# `SmolBox.NetworkPolicy`
[🔗](https://github.com/hfiguera/smolbox/blob/v0.1.3/lib/smolbox/network_policy.ex#L1)

Explicit outbound allowlist for smolvm 1.16.0. Offline remains the default.

Hosts are lowercase DNS names; a name also allows its subdomains upstream.
smolvm learns destination IPs from DNS responses, so this is not HTTP hostname,
URL, TLS identity or port filtering. Other services on an allowed IP can be
reachable. CIDRs and learned IPs are combined. DNS is needed for host policies.

Policies are trusted operator configuration, never guest-selected authority.
Approve a new profile revision when changing access. No inbound ports, host
mounts or automatic image pulls are enabled. Upstream and deployment controls
can deny additional destinations; an allowlist is not proof of reachability.

The upstream DNS gateway and authenticated rollout endpoint are infrastructure
exceptions to the allowlist. The server's strict egress floor is deployment
configuration, not a guarantee attested by this struct. See the controlled
network access guide for the tested platform and protocol boundaries.

# `t`

```elixir
@type t() :: %SmolBox.NetworkPolicy{cidrs: [String.t()], hosts: [String.t()]}
```

# `new`

```elixir
@spec new(keyword()) :: {:ok, t()} | {:error, SmolBox.Error.t()}
```

Build a nonempty allowlist with at most 32 hosts and 32 canonical CIDRs.

Use `hosts: ["api.example.com"]` or `cidrs: ["203.0.113.0/24"]`, or both.
Hosts exclude URLs, wildcards, IP literals and trailing dots. CIDRs require
network-aligned IPv4/IPv6 addresses and a nonzero prefix. Duplicate entries
are rejected; order is canonicalized for durable identity comparisons.
Bare networking flags and empty policies are rejected; use `:offline` instead.
Broad CIDRs grant broad access; operators must review the complete policy.

# `valid?`

```elixir
@spec valid?(term()) :: boolean()
```

Revalidate a canonical policy or the offline sentinel.

---

*Consult [api-reference.md](api-reference.md) for complete listing*