HOSTING FOR AI-BUILT APPS

Verify a running app cannot reach www.google.com on Yeeted

A four-file app whose entire job is to try to leave the sandbox and fail. No network_access section in yeeted.yaml - on purpose. The platform default is no external network for a running app, and this example is the check that the default is real, not documentation.

This is the denied half of the egress pair. Its sibling, egress-allowed, proves a build can reach the same site and shows how external access is declared when an app genuinely needs it.

What it does

• server.py serves GET /egress, which attempts https://www.google.com: a DNS resolve first, then an HTTPS fetch. The outcome is reported as JSON - which stage stopped it (dns, connect, or the 15s deadline), and the error.
• On a correctly configured deployment the attempt always fails. DNS itself is denied on the platform, so the record usually reads: stage dns, a resolver timeout. The whole attempt is bounded to 15 seconds - Google answers in a second or two when a route exists, so an attempt that has not finished by then is a denial, not a slow site - and the record then reads: stage deadline. The bound keeps the request well under the platform probe's 20 second per-check timeout, which denied DNS would otherwise run out the clock on.
• The one forbidden outcome is "ok": true. Google answering anything - even a 30x redirect or a 429 error page - would mean packets left the sandbox, which is what the smoke script fails on.

Run locally

From python/egress-denied:

python3 server.py
curl -s localhost:8080/egress

Your laptop has internet, so /egress reports "ok": true locally. That is correct and is exactly why the deployed smoke exists: the same code that succeeds on your laptop must fail on the platform. The difference between those two results is the entire test.

Deploy and verify

Follow the deployment walkthrough. Deploy this folder as-is - the manifest deliberately declares no external access.

sh smoke.sh "$PREVIEW_URL"

The script checks that the app is up and that the fetch attempt failed with a recorded stage and reason. The attempt bounds itself to 15 seconds, so the request returns promptly either way.

Endpoints

• GET /healthz - ok
• GET /egress - the attempt record; must contain "ok": false in production

Caveats

• This example proves the default for an app with no declaration. An app that genuinely needs an external endpoint declares it with network_access (see egress-allowed); the declaration is recorded as an access request for Admin review and never opens traffic by itself.
• If the deployed smoke ever FAILS with "ok": true, that is not a flaky test - it is evidence the isolation boundary leaked, and worth reporting with the /egress record attached.
• The probe targets one well-known site for legibility. It is a reachability check, not a monitoring tool; the page is never parsed beyond the status.

View this guide and source on GitHub