From cc9633b1aef3f7b41b106e61baff7aa95c5db8a3 Mon Sep 17 00:00:00 2001 From: Craig Osterhout Date: Wed, 26 Aug 2026 09:38:57 -0700 Subject: [PATCH] sbx-policy: clarify network rule port matching Signed-off-by: Craig Osterhout --- content/manuals/ai/sandboxes/governance/concepts.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/manuals/ai/sandboxes/governance/concepts.md b/content/manuals/ai/sandboxes/governance/concepts.md index d39cd47f128..e36ad0152fe 100644 --- a/content/manuals/ai/sandboxes/governance/concepts.md +++ b/content/manuals/ai/sandboxes/governance/concepts.md @@ -64,6 +64,10 @@ ranges, or ports. The governance policy schema also accepts `connect:udp`, but Docker Sandboxes always blocks direct external UDP and ICMP. `connect:udp` rules have no effect. +When a resource doesn't specify a port, the rule matches every port on that +destination. `example.com` matches all ports on `example.com`; `example.com:443` +matches only port 443. + **Hostname patterns** | Pattern | Example | Matches |