Diagnosing sbx sandboxes

Start here, because it settles most of them in one command:

sbx policy log        # what was blocked, and by which rule
sbx diagnose          # everything needed to file a good bug

Fixing what you find usually means editing a kit — see creating-sbx-kits — or the image, see creating-sbx-templates.

The proxy is the whole model

Every packet leaves through a host-side proxy that enforces policy and injects credentials. Configuring the network is configuring the proxy, and most network problems are proxy