Network Policies for Blueprints

Start with the Runloop Quickstart to use the examples below.

Network Policies can be applied to Blueprints in two ways:

Build-time policy: Restricts network access during the blueprint build process
Runtime policy: Applies to all Devboxes created from the blueprint

Build-time Network Policy

Apply a network policy during the blueprint build to restrict what the build process can access. This is useful when your build commands need to download packages from specific registries.

# Create a build-time network policy
build_policy = await runloop.network_policies.create(
    name="build-policy",
    allow_all=False,
    allowed_hostnames=["github.com", "*.npmjs.org", "pypi.org"]
)

# Apply the policy during blueprint build
blueprint = await runloop.blueprint.create(
    name="secure-build-blueprint",
    network_policy_id=build_policy.id,  # Applies during build
    launch_parameters={
        "launch_commands": ["npm install"]
    }
)

// Create a build-time network policy
const buildPolicy = await runloop.networkPolicy.create({
    name: "build-policy",
    allow_all: false,
    allowed_hostnames: ["github.com", "*.npmjs.org", "pypi.org"]
});

// Apply the policy during blueprint build
const blueprint = await runloop.blueprint.create({
    name: "secure-build-blueprint",
    network_policy_id: buildPolicy.id,  // Applies during build
    launch_parameters: {
        launch_commands: ["npm install"]
    }
});

The build-time network_policy_id only affects the build process. It does not affect Devboxes created from the blueprint.

Runtime Network Policy for Devboxes

To apply a network policy to all Devboxes created from the blueprint, set network_policy_id in launch_parameters:

# Create a runtime network policy
runtime_policy = await runloop.network_policies.create(
    name="runtime-policy",
    allow_all=False,
    allowed_hostnames=["github.com", "api.openai.com"]
)

# Apply the policy to devboxes created from this blueprint
blueprint = await runloop.blueprint.create(
    name="secure-agent-blueprint",
    launch_parameters={
        "network_policy_id": runtime_policy.id,  # Applies to devboxes
        "launch_commands": ["npm install"]
    }
)

# Devboxes created from this blueprint inherit the runtime policy
devbox = await blueprint.create_devbox()

// Create a runtime network policy
const runtimePolicy = await runloop.networkPolicy.create({
    name: "runtime-policy",
    allow_all: false,
    allowed_hostnames: ["github.com", "api.openai.com"]
});

// Apply the policy to devboxes created from this blueprint
const blueprint = await runloop.blueprint.create({
    name: "secure-agent-blueprint",
    launch_parameters: {
        network_policy_id: runtimePolicy.id,  // Applies to devboxes
        launch_commands: ["npm install"]
    }
});

// Devboxes created from this blueprint inherit the runtime policy
const devbox = await blueprint.createDevbox();

Using Both Build and Runtime Policies

You can use different policies for build and runtime:

# Build policy: allow package registries
build_policy = await runloop.network_policies.create(
    name="build-policy",
    allow_all=False,
    allowed_hostnames=["*.npmjs.org", "pypi.org", "github.com"]
)

# Runtime policy: more restrictive for production
runtime_policy = await runloop.network_policies.create(
    name="runtime-policy",
    allow_all=False,
    allowed_hostnames=["api.openai.com"]
)

blueprint = await runloop.blueprint.create(
    name="dual-policy-blueprint",
    network_policy_id=build_policy.id,  # Build-time
    launch_parameters={
        "network_policy_id": runtime_policy.id,  # Runtime
        "launch_commands": ["npm install"]
    }
)

// Build policy: allow package registries
const buildPolicy = await runloop.networkPolicy.create({
    name: "build-policy",
    allow_all: false,
    allowed_hostnames: ["*.npmjs.org", "pypi.org", "github.com"]
});

// Runtime policy: more restrictive for production
const runtimePolicy = await runloop.networkPolicy.create({
    name: "runtime-policy",
    allow_all: false,
    allowed_hostnames: ["api.openai.com"]
});

const blueprint = await runloop.blueprint.create({
    name: "dual-policy-blueprint",
    network_policy_id: buildPolicy.id,  // Build-time
    launch_parameters: {
        network_policy_id: runtimePolicy.id,  // Runtime
        launch_commands: ["npm install"]
    }
});

Devboxes can override the Blueprint’s runtime network policy by specifying a different network_policy_id at creation time.

Next Steps

Manage blueprint lifecycle - Delete blueprints and configure launch parameters
Learn more about Network Policies - Full documentation on network policy configuration
Troubleshoot blueprint builds - Debug failed builds

Overview

Tools

Components

Benchmarks & Evals

Debugging

Network Policies for Blueprints

Build-time Network Policy

Runtime Network Policy for Devboxes

Using Both Build and Runtime Policies

Next Steps

​Build-time Network Policy

​Runtime Network Policy for Devboxes

​Using Both Build and Runtime Policies

​Next Steps

Build-time Network Policy

Runtime Network Policy for Devboxes

Using Both Build and Runtime Policies

Next Steps