Private network

​

Tailscale

1. Create a tag for Runs. In your tailnet policy file, add a tag such as tag:melso and grant it exactly what agents may reach. Access control stays in the policy: a Run can reach what the tag can reach, nothing more.
   {
     "tagOwners": {
       "tag:melso": ["autogroup:admin"]
     },
     "grants": [
       { "src": ["tag:melso"], "dst": ["tag:agent-https-service"], "ip": ["tcp:443"] }
     ]
   }
   
   Apply tag:agent-https-service only to the specific HTTPS services agents may reach. Replace it with your own restricted destination tag. Add database ports or subnet routes only when the work requires them; a subnet router must advertise any route you allow.
2. Create an OAuth client. In the Tailscale admin console, generate an OAuth client with the Auth Keys scope set to Write and the tag from step 1. Copy the client ID and the client secret (tskey-client-…); the secret is shown once.
3. Connect it. In Settings → Network, choose Connect, then Tailscale. Paste the client ID and secret, and enter the tags, separated by commas. Saving checks the client: Melso exchanges it for an access token with the auth_keys scope and your tags. If Tailscale refuses, nothing is saved and Settings shows why.

​

Headscale

1. Create a user for Runs, or use tags from your Headscale policy:
   headscale users create melso
   
2. Create a reusable, ephemeral pre-auth key with an expiry. This example uses 24 hours; choose a shorter window if practical. Add --tags tag:melso if your policy uses tags.
   headscale preauthkeys create --user <user> --reusable --ephemeral --expiration 24h
   
3. Connect it. In Settings → Network, choose Connect, then Headscale. Enter the login server as an HTTPS origin with no path, such as https://headscale.example.com, and paste the key.

​

What a Run gets

• The Run’s worker joins the network before any harness, checkout step or skill runs, and leaves it when the Run completes, fails or is cancelled.
• Each Run is its own ephemeral device named melso- followed by the first eight characters of the Run ID. On Tailscale it carries the configured tags; the control plane removes the device after the Run.
• Subnet routes are accepted and MagicDNS names resolve by default. Turn off Accept subnet routes or Use network DNS in Settings to change that.
• Kernel mode is used when the sandbox allows it (a TUN device and passwordless sudo): every program reaches the network transparently. Otherwise the worker falls back to userspace networking and points the harness at a local HTTP and SOCKS5 proxy on 127.0.0.1:1055 through ALL_PROXY, HTTP_PROXY and HTTPS_PROXY. Only programs that honor those variables reach the network then. The Run’s brief says which mode applies.
• A Run that cannot join fails before its harness starts, with failure_reason private_network_unavailable and “This task could not join the company network.” It never runs half-connected. Check the credential, its tags and the tailnet policy, and the Last error in Settings.

​

Limits

• One network per company.
• Corporate VPNs that require interactive sign-in, MFA or device posture checks (Cisco AnyConnect, GlobalProtect, Zscaler, Fortinet) cannot enroll a sandbox. Run those tasks on a worker inside the company network instead.
• In userspace mode, programs that ignore proxy variables cannot reach the network.

​

Settings API

​

API reference