Egress

Every runtime has one egress policy. Setting it replaces the complete policy.

Policy entries are hostnames or wildcard host patterns, not URLs:

pypi.org
api.openai.com
*.pythonhosted.org

Hosts are lowercased, sorted, and deduplicated. Do not include schemes, paths, ports, or query strings.

Set Policy

Each call replaces the entire policy, so include every host you want to keep.

CLI

runta egress set demo \
  --mode allowlist \
  --allow pypi.org '*.pythonhosted.org' api.openai.com

Python

from runta import EgressMode, EgressPolicy

runtime.egress.set_policy(
    EgressPolicy(
        mode=EgressMode.ALLOWLIST,
        allowed_hosts=["pypi.org", "*.pythonhosted.org", "api.openai.com"],
        denied_hosts=[],
    )
)

TypeScript

await runtime.egress.setPolicy({
  mode: "allowlist",
  allowedHosts: ["pypi.org", "*.pythonhosted.org", "api.openai.com"],
  deniedHosts: [],
});

Read the current policy with runta egress describe demo, runtime.egress.get(), or await runtime.egress.get().

Reset Policy

An empty denylist is the default open policy:

CLI

runta egress set demo --mode denylist

Python

runtime.egress.set_policy(EgressPolicy())

TypeScript

await runtime.egress.setPolicy({
  mode: "denylist",
  allowedHosts: [],
  deniedHosts: [],
});

Quick Reference

CLI

Use the Runta CLI for terminal workflows, shell scripts, and direct runtime operations.

Task	CLI command
Inspect the current policy	runta egress describe demo
Set an allowlist	runta egress set demo --mode allowlist --allow api.openai.com
Set a denylist	runta egress set demo --mode denylist --deny example.com
Reset to the default open policy	runta egress set demo --mode denylist

Python

Use these calls after creating or resolving a Python runtime handle such as runtime.

Task	Python SDK
Inspect the current policy	runtime.egress.get()
Set an allowlist	runtime.egress.set_policy(policy)
Set a denylist	runtime.egress.set_policy(policy)
Reset to the default open policy	runtime.egress.set_policy(EgressPolicy())

TypeScript

Use these promise-based calls after creating or resolving a TypeScript runtime handle.

Task	TypeScript SDK
Inspect the current policy	await runtime.egress.get()
Set an allowlist	await runtime.egress.setPolicy(policy)
Set a denylist	await runtime.egress.setPolicy(policy)
Reset to the default open policy	await runtime.egress.setPolicy({ mode: "denylist", allowedHosts: [], deniedHosts: [] })