> ## Documentation Index
> Fetch the complete documentation index at: https://docs.celesto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Control internet access for AI agent sandboxes

> Choose whether an agent computer can connect to the internet, while keeping commands and terminal sessions available for your agent workflow.

You can decide whether a new Celesto computer can reach the internet. Turn internet access off when you want the computer to work only from files and tools already on disk, for example when an agent runs untrusted code, processes sensitive input that must not leave the sandbox, or reproduces a build with no outside package fetches. The computer can still run commands and provide a terminal for your agent.

Set the choice when you create a computer. It stays with that computer across stop, start, and restore, so create a new computer when a task needs a different setting.

<Note>
  Network Control requires Celesto SDK **0.0.13** or later for Python and **0.1.5** or later for TypeScript. The `--no-internet` CLI flag ships in the same Python release.
</Note>

## Choose an internet setting

| Setting | What your computer can do                                                        |
| ------- | -------------------------------------------------------------------------------- |
| `open`  | Connect to the internet. This is the default.                                    |
| `off`   | Run commands and use terminal sessions with outbound internet access turned off. |

Network Control currently supports these two settings. Domain and IP allowlists are not available.

## Create an offline computer

Pass `network_policy={"mode": "off"}` when you create a computer with Python, or `networkPolicy: { mode: "off" }` with TypeScript. The CLI provides the same choice through `--no-internet`.

<CodeGroup>
  ```python Python theme={null}
  from celesto import Computer


  computer = Computer(network_policy={"mode": "off"})
  try:
      result = computer.run("uname -a")
      print(result["stdout"].strip())
  finally:
      computer.delete()
  ```

  ```ts TypeScript theme={null}
  import { Computer } from "@celestoai/sdk";


  const computer = await Computer.create({ networkPolicy: { mode: "off" } });

  try {
    const result = await computer.run("uname -a");
    console.log(result.stdout.trim());
  } finally {
    await computer.delete();
  }
  ```

  ```bash CLI theme={null}
  celesto computer create --no-internet
  ```
</CodeGroup>

<Check>
  The Python and TypeScript examples print information about the computer's operating system. Commands and terminal sessions remain available while outbound internet access is off.
</Check>

## Keep the setting with the computer

Internet access is fixed when the computer is created. Stopping, starting, and restoring a computer keeps the same setting. This makes an offline workflow predictable when an agent resumes work later.

You can read the selected setting from the computer response:

<CodeGroup>
  ```python Python theme={null}
  from celesto import Computer


  computer = Computer(network_policy={"mode": "off"})
  try:
      print(computer.network_policy)
  finally:
      computer.delete()
  ```

  ```ts TypeScript theme={null}
  import { Computer } from "@celestoai/sdk";


  const computer = await Computer.create({ networkPolicy: { mode: "off" } });

  try {
    console.log(computer.networkPolicy);
  } finally {
    await computer.delete();
  }
  ```
</CodeGroup>

Both examples print the following policy:

```json theme={null}
{ "mode": "off" }
```

## Use an offline computer with local home storage

An offline computer uses the default home storage. A persistent home is a saved home folder that uses external storage, and it needs internet access. Keep `persistent_home=False` in Python or `persistentHome: false` in TypeScript when you select `off`.

<Warning>
  `network_policy={"mode": "off"}` cannot be combined with `persistent_home=True`. The TypeScript equivalents, `networkPolicy: { mode: "off" }` and `persistentHome: true`, cannot be combined either. The SDK validates this before it creates the computer.
</Warning>

Use the default `open` setting when your workflow needs a persistent home. Learn more about saved work in [Keep work between sessions](/cloud/features/persistence).

## Use Network Control with OpenAI Agents

`CelestoSandboxClientOptions` accepts the same policy when it creates a hosted computer for an OpenAI agent. Install the OpenAI Agents integration first with `pip install "celesto[openai-agents]"`.

```python network_controlled_agent.py theme={null}
import asyncio

from celesto.integrations.openai_agents import (
    CelestoSandboxClient,
    CelestoSandboxClientOptions,
)


async def main() -> None:
    client = CelestoSandboxClient()
    session = await client.create(
        options=CelestoSandboxClientOptions(
            network_policy={"mode": "off"},
        ),
    )
    try:
        print(session.state.computer_id)
    finally:
        await client.delete(session)


asyncio.run(main())
```

When you reuse a computer with `computer_id`, the requested policy must match that computer's saved setting. If it does not, the session fails closed: `client.create()` raises `RuntimeError` and does not start the computer, so an agent that expected an offline sandbox never runs against an online one. Omit `network_policy` when you want to accept whatever setting the existing computer was created with. For a complete agent workflow, see [Sandbox an OpenAI agent with Celesto or SmolVM](/cloud/openai-agents).

## Related pages

* [Create and manage sandboxed computers](/cloud/computers)
* [Keep work between sessions](/cloud/features/persistence)
* [Celesto CLI reference](/cloud/cli)


## Related topics

- [InternetSettings](/smolvm/api/internetsettings.md)
- [Network Controls](/smolvm/features/network-controls.md)
- [Celesto: secure microVM sandboxes for AI agents](/smolvm/introduction.md)
- [Network configuration](/smolvm/concepts/networking.md)
- [Petabyte-scale storage for AI agent sandboxes](/cloud/features/petabyte-storage.md)