Network access from Python

Every Python run executes in a single-use gVisor sandbox that is created for that run and destroyed after it. The sandbox has its own network boundary, enforced outside the Python process, so a run cannot widen it. This page describes what that boundary allows, what it refuses, and how each refusal looks from your code.

What works

Outbound TCP to public IPv4 addresses, on any port. HTTPS on 443, Postgres on 5432, and anything else that speaks TCP — including plain HTTP on port 80, which stays open because not every system a pipeline has to talk to offers TLS.
DNS, resolved through the cluster resolver. Use hostnames; you do not need to hardcode addresses.
Preinstalled and declared dependencies. The packages in the sandbox image are available immediately, and a node’s requirements are resolved to binary wheels before the run and installed offline inside the sandbox.

Plain HTTP is not encrypted. Anything a run sends over http:// — or to any other port without TLS — is readable, and modifiable, by every network between this cluster and the destination. Treat credentials, tokens and personal data sent that way as disclosed. Prefer https:// whenever the far end supports it; the usual way this goes wrong is a connection string with a password in it, sent to a legacy endpoint over http://.

Call a public API

import httpx
from _panels import output

response = httpx.get(
    "https://api.exchangerate.host/latest",
    params={"base": "GBP"},
    timeout=20.0,
)
response.raise_for_status()
output({"rates": response.json()["rates"]})

Read from a public database

import os
import duckdb
import sqlalchemy as sa
from _panels import output_table

# Postgres over TCP/5432 on a public host.
engine = sa.create_engine(os.environ["ANALYTICS_DB_URL"])
with engine.connect() as conn:
    rows = conn.execute(sa.text("SELECT country, population FROM cities")).fetchall()

# DuckDB reading a public HTTPS object works the same way.
remote = duckdb.sql("SELECT * FROM read_parquet('https://example.com/cities.parquet')").df()

output_table(remote)

Use a secret reference for the connection string. Never inline credentials in node code. If the secret is a connection (a structured secret with a host, port, database, user and password rather than a bare connection string), the runtime assembles the connection string for you — TLS required unless the connection says otherwise — and exposes it two ways: as os.environ["<ENV>_URL"], and as get_secret("<ENV>")["url"] alongside the individual fields.

from _panels import get_secret
import sqlalchemy as sa

engine = sa.create_engine(get_secret("ANALYTICS_DB")["url"])

Declare a dependency

{
  "code": "import tenacity\n…",
  "requirements": ["tenacity>=9,<10"]
}

Requirements are resolved against PyPI before the sandbox starts and installed from prebuilt wheels with no index access and no build step. A package with no binary wheel for the sandbox’s Python version and platform fails at resolution, not at import — the run never starts. Ask your operator to add such a package to the image instead.

What does not work

You tried	What happens	Why
An IPv6 address or an IPv6-only host	`OSError: [Errno 97] Runner network: only TCP over IPv4 is available — see https://docs.panels-analytics.com/guides/data/python-network-access`, or a connection failure after DNS returns only `AAAA` records	IPv6 egress is not enabled (see below)
A UDP socket — NTP, a custom DNS resolver, QUIC/HTTP3	The same `OSError` when the socket is created; a raw UDP send that bypasses the socket API is dropped and times out	The sandbox permits TCP only
`ping`, or a raw socket	`ping` reports 100% packet loss; `socket.socket(AF_INET, SOCK_RAW)` raises the same `OSError`	ICMP is not permitted, and raw sockets are not available to an unprivileged sandbox
Listening for an inbound connection — a webhook, an OAuth callback	The `bind()` and `listen()` succeed but nothing ever connects, and the run ends at its deadline	Nothing can open a connection into the sandbox
`https://app.panels-analytics.com`, a cluster service, a node IP, or any private range	`ConnectTimeout` / `ConnectionRefusedError`	Our own infrastructure is excluded from the egress allowance by design
Work that runs longer than its execution budget — five minutes, less whatever installation and startup took on a managed runner	The run is cancelled and reported as a timeout	See Timeouts

To read or write Panels data, do not call the platform API from inside a run. Use the run’s inputs (input_table()), the DuckLake run proxy that the sandbox is already wired to, and output() / output_table() for results. Those go through run-scoped credentials that expire with the run and are refused from outside the cluster.

Requests leave from a datacenter IP address. Sites with bot protection may challenge or block them even though the network boundary allows the connection. A 403 with a challenge page is a decision by the remote site, not a sandbox restriction.

