From d17b6f1a8be159ed0b48bf0a14ad7c5d7457578f Mon Sep 17 00:00:00 2001 From: Craig Osterhout Date: Wed, 26 Aug 2026 09:38:57 -0700 Subject: [PATCH] sbx-policy: clarify network rule port matching Signed-off-by: Craig Osterhout --- content/manuals/ai/sandboxes/governance/concepts.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/content/manuals/ai/sandboxes/governance/concepts.md b/content/manuals/ai/sandboxes/governance/concepts.md index 070d3349f31..76bab17d8b3 100644 --- a/content/manuals/ai/sandboxes/governance/concepts.md +++ b/content/manuals/ai/sandboxes/governance/concepts.md @@ -88,12 +88,12 @@ rules have no effect. **Hostname patterns** -| Pattern | Example | Matches | -| --------------------- | ----------------- | -------------------------------------------------- | -| Exact hostname | `example.com` | `example.com` only, not subdomains | -| Single-level wildcard | `*.example.com` | One subdomain level: `api.example.com` | -| Multi-level wildcard | `**.example.com` | Any depth: `api.example.com`, `v2.api.example.com` | -| Hostname with port | `example.com:443` | `example.com` on port 443 only | +| Pattern | Example | Matches | +| --------------------- | ----------------- | ------------------------------------------------------------- | +| Exact hostname | `example.com` | `example.com` on any port, not subdomains | +| Single-level wildcard | `*.example.com` | One subdomain level, any port: `api.example.com` | +| Multi-level wildcard | `**.example.com` | Any depth, any port: `api.example.com`, `v2.api.example.com` | +| Hostname with port | `example.com:443` | `example.com` on port 443 only | `example.com` and `*.example.com` don't cover each other. Specify both if you need to match the root domain and its subdomains.