← Features

Egress policy

A VM's egress policy controls which outbound destinations it can reach. The default policy is all. Set it to integrations to block public internet access while keeping exe.dev metadata and attached integration endpoints available.

Check a VM's policy, restrict it, or remove the restriction:

ssh exe.dev egress my-vm
ssh exe.dev egress my-vm integrations
ssh exe.dev egress my-vm all

Set the policy when creating or copying a VM with --egress:

ssh exe.dev new --egress=integrations
ssh exe.dev cp my-vm --egress=integrations

A copy inherits the source VM's policy unless --egress is given.

DNS

exe.dev is transitioning VMs to the DNS server at 169.254.169.254. New VMs are configured automatically. Older VMs must be configured manually so DNS continues to work when outbound access is restricted:

echo "nameserver 169.254.169.254" | sudo tee /etc/resolv.conf