Oracle Cloud Infrastructure Documentation

Networking for Sandboxes

Configure outbound network access for the sandboxes in a Generative AI project.

Select the network configuration when enabling sandboxes for a project. All sandboxes in that project use the same outbound network configuration. Network mode and warm pool type are independent choices.

Managed Networking

With Managed networking, the service manages the outbound network path. Use the project's network policy to allow all outbound access, deny outbound access, or allow selected domains.

The CLI quick start uses ALLOW_ALL. Select the policy needed for your workload explicitly. If you restrict domains, include the destinations required to download dependencies or call external services.

Custom Networking

With Custom networking, outbound traffic uses a private subnet that you provide. Prepare:

  • A private subnet in the same region as the project.
  • Routes, DNS, security lists, and any gateways or private connectivity required to reach your destinations.
  • Optionally, up to five unique network security groups in the same VCN as the subnet.
  • Permission for the caller to use the subnet and any selected NSGs.
Allow group <group-name> to use subnets in compartment <network-compartment-name>
Allow group <group-name> to use network-security-groups in compartment <network-compartment-name>

Apply the NSG policy only if you use NSGs. Scope these policies to the compartment containing the network resources.

In the Console, select Custom under Networking mode. Enter the Subnet OCID. To add an NSG, select Add network security group tag and enter its OCID. See Sandbox Configuration.

For the API or CLI, use this sandboxConfig structure. Save it as sandbox-config.json and replace the placeholders:

{
  "isEnabled": true,
  "sandboxOutboundNetworkingConfig": {
    "networkMode": "CUSTOM",
    "subnetId": "SUBNET_OCID",
    "nsgIds": ["NSG_OCID"]
  }
}

Omit nsgIds if you aren't attaching NSGs. Managed networkPolicy settings don't apply to custom networking. Your VCN controls outbound access.

profile_name="DEFAULT"
region="us-chicago-1"
compartment_id="COMPARTMENT_OCID"

oci --profile "$profile_name" --auth security_token --region "$region" \
  generative-ai generative-ai-project create \
  --compartment-id "$compartment_id" \
  --display-name custom-network-sandbox-project \
  --sandbox-config file://sandbox-config.json

Wait for the project to become ACTIVE before creating a sandbox. Use the returned project OCID with the sandbox creation commands in Creating and Using a Sandbox.

Important

To use a different custom subnet or NSG set, create another project.

Published Ports

Publishing a port makes a service running in a sandbox reachable at a returned URL. This is configured when creating the sandbox and is separate from the project's outbound network settings.

Important

The published port endpoint doesn't add OCI sign-in or application authorization. Anyone who has the URL can reach the service while the sandbox is running unless your application provides its own authentication and authorization. Treat the URL as sensitive.

See Running a Service on a Published Port.