Traffic policies
Let a VM talk to what it needs. Nothing else.
An agent needs its model and its packages, not your whole internet. Pick a template, adjust it, and import it into Hangar with one link.
Start from a template. Change anything.
Claude Code
The API and sign-in, GitHub for plugins, npm for MCP servers. The optional Datadog telemetry hosts stay off.
Use thisCodexIn the builder
OpenAI’s API and ChatGPT sign-in, with GitHub and npm to work with.
Use this+ 4 more
Any model
Claude, OpenAI, Gemini and Hugging Face, plus GitHub, npm and PyPI to build with.
Use this+ 3 more
CI runner
Check out from GitHub, install from npm, PyPI, crates.io and Go, pull from Docker Hub.
Use thismacOS and Xcode
Apple’s updates, Xcode components and notarization, with Homebrew and GitHub.
Use thisUpdates only
The Debian and Ubuntu archives. Nothing else gets out.
Use thisQuiet room
An allow list with nothing on it. The VM looks up nothing and reaches nothing.
Use thisBuilder
Pick what it may reach. Block the rest.
Every service comes with its host names, and with the address ranges it publishes as its own. The result is an allow list: a link you import in Hangar, a file, or a command.
Services without an address range sit behind a shared CDN. Hangar matches them by host name, since allowing the CDN’s addresses would open every other site on it.
Your own
Also
89 rules
allow list
https://hangar.baseguard.io/policies/rules.json?use=openai,github,npm
- 01In Hangar, open the VM’s Traffic tab.
- 02Under Rules File, choose Import… › Import from URL…
- 03Paste the link. Hangar shows what changes and asks first.