From de7ff8b6fbe89e4bc6fd89702a12ddea30d1bdbf Mon Sep 17 00:00:00 2001 From: Alexander Watson Date: Fri, 13 Mar 2026 10:59:33 -0700 Subject: [PATCH] docs: soften default-deny wording to minimal outbound access Sandbox defaults vary by type and community configs, so "all outbound traffic is blocked" is too absolute. Made-with: Cursor --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ecf19dbc2..f37b5e0b5 100644 --- a/README.md +++ b/README.md @@ -48,10 +48,10 @@ The sandbox container includes the following tools by default: ### See network policy in action -Every sandbox starts in **default-deny** — all outbound traffic is blocked. You open access with a short YAML policy that the proxy enforces at the HTTP method and path level, without restarting anything. +Every sandbox starts with **minimal outbound access**. You open additional access with a short YAML policy that the proxy enforces at the HTTP method and path level, without restarting anything. ```bash -# 1. Create a sandbox (all outbound traffic denied by default) +# 1. Create a sandbox (starts with minimal outbound access) openshell sandbox create --name demo --keep --no-auto-providers # 2. Inside the sandbox — blocked