Networking and egress

How do I expose a port from a sandbox?

Every sandbox port is reachable through a preview URL for the sandbox's lifetime — no token endpoint, no extra setup:

https://<port>-<sandbox-id>.pandastack.ai

pandastack sandbox preview-url <sandbox-id> --port 3000
# → https://3000-<sandbox-id>.pandastack.ai

The URL itself is the credential: anyone who has it can reach that port, and there is no separate token to revoke. Treat it as a secret; to cut access, stop the server on that port or delete the sandbox. See Preview URLs.

What URL does a deployed app get?

Every app gets a stable host that survives every deploy:

https://<app-id>.pandastack.ai

The app UUID in the hostname is the bearer credential. You can also bring your own domain with managed TLS — see Custom domains.

How do I connect to a managed database?

Over TLS, at the database's own hostname:

<id>.db.pandastack.ai:5432

psql "postgres://pandastack:<pw>@<id>.db.pandastack.ai:5432/pandastack?sslmode=require"

Traffic is routed to your VM by SNI on that hostname, so TLS is required — a non-TLS client cannot connect. pandastack database connection <id> returns the full connection_url (direct, port 5432) and a pooled_connection_url (port 6432). See Databases.

Do sandboxes have outbound internet access?

Yes — egress is on by default and open: agents install packages, call APIs, and clone repositories, so there is no outbound allowlist. Each VM's traffic leaves through its own network namespace and is NATed, which makes egress attributable to a specific VM and workspace. Details in Egress controls.

Is egress billed?

No. Network egress is metered (so we can see it) but not billed on any plan, inbound or outbound, within fair use. If a workspace's traffic is wildly out of line with normal agent, app, and database workloads, we will contact you rather than bill you by surprise.

Is anything blocked?

Three classes of traffic are dropped at the host firewall, before any accept rule:

1. VM-to-VM traffic — a guest cannot reach another tenant's VM on any port.
2. Cloud metadata — the link-local range is dropped, so a guest cannot reach the cloud metadata endpoint for host credentials.
3. Mining-protocol egress — outbound connections to the standard cryptocurrency-mining pool (Stratum) control ports are blocked by default. This is an abuse control; on self-hosted deployments the blocked-port list is operator-configurable.

If you believe a control is misfiring on legitimate traffic, contact support.

Why does every sandbox report the same internal IP?

By design. Snapshots bake the guest's network identity (IP, MAC, gateway), and every sandbox restored from the same template sees identical values inside its own isolated network namespace — that is what makes sub-second restores work. It never collides because each sandbox has its own namespace. See Networking internals.