of a range. |
| `end_port` | int32  | Optional. The end of a range.                |

### `TenantScope`

| Value                          | Selects                                                                                        |
| ------------------------------ | ---------------------------------------------------------------------------------------------- |
| `TENANT_SCOPE_SAME_USER`       | Sandboxes owned by the same user.                                                              |
| `TENANT_SCOPE_SAME_ORG`        | Sandboxes in the same organization.                                                            |
| `TENANT_SCOPE_SANDBOX_NETWORK` | Sandboxes on the same sandbox network. Not supported yet; an egress rule using it is rejected. |

### `SelectorBlock`

| Field              | Type       | Description                                            |
| ------------------ | ---------- | ------------------------------------------------------ |
| `pod_labels`       | string map | Required. Labels matched on the destination pod.       |
| `namespace_labels` | string map | Optional. Labels matched on the destination namespace. |

Matching is by exact label pairs. A selector entitlement is required for a declared selector: an `any` entitlement covers address-shaped destinations but never selectors, so an open egress policy does not silently grant label-based selection of co-located workloads.

## `SecurityConstraints`

| Field                       | Type        | Description                                                                         |
| --------------------------- | ----------- | ----------------------------------------------------------------------------------- |
| `allow_privileged`          | bool        | Whether a container may run privileged.                                             |
| `allowed_capabilities`      | string list | Linux capabilities a container may add.                                             |
| `allowed_seccomp_profiles`  | string list | Permitted seccomp profiles, such as `RuntimeDefault` or `Unconfined`.               |
| `allow_host_network`        | bool        | Whether a sandbox may use the host network namespace. Deprecated and being removed. |
| `allow_host_pid`            | bool        | Whether a sandbox may use the host PID namespace. Deprecated and being removed.     |
| `allowed_runtime_classes`   | string list | Runtime classes a sandbox may pin. Fails closed: empty permits no pin at all.       |
| `default_cpu_runtime_class` | string      | Runtime class applied to a CPU sandbox that pins none.                              |
| `default_gpu_runtime_class` | string      | Runtime class applied to a GPU sandbox that pins none.                              |

`allowed_runtime_classes` is the one list where empty means "nothing," not "anything." A sandbox can only select a runtime class you name explicitly.

Host-reaching settings are policy-only and never appear on a sandbox spec, whatever the isolation in use.

## `InstanceConstraints`

| Field                    | Type        | Description                                                   |
| ------------------------ | ----------- | ------------------------------------------------------------- |
| `allowed_instance_types` | string list | Node instance types a sandbox may land on. Empty permits any. |

## `LifecycleConstraints`

| Field                      | Type  | Description                                      |
| -------------------------- | ----- | ------------------------------------------------ |
| `default_lifetime_seconds` | int32 | Lifetime applied when the sandbox requests none. |

The policy carries no lifetime cap. The platform maximum, currently 30 days, bounds every sandbox: a create request above it is rejected. The `max_lifetime_seconds` field was removed from the policy document, and `cwic` rejects a policy that still carries it.

## `MetadataConstraints`

| Field                        | Type        | Description                                                |
| ---------------------------- | ----------- | ---------------------------------------------------------- |
| `denied_annotation_prefixes` | string list | Annotation key prefixes that are rejected.                 |
| `max_annotation_count`       | int32       | Maximum annotations a sandbox may set. `0` means no limit. |

## `VolumeConstraints`

| Field           | Type                 | Description                                 |
| --------------- | -------------------- | ------------------------------------------- |
| `allowed_media` | `StorageMedium` list | Permitted storage media. Empty permits any. |
| `max_size`      | string               | Maximum size per volume, such as `100Gi`.   |

### `StorageMedium`

| Value                        | Description                                          |
| ---------------------------- | ---------------------------------------------------- |
| `STORAGE_MEDIUM_UNSPECIFIED` | Platform default, which is disk-backed.              |
| `STORAGE_MEDIUM_DISK`        | Disk-backed.                                         |
| `STORAGE_MEDIUM_MEMORY`      | RAM-backed, counting against the container's memory. |

Omit `STORAGE_MEDIUM_MEMORY` from `allowed_media` to forbid RAM-backed volumes.

## Validation rules

A policy is rejected when any of the following hold:

* The encoded document exceeds 256 KiB.
* The policy is null. A configured policy cannot be cleared, only replaced.
* `default_egress` carries DNS names on a runner that cannot enforce them.

## See also

* [Configure a sandbox policy](/products/sandboxes/profiles/configure): the task-oriented walkthrough for every group on this page.
* [Policy examples](/products/sandboxes/profiles/profile-examples): five complete policies for common cluster postures.
* [Policies overview](/products/sandboxes/profiles/profiles): how a sandbox resolves against a policy.
* [Deploy and manage a runner](/products/sandboxes/operations/managed-runners): where the policy lives and how to set it.