Network and outbound traffic

A sandbox can reach the internet. The internet can reach it through SSH, froog's public URLs, its own public IPv6 address, which answers SSH and the ports you open, and the ports you open over IPv4, each at a port of its own on the machine's shared address. Other inbound connections are refused. In detail:

Restricting outbound traffic

froog doesn't filter outbound traffic beyond the rules above. You have root in the sandbox, so you can add your own rules with nftables. Rules made by user can be undone by anything running as user, since it has passwordless sudo. To contain code you don't trust, run it as a second user without sudo and outside the docker group, and limit that user. This allows it only DNS and HTTPS:

$ froog ssh my-box
user@my-box:~$ command -v nft || sudo apt-get install -y nftables   # sudo pacman -S nftables on Omarchy
user@my-box:~$ sudo useradd -m -s /bin/bash agent
user@my-box:~$ sudo nft -f - <<EOF
table inet egress {
  chain out {
    type filter hook output priority 0; policy accept;
    meta skuid $(id -u agent) oifname "lo" accept
    meta skuid $(id -u agent) udp dport 53 accept
    meta skuid $(id -u agent) tcp dport 443 accept
    meta skuid $(id -u agent) drop
  }
}
EOF
user@my-box:~$ sudo -u agent -H bash -lc 'cd ~ && ./run-task.sh'

The rules last until the sandbox stops: every start boots afresh. To apply them at every start, put the commands in your setup script (it runs in the background at every start, so the rules apply a moment after the sandbox is up). The second user can't read ~/.froog (mode 700, with your variables and setup files) or the files froog writes with mode 600 (secret files, and the in-sandbox key in ~/.config/froog/config.json). To allow a list of hosts rather than ports, send that user's traffic through an HTTP proxy that checks host names, and allow only the proxy.