The installer and platform settings that change the security posture of a self-hosted deployment, with their options and product defaults.
Installer settings are set in the installer’s configuration screen. Platform settings are set by the setup operator in the application. Capabilities behind settings that are off are not described in these pages.
Sandbox runtime
| Setting | Options | Default | Effect |
|---|
| Sandbox Mode | Agent Sandbox (recommended), Daytona | Agent Sandbox | Agent Sandbox runs each sandbox as a Kubernetes Pod in your cluster, managed by the sandbox controller. |
| Install Agent Sandbox Controller | On, off | On | Installs the sandbox controller with the release. |
| Sandbox Workload Identity | On, off | Off | Turns on the sandbox identity described in Sandbox identity and shows Sandbox Egress Posture. |
| Enable Agent-Sandbox Warm Pool (CRD) | On, off | Off | Keeps pooled sandboxes started in advance; a task falls back to a cold sandbox when the pool is empty. |
| Agent-Sandbox Warm Pool Size | A number (3 to 10 recommended) | 3 | How many pooled sandboxes to keep. |
| Sandbox CPU | A CPU quantity | 1 | CPU allocation per sandbox, applied as both the request and the limit (guaranteed QoS). |
| Sandbox Memory | A memory quantity | 4Gi | Memory allocation per sandbox, applied as both the request and the limit (guaranteed QoS). |
| Sandbox Idle Timeout (minutes) | 1 to 240 | 30 | Minutes of agent inactivity before the sandbox is torn down. Lower values reclaim resources faster but force more warm starts for people who pause and return (typical: 10 for cost-sensitive development, 30 for production, 60 or more for long human-in-the-loop gaps). |
| Use OhMyPi for new tasks | On, off | On | Chooses the harness for new tasks (see Harness). |
Sandbox egress
| Setting | Options | Default | Effect |
|---|
| Sandbox Egress Posture | Open internet, Domain allowlist, Workspace only | Derived from the two settings below: Domain allowlist if the egress proxy is on, otherwise Open internet if sandbox internet access is on, otherwise Workspace only. With both at their defaults, the result is Open internet. | Open internet permits direct connections to public addresses (private and link-local addresses stay blocked). Domain allowlist sends all outbound traffic through the egress proxy and permits only listed domains. Workspace only permits only the platform’s own services. Restricted postures add a note to the agent’s system prompt. Shown only when Sandbox Workload Identity is on. |
| Sandbox Internet Access | On, off | On | Without workload identity: permits sandbox traffic to any address except the private ranges. |
| Sandbox Egress Proxy (domain allowlist) | On, off | Off | Without workload identity: sends sandbox traffic through the egress proxy and applies the allowlist. |
| Sandbox Egress Proxy Allowlist | One domain per line; a leading dot covers the domain and its subdomains | Empty (an empty list denies all outbound traffic) | Destinations the proxy permits under Domain allowlist. Box needs .boxcloud.com and upload.box.com (and upload.<zone>.box.com for Box Zones); do not add .box.com. The Daytona sandbox mode accepts at most 20 entries. |
| private upstream CIDRs (advanced) (sandbox group) | CIDR ranges; entries shorter than /12 are rejected | Empty | Private ranges the egress proxy may reach on port 443, for example a model gateway inside your network. Limit it to the model gateway’s range. |
| Sandbox Private HTTPS CIDRs | CIDR ranges | 0.0.0.0/0 | Ranges sandboxes may reach on HTTPS in the legacy network policy. |
| Sandbox DNS Service CIDRs | CIDR ranges | 0.0.0.0/0 | Ranges sandboxes may reach for DNS. |
Before you change the egress posture, drain or replace sandboxes, including pooled sandboxes: existing Pods keep the network settings they started with. For how the egress proxy applies credentials, see Credential handling.
