Network ingress & previews

1. Expose a port (skip network isolation)

By default, every execution in a sandbox runs inside a network-isolated namespace to prevent egress/ingress abuse. To allow inbound routing to a background process (like a web server on port 3000), you must explicitly setexpose_port when starting the process.

# Neither SDK wraps expose_port yet -- call the REST endpoint directly
POST /v1/sandboxes/{session_id}/processes
Authorization: Bearer bxk_live_...
Content-Type: application/json

{
  "command": "python3 -m http.server 3000",
  "expose_port": 3000
}

This moves the specified process into the pod's shared network namespace, making port 3000 reachable by the sidecar. All other sandbox processes remain fully isolated.

2. Mint a preview URL

To make the exposed port accessible publicly (e.g. for sharing or viewing in a browser), mint a signed, temporary preview URL. The response contains the public URL, expiration timestamp, and a token_id for early revocation.

# Generate a signed URL valid for 1 hour (default is 15 minutes)
preview = client.create_preview_url(
    session_id=sb.id,
    port=3000,
    ttl_seconds=3600
)

print(preview["url"])          # Public HTTPS URL with temporary token query param
print(preview["token_id"])     # Token ID used for early revocation

3. Revoke a preview URL early

You can invalidate a preview URL token immediately before its natural expiration using its token_id:

client.revoke_preview_url(
    session_id=sb.id,
    port=3000,
    token_id=preview["token_id"]
)