Addresses a model provider fetches
For: cluster operators and plugin authors.
What a provider reaches on a call's behalf
A model call can make the provider itself open a connection: an image's URL, a remote MCP server, web search. That traffic starts outside the cluster, so no sandbox or egress proxy sees it, and the gateway holds it at the call:
| What the call names | What happens |
|---|---|
| An address (image, document, video, audio or file URL; remote MCP server) | Refused with 403 oz0_provider_egress unless the host and port are on the tenant's egress list, and on the list for the job's level when one applies |
Inline content (data:, base64) | Passes: no connection is made |
| A hosted tool that reaches addresses nobody can name beforehand (web search, web fetch, URL context, one the gateway does not know), or a model family known to search by name | Off until a tenant admin runs oz0 model rules --hosted-web-tools; always off for a job at a level with an egress list |
What is left is the provider's: a model outside that list that browses by itself, and whatever a hosted tool does once a tenant turned it on. See the threat model. On a node, a local model server is sent no address at all.
Check it yourself
make e2e-egress runs on Linux without root, in an unprivileged user and network namespace (on Ubuntu 24.04, sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 first). It downloads the toolchain once into ~/.cache/oz0-tools/toolchain, then runs a dev server, a node from an empty data directory with --offline, a plugin from Git, the quickstart's first run and, with OZ0_TEST_POSTGRES_URL set, a cluster-mode server, where every packet to another address and every DNS name is recorded. It prints what tried to leave, by process, and fails if anything did.