# Sandbox networks
URL: https://docs.munito.ai/sandboxes/networks

A network joins sandboxes of one workspace. Each member gets a private IPv6 address and the name `<hostname>.<network>.internal`. A member reaches each member of its networks on each port, over TCP and UDP. Nothing else reaches the members through the network.

## Join sandboxes in a network [#join-sandboxes-in-a-network]

1. Create a network:

```bash
curl -sS --fail-with-body https://api.munito.ai/sandboxes/v1/networks \
  -H "Authorization: Bearer $MUNITO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "app"}'
```

The answer is the network. Keep its `id`:

```bash
export NETWORK="net_01k8f7a2c4d6e8g0h2j4k6m8n0"
```

2. Create two sandboxes in the network, each with a hostname:

```bash
for name in db web; do
  curl -sS --fail-with-body https://api.munito.ai/sandboxes/v1/sandboxes \
    -H "Authorization: Bearer $MUNITO_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"networks": ["'"$NETWORK"'"], "hostname": "'"$name"'"}'
done
```

3. In the `db` sandbox, start a server on port 8080. In the `web` sandbox, open `http://db.app.internal:8080`.

- A server takes connections from the network when it listens on `::`. A server that listens on `0.0.0.0` takes IPv4 only, and the network is IPv6.
- `networks` in the answer gives the name and the address of the sandbox in each network.
- A sandbox without a hostname has its id as its name, with a hyphen for the underscore: `sbx-01k8f6x7g3d2b9v5n4m1q0w8e6.app.internal`.
- A sandbox resolves the names of its own networks. The other names resolve as before.

## Join and leave a running sandbox [#join-and-leave-a-running-sandbox]

- To join a running sandbox to a network, send `POST /sandboxes/{sandbox_id}/networks/{network_id}`. The sandbox gets its address at once. The other members resolve its name within seconds.
- To take a sandbox out of a network, send `DELETE /sandboxes/{sandbox_id}/networks/{network_id}`. The sandbox then reaches no member of that network.
- A sandbox that stops leaves its networks.

## Manage networks [#manage-networks]

| Request                         | Result                                                   |
| ------------------------------- | -------------------------------------------------------- |
| `GET /networks`                 | The networks of the workspace, each with its members     |
| `GET /networks/{network_id}`    | One network, with the name and address of each member    |
| `DELETE /networks/{network_id}` | Deletes a network that no running sandbox is a member of |

## Security [#security]

- A network does not connect to the internet, to your other workspaces or to another organization.
- A member sends only from its own address, and only to the members of its networks. The machine of the sandbox checks each packet, and root in the sandbox cannot change that.
- The traffic between members on different machines is encrypted.
- A sandbox with `"internet": false` can join a network. It then reaches its members and nothing else.

## Limits and price [#limits-and-price]

- An organization has 10 networks at most, and a network has 1,000 members at most.
- A persistent sandbox cannot join a network yet.
- Networks are free. The traffic between members is free.