Profile differences

The profile for a run is derived from what the node declares; you do not select it directly.

Profile	Typical work	Network
`public` / `flexible`	Python that calls public APIs, with or without a selected secret	Outbound TCP to public IPv4, plus the platform data plane
`governed`	Managed provider connections, and unattended agent runs	No network egress. The process can open only a Unix-domain socket to the local provider gateway, enforced by a seccomp filter it cannot remove. Use `provider_request()`.
`restricted`	Internal SQL, references, manual tables	Platform data plane only. No public egress.

On governed, an attempt to create any IP socket raises PermissionError: [Errno 1] Operation not permitted — the kernel refuses it, and the refusal is inherited by every child process. See Connect an OAuth provider for the request API available on that tier.

Timeouts

Your code gets five minutes of execution, and that is the budget every network call it makes has to fit inside. Dependency installation and interpreter startup are billed to separate budgets before yours begins — 2 minutes and 60 seconds — so they do not spend it. On a managed runner the five minutes is a ceiling rather than a promise. The runner’s claim is capped at five minutes and covers installation, startup and execution together, so your code gets what is left of the claim once preparation and startup have taken their share. A run that installs nothing starts with almost the whole five minutes; one that resolves a large dependency set starts with less. Plan for the remainder, not the ceiling. A long sync is not meant to fit one run at all. End the run early with ctx.request_continuation(...) and the platform runs the node again from the cursor you checkpointed — see Connect a database. Set an explicit client timeout well inside your budget. Most HTTP clients default to no timeout at all, which turns an unreachable host into a run that ends at its deadline with no result:

httpx.get(url, timeout=30.0)                       # httpx
requests.get(url, timeout=30)                      # requests
sa.create_engine(url, connect_args={"connect_timeout": 10})  # psycopg

Why IPv6 is not enabled

IPv6 egress is deliberately off, and the sandbox refuses AF_INET6 sockets early so the failure is legible rather than a hang. The egress boundary is an address-based allowance: public destinations are permitted and private, loopback, link-local, metadata, carrier-grade NAT, test, multicast, and reserved ranges are denied. That classification is only sound if the address being classified is the address actually reached. With IPv6 in play, a translated destination (NAT64 and similar) can carry a private target inside a public-looking address, and the prefix used for the translation is deployment-specific — a fixed exception list cannot cover it. Enabling IPv6 therefore requires forcing traffic through a gateway that classifies the post-translation address. Until that exists, IPv6 stays disabled rather than being allowed with a boundary that cannot be trusted. Practically, every destination must have an A record. Libraries that try IPv6 first and fall back to IPv4 (httpx, requests, urllib3, socket.create_connection) continue to work: the IPv6 attempt fails at socket creation and the IPv4 attempt proceeds.

Troubleshooting

Symptom	What to do
`ping` fails or reports 100% loss	Expected. ICMP is not permitted. Test reachability with a TCP connection instead.
`OSError … only TCP over IPv4 is available` naming an IPv6 address	Connect to the host’s IPv4 address, or use a hostname with an `A` record. The host may be IPv6-only.
`Connection to app.panels-analytics.com refused` or timing out	By design. Do not call the Panels API from a run — use the node’s inputs, the DuckLake proxy, and `output_table()`.
A UDP socket raises `EPERM` or the guide error	Not supported. Use a TCP transport; there is no UDP path, including for a custom DNS resolver.
`PermissionError: [Errno 1] Operation not permitted` on any socket	The run is on the `governed` profile. Use `provider_request()` rather than a direct connection.
A request hangs until the run is cancelled	No client timeout. Set one, and confirm the destination is a public IPv4 address.
A webhook or OAuth callback never arrives	Nothing can connect into the sandbox. Poll the provider, or receive the callback through a Panels source.

How It Works

Notebooks

Visualization

Data

Automation

Reliability

AI

What works

Call a public API

Read from a public database

Declare a dependency

What does not work

Profile differences

Timeouts

Why IPv6 is not enabled

Troubleshooting

​What works

​Call a public API

​Read from a public database

​Declare a dependency

​What does not work

​Profile differences

​Timeouts

​Why IPv6 is not enabled

​Troubleshooting

​Related resources

What works

Call a public API

Read from a public database

Declare a dependency

What does not work

Profile differences

Timeouts

Why IPv6 is not enabled

Troubleshooting

Related resources