# Cloud security

This page describes the security model of cmux Cloud machines: what isolates a machine, where credentials live, and how to limit what a machine can reach on the network.

## Isolation

Each machine is a microVM with its own Linux kernel. It is not a container on a shared kernel.

You have passwordless root in the machine by design. The VM is the security boundary, not the user account in it. Every process in the machine, including an agent, can do what root can do there.

Recreating a machine resets its home directory. Recreate a machine to return it to a known state.

## Credentials

Model credentials for CodeRouter never enter the machine. The cmux Cloud TLS edge adds them to requests after the requests leave the machine. The provider stores these header values write-only, so nobody can read them back after cmux sets them.

Attach credentials, which let a client open a session on the machine, are short-lived and scoped to one machine and one session.

## Port previews

Port previews go over your private WireGuard network. They have no public URL. Only devices on your private network can open them.

## Outbound network policy

Each machine has an outbound network policy. Set it with the Network control on the [Cloud dashboard](https://cmux.com/dashboard/cloud). Changes apply to a running machine live, with no restart.

### Modes

-   **Full internet**: the machine can reach any public address. This is the default.
-   **Allowlist**: the machine can reach only the presets, domains, and IP ranges you list, plus the always-allowed cmux hosts.
-   **No internet**: the machine can reach only the always-allowed cmux hosts.

### Domain rules

A domain rule matches one exact host name. api.example.com does not match example.com or other subdomains. Wildcards are not supported yet.

Domain rules allow HTTPS on port 443 only.

The platform steers each allowed name to the provider's TLS edge through the machine's /etc/hosts file. A domain rule works with no DNS and no IP range.

Traffic that does not use /etc/hosts is not steered. Examples are containers with their own DNS resolver and tools that pin TLS certificates. That traffic cannot reach the domain unless an IP range allows it.

Presets add groups of exact names for common services: Anthropic, OpenAI, OpenRouter, OpenCode, GitHub, npm, PyPI, and Rust. cmux keeps the name lists current, and an update reaches every machine that uses the preset. Review what a preset adds before you turn it on.

### IP ranges

An IP range is an IPv4 or IPv6 CIDR block, optionally narrowed to one port and protocol. The provider firewall enforces IP ranges outside the machine, so root in the machine cannot remove them.

### DNS

In Allowlist mode, you can allow DNS so that tools can resolve the names that your IP ranges point at. Domain rules do not need DNS.

Open DNS is an outbound channel. A process can put data in the names it looks up, and resolvers forward those lookups to the servers for that domain. Turn DNS off when the machine runs code you do not trust.

### Mail ports

The platform always blocks outbound mail ports 25, 465, and 587, in every mode.

### Always-allowed hosts

Every mode allows the hosts that cmux needs to install and update the CLI and the coding agents in the machine:

-   `files.cmux.com`
-   `github.com`
-   `api.github.com`
-   `objects.githubusercontent.com`
-   `release-assets.githubusercontent.com`

Without these hosts, a machine in Allowlist or No internet mode could not get its cmux tools or agent updates.

## Hardening checklist

-   Use Allowlist mode for repositories you do not trust. Add only the presets and domains the work needs.
-   Keep secrets out of the repository and out of the machine. Every process in the machine can read what is in it.
-   Prefer edge-injected credentials, such as CodeRouter, to API keys stored in the machine.
-   Review presets before you turn them on, and remove presets that a machine no longer needs.
-   In Allowlist mode, keep DNS off unless an IP range needs it.
-   Recreate a machine to reset its state after it runs code you do not trust.

## Limits

-   There are no egress logs yet. You cannot see which connections a machine made or which connections the policy blocked.
-   Wildcard domains are not supported yet. List each exact name.
-   There is no team-wide enforced policy yet. Each machine has its own policy.
-   The always-allowed hosts include github.com, so No internet mode does not block HTTPS to github.com.
-   Domain rules do not cover traffic that bypasses /etc/hosts or pins certificates.

Canonical: https://cmux.com/docs/cloud-security

Documentation index: https://cmux.com/llms.txt