Function Compute:VPC Network Configuration

This feature must be configured in the Function Compute console, the FC Agent Sandbox control plane, or related cloud products first, including the VPC, vSwitch, and security group settings. The application still uses the E2B SDK to create the sandbox.

Configuration entry and effective scope

Before integration, confirm the VPC configuration entry and effective scope:

• Configuration entry: Use the currently available FC Agent Sandbox console or control plane capability as the source of truth. If the console does not show a VPC configuration entry for FC Agent Sandbox, contact product support to confirm the enablement method.

• Effective scope: Confirm whether the configuration applies to the account, region, template, sandbox, or session, and whether it affects only newly created sandboxes.

• Network boundary: Confirm that FC Agent Sandbox, the VPC, vSwitch, security group, and target resources are in reachable regions and network scopes.

After the cloud-side configuration is complete, application code only needs to create the sandbox and access the target private endpoint inside the sandbox.

Verify internal network access

import { Sandbox } from "e2b";

const sandbox = await Sandbox.create("code-interpreter-v1", {
  apiKey: process.env.E2B_API_KEY,
  apiUrl: process.env.E2B_API_URL,
  domain: process.env.E2B_DOMAIN,
});

try {
  const endpoint = process.env.INTERNAL_API_ENDPOINT;
  if (!endpoint) {
    throw new Error("INTERNAL_API_ENDPOINT is required");
  }

  const result = await sandbox.commands.run(
    `python3 - <<'PY'
import os
import urllib.request

url = os.environ["INTERNAL_API_ENDPOINT"]
with urllib.request.urlopen(url, timeout=5) as response:
    print(response.status)
PY`,
    {
      envs: {
        INTERNAL_API_ENDPOINT: endpoint,
      },
      timeoutMs: 10_000,
    }
  );

  console.log(result.stdout.trim());
} finally {
  await sandbox.kill();
}

Common configuration items

• VPC: The private network that the sandbox needs to access.

• vSwitch: The vSwitch used by the sandbox.

• Security group: Controls the allowed traffic between the sandbox and target resources.

• Service-side allowlists: Access control configured on RDS, Redis, private APIs, and similar services.

Notes

• The VPC, vSwitch, FC Agent Sandbox, and target resources must be in reachable regions and network scopes.

• Open only the ports and address ranges that the sandbox actually needs to access.

• Network reachability does not grant business permissions. Databases, APIs, and object storage resources still require service-side authentication and authorization.

For configuration details, see the official documentation: VPC Network Configuration.