> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Policies for Blueprints

> Restrict network access during blueprint builds and for Devboxes created from blueprints

<Tip>Start with the [Runloop Quickstart](/docs/tutorials/quickstart) to use the examples below.</Tip>

[Network Policies](/docs/network-policies) can be applied to Blueprints in two ways:

1. **Build-time policy**: Restricts network access during the blueprint build process
2. **Runtime policy**: Applies to all Devboxes created from the blueprint

## Build-time Network Policy

Apply a network policy during the blueprint build to restrict what the build process can access. This is useful when your build commands need to download packages from specific registries.

<CodeGroup>
  ```python Python theme={null}
  # Create a build-time network policy
  build_policy = await runloop.network_policies.create(
      name="build-policy",
      allow_all=False,
      allowed_hostnames=["github.com", "*.npmjs.org", "pypi.org"]
  )

  # Apply the policy during blueprint build
  blueprint = await runloop.blueprint.create(
      name="secure-build-blueprint",
      network_policy_id=build_policy.id,  # Applies during build
      launch_parameters={
          "launch_commands": ["npm install"]
      }
  )
  ```

  ```typescript TypeScript theme={null}
  // Create a build-time network policy
  const buildPolicy = await runloop.networkPolicy.create({
      name: "build-policy",
      allow_all: false,
      allowed_hostnames: ["github.com", "*.npmjs.org", "pypi.org"]
  });

  // Apply the policy during blueprint build
  const blueprint = await runloop.blueprint.create({
      name: "secure-build-blueprint",
      network_policy_id: buildPolicy.id,  // Applies during build
      launch_parameters: {
          launch_commands: ["npm install"]
      }
  });
  ```
</CodeGroup>

<Note>
  The build-time `network_policy_id` only affects the build process. It does **not** affect Devboxes created from the blueprint.
</Note>

## Runtime Network Policy for Devboxes

To apply a network policy to all Devboxes created from the blueprint, set `network_policy_id` in `launch_parameters`:

<CodeGroup>
  ```python Python theme={null}
  # Create a runtime network policy
  runtime_policy = await runloop.network_policies.create(
      name="runtime-policy",
      allow_all=False,
      allowed_hostnames=["github.com", "api.openai.com"]
  )

  # Apply the policy to devboxes created from this blueprint
  blueprint = await runloop.blueprint.create(
      name="secure-agent-blueprint",
      launch_parameters={
          "network_policy_id": runtime_policy.id,  # Applies to devboxes
          "launch_commands": ["npm install"]
      }
  )

  # Devboxes created from this blueprint inherit the runtime policy
  devbox = await blueprint.create_devbox()
  ```

  ```typescript TypeScript theme={null}
  // Create a runtime network policy
  const runtimePolicy = await runloop.networkPolicy.create({
      name: "runtime-policy",
      allow_all: false,
      allowed_hostnames: ["github.com", "api.openai.com"]
  });

  // Apply the policy to devboxes created from this blueprint
  const blueprint = await runloop.blueprint.create({
      name: "secure-agent-blueprint",
      launch_parameters: {
          network_policy_id: runtimePolicy.id,  // Applies to devboxes
          launch_commands: ["npm install"]
      }
  });

  // Devboxes created from this blueprint inherit the runtime policy
  const devbox = await blueprint.createDevbox();
  ```
</CodeGroup>

## Using Both Build and Runtime Policies

You can use different policies for build and runtime:

<CodeGroup>
  ```python Python theme={null}
  # Build policy: allow package registries
  build_policy = await runloop.network_policies.create(
      name="build-policy",
      allow_all=False,
      allowed_hostnames=["*.npmjs.org", "pypi.org", "github.com"]
  )

  # Runtime policy: more restrictive for production
  runtime_policy = await runloop.network_policies.create(
      name="runtime-policy",
      allow_all=False,
      allowed_hostnames=["api.openai.com"]
  )

  blueprint = await runloop.blueprint.create(
      name="dual-policy-blueprint",
      network_policy_id=build_policy.id,  # Build-time
      launch_parameters={
          "network_policy_id": runtime_policy.id,  # Runtime
          "launch_commands": ["npm install"]
      }
  )
  ```

  ```typescript TypeScript theme={null}
  // Build policy: allow package registries
  const buildPolicy = await runloop.networkPolicy.create({
      name: "build-policy",
      allow_all: false,
      allowed_hostnames: ["*.npmjs.org", "pypi.org", "github.com"]
  });

  // Runtime policy: more restrictive for production
  const runtimePolicy = await runloop.networkPolicy.create({
      name: "runtime-policy",
      allow_all: false,
      allowed_hostnames: ["api.openai.com"]
  });

  const blueprint = await runloop.blueprint.create({
      name: "dual-policy-blueprint",
      network_policy_id: buildPolicy.id,  // Build-time
      launch_parameters: {
          network_policy_id: runtimePolicy.id,  // Runtime
          launch_commands: ["npm install"]
      }
  });
  ```
</CodeGroup>

<Note>
  Devboxes can override the Blueprint's runtime network policy by specifying a different `network_policy_id` at creation time.
</Note>

## Next Steps

* [Manage blueprint lifecycle](/docs/devboxes/blueprints/lifecycle) - Delete blueprints and configure launch parameters
* [Learn more about Network Policies](/docs/network-policies) - Full documentation on network policy configuration
* [Troubleshoot blueprint builds](/docs/devboxes/configuration/troubleshooting/troubleshooting-blueprints) - Debug failed builds