From d654c7d35f22ac628bc423cbb30d7637a63c68e2 Mon Sep 17 00:00:00 2001
From: Drew Newberry <anewberry@nvidia.com>
Date: Thu, 12 Mar 2026 00:50:48 -0700
Subject: [PATCH] wip

---
 examples/local-inference/sandbox-policy.yaml | 30 +-------------------
 1 file changed, 1 insertion(+), 29 deletions(-)

diff --git a/examples/local-inference/sandbox-policy.yaml b/examples/local-inference/sandbox-policy.yaml
index 7c9f3b306..549a31c9c 100644
--- a/examples/local-inference/sandbox-policy.yaml
+++ b/examples/local-inference/sandbox-policy.yaml
@@ -25,32 +25,4 @@ process:
   run_as_user: sandbox
   run_as_group: sandbox
 
-network_policies:
-  opencode:
-    name: opencode
-    endpoints:
-    - host: models.dev
-      port: 443
-    - host: registry.npmjs.org
-      port: 443
-    - host: opencode.ai
-      port: 443
-    binaries:
-    - path: /usr/lib/node_modules/opencode-ai/bin/.opencode
-    - path: /usr/bin/node
-    - path: /usr/local/bin/opencode
-  nvidia_inference:
-    name: nvidia-inference
-    endpoints:
-    - host: integrate.api.nvidia.com
-      port: 443
-      protocol: rest
-      tls: terminate
-      enforcement: enforce
-      access: full
-    binaries:
-    - path: /usr/lib/node_modules/opencode-ai/bin/.opencode
-    - path: /usr/bin/node
-    - path: /usr/local/bin/opencode
-    - path: /usr/bin/curl
-    - path: /bin/bash
+# No network policies means all outbound connections are denied and only inference.local is allowed.