Egress control

Egress control is the policy on what a sandbox can reach on the internet, enforced with measures such as allow-lists and logging of outbound traffic.

Each sandbox needs an interface, an address, and three network policies. The policies are no lateral access to other sandboxes or the host, controlled egress to the internet, and controlled ingress through a proxy. Egress is the sensitive policy of the three.