Expose CLI flag to allow access to host/private IPs (`NetworkPolicy::allow_all`)

[rominf]

The Problem

Currently, it is impossible to access services running on the host machine (e.g., a local Ollama instance on port 11434) or other private LAN IPs from inside a microsandbox via the CLI.

Even when configuring the host service to listen on 0.0.0.0 and using the host's actual local IP (e.g., 192.168.x.x), the connection instantly fails. This appears to be because the CLI enforces NetworkPolicy::public_only() by default, which drops all packets destined for private subnets.

While --no-dns-rebind-protection allows DNS to resolve to local IPs, the underlying packet filter still blocks the traffic.

Use Case

Running local AI development environments inside msb where the sandbox needs to communicate with large, resource-heavy services running on the host machine (like an LLM inference server).

Currently, the only local workaround is to use a clunky file-system bypass (using socat to pipe traffic through a Unix socket in a shared volume).

Proposed Solution

Provide a flag in the msb create CLI to override the default network policy and allow traffic to private IP addresses.

For example, an --allow-private-ips or --network-policy allow_all flag that passes NetworkPolicy::allow_all() to the underlying sandbox configuration.

Expected CLI Usage:

msb run --allow-private-ips ubuntu

Environment Context

• Host Service: Ollama bound to 0.0.0.0:11434
• Command: msb exec dev -- curl http://<HOST_LAN_IP>:11434/v1
• Result: curl: (7) Failed to connect ... after 0 ms: Could not connect to server

[appcypher]

Thanks for raising this. Like you said, the logic is there in the code, just not exposed to the CLI yet.

But I would go for

• --network-policy none
• --network-policy public-only
• --network-policy nonlocal
• --network-policy allow-all

With meanings:

• none: no network
• public-only: public internet only
• nonlocal: public + private, but still not loopback/link-local/metadata
• allow-all: everything the engine can reach

And I would introduce:

NetworkPolicy::non_local()

[nramirezuy]

@appcypher, I'm curious in the reasoning of nonlocal. Do you have a use case for it?

Is is possible to have a --private-only? I want to host some resources in the private network, for example an ollama service, but my microvm don't really need internet access for anything.