Gateway
The sandbox gateway enforces data-plane policy per sandbox.
- Per-sandbox token: the controller mints a Secret for each sandbox; clients present it to the gateway. See Install: Per-Sandbox Token.
- Egress policy: the gateway allowlists hosts and egress according to the sandbox spec.
- Separation: Imp remains the VM runtime; the gateway does not bypass
ImpVMorImpNetwork.
See Sandbox Overview and Install.