Networking

Exposing Ports

You can expose TCP ports to the outside world by specifying the ports you want to expose in the ports parameter.

ports accepts a list, so you can expose multiple ports too.

In the example below, we expose two ports:

• 8888 for a Jupyter Notebook server
• 3000 for a separate application or web server

from beam import Image, Pod

pod = Pod(
    image=Image(base_image="jupyter/base-notebook:latest"),
    ports=[8888, 3000],
    entrypoint=["start-notebook.py"],
)

Once your Pod is running, both ports will be available at a public URL.

Network Security

Blocking Outbound Traffic

You can block all outbound network access from your Pod while still allowing inbound connections to exposed ports. This is useful for security-sensitive workloads that shouldn’t communicate with external services.

from beam import Image, Pod

pod = Pod(
    image=Image(base_image="python:3.11-slim"),
    ports=[8000],
    block_network=True,  # Block all outbound traffic
    entrypoint=["python", "-m", "http.server", "8000"],
)

With block_network=True, the Pod can receive requests on exposed ports but cannot make outbound connections to external services.

Allow Lists

Allow only specific hostnames, wildcard domains, IPs or CIDRs. All other outbound destinations are blocked.

from beam import Image, Pod

pod = Pod(
    image=Image(base_image="python:3.11-slim"),
    ports=[8000],
    allow_list=[
        "api.example.com",
        "10.0.0.0/8",      # Allow private network range
        "2001:db8::/32",   # Allow IPv6 range
    ],
    entrypoint=["python", "app.py"],
)

Allowlists accept up to 64 entries, including IPv4 and IPv6. Hostname rules govern TLS SNI on port 443/HTTP Host on port 80 and resolve on the worker; resolved private, loopback and link-local addresses are rejected. Other TCP needs IP/CIDR rules. UDP/ICMP are blocked except DNS to the configured resolver. Do not combine an explicit allow_list with block_network=True.

Static IPs

Pods are served in a static IP range, making it possible to whitelist the Beam IP range from the client.

For the static IP range, send us a message in Slack.