Edge and load balancer
| Setting | Options | Default | Effect |
|---|
| Deny internal-only paths at the edge | On, off | Off | Returns 403 at the edge for internal-only paths (/api/internal/*, /internal/applet-api/*, /internal/mcp-connector/*, /_s3-gateway/finalize-upload and /metrics), except the checkpoint path. Review about 7 days of access logs before you turn it on. |
| ALB Visibility | Internal (VPC-only), Internet-Facing | Internal | Whether the load balancer is reachable only inside your network. |
| Allowed Source CIDRs | CIDR ranges | Empty (no source restriction) | Source ranges allowed to reach the load balancer. |
| WAF Web ACL ARN | An AWS WAF Web ACL | Empty | Attaches a WAF to the load balancer. Shown only for an internet-facing load balancer. |
| TLS Termination on ALB | On, off | On | Terminates TLS at the load balancer. |
Connectors
| Setting | Options | Default | Effect |
|---|
| Enable MCP Connectors | On, off | Off | Installs the connectors service. |
| Connector Deployment Boundary | Public internet / Prosumer, Customer VPC | None; you choose | Public internet forces public-only targets and the connector network policy. Customer VPC allows the target settings below. |
| Connector Target URL Mode | Public only, Public plus allowlist | Public only | Which addresses connectors may call. Cloud metadata and link-local addresses are always blocked. |
| Allow All Private Connector Targets | On, off | Off | Lets connectors call any address in the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 and IPv6 unique local addresses). |
| Connector Target URL Allowlist | Comma- or newline-separated host patterns (* matches exactly one label), exact IPs or CIDRs | Empty | The approved private hosts connectors may call under Public plus allowlist. List only your MCP servers. |
| Enable Connector Egress NetworkPolicy | On, off | Off | Limits the connectors service’s outbound traffic with a Kubernetes NetworkPolicy. |
| Connector Target Egress Ports | Ports | 80,443 | Ports the connector network policy permits. |
| Connector Public Egress CIDRs | CIDR ranges | 0.0.0.0/0 | Public ranges the connector network policy permits. |
For the organization-level connector controls, see Connectors.
Model gateway and third parties
| Setting | Options | Default | Effect |
|---|
| Run LiteLLM in-cluster | On, off | On | Runs the model gateway inside the cluster. |
| LiteLLM Base URL | A URL | Empty | An external model gateway to use instead, for example one inside your network. The egress proxy adds its credential to model requests. |
| Composio API Key | A key | Empty | When set, some connector requests are sent to Composio, a third party. The key stays server-side and is not sent to sandboxes. |
| Enable Box Integration | On, off | Off | Lets agents read and write Box content; sandboxes then need the Box domains in the egress allowlist. |
| Parallel API Key (recommended) | A key | Empty | Web search provider used by agents. |
| fal.ai API Key (video generation) | A key | Empty (video generation off) | Media generation provider; a blank key disables it. |
Which model configurations exist, and which gateway they use, is set by the setup operator in the application.
Observability
| Setting | Options | Default | Effect |
|---|
| Install bundled observability stack | On, off | Off | Installs Loki, Tempo, Alloy, Grafana, Prometheus and Alertmanager in their own namespace. |
| Loki retention period | A duration | 168h (seven days) | How long the bundled Loki keeps logs. |
| Sandbox Log Receiver Key | A key | Generated | The key the application uses to verify sandbox log pushes (see Known issues and hardening, S-06). |
Sign-up
| Setting | Options | Default | Effect |
|---|
| Allowed Sign-Up Email Domain | A domain, or * for any address | Empty (self-service sign-up off) | Who can create an account by signing up. |
| Require an Invitation to Join | On, off | Off | People who sign up without an invitation do not get an organization of their own or join one by email domain. |
| Signup Domain-Health Gate | Off, Shadow, Enforce | Off | Checks the health of a new account’s email domain and, under Enforce, blocks bad domains. |
Domain mapping, the fallback organization, the default sign-up workspace, email verification, password sign-in and single sign-on are set in the application (see Sign-up and accounts and Sign-in options).
Permissions engine
| Setting | Options | Default | Effect |
|---|
| Permissions v4 (OpenFGA) | On, off | Off | Installs the permissions v4 decision server. Only organizations created on v4 use it; existing organizations keep the existing permissions. |
| Permissions engine for new organizations | Legacy, Permissions v4 | Legacy, or Permissions v4 when Permissions v4 (OpenFGA) is on | Which permissions engine new organizations use. Several permissions findings behave differently on v4 (see Status of product changes). |
Organization infrastructure page
| Setting | Options | Default | Effect |
|---|
| Show Organization Infrastructure Page | On, off | Off | Gives every organization owner and admin a page that shows sandbox state for the whole deployment and can delete any sandbox (S-17, P-09). |
These are set in the application, not in the installer: feature settings by the setup operator, organization policies by organization admins. Each affects what agents and people can do.
| Setting | Effect when on |
|---|
| Connectors | People and agents can use MCP connectors |
| Drive search tool for agents | Agents can search the drive |
| Scheduled tasks | Tasks can run on a schedule |
| Applets, applet secrets and applet vector store | Applets can be built and published, use bound secrets and keep a vector store |
| Context Code | Paired devices can claim work |
| Media generation | Agents can generate images and video through the configured provider |
| Organization infrastructure page | See Organization infrastructure page |
| Restriction on running another person’s assistant | Only people with explicit rights can run a personal assistant; organization owners still can (P-01) |
| Private-workspace restriction for organization admins | Organization admins and owners lose standing access to private and personal workspaces (P-03) |
| Agent role restrictions | Agents cannot be given admin or owner roles (P-07) |
| Credentials for developer tools in sandboxes; agent use of secrets | Developer-tool credentials are placed in sandboxes and agents can use secrets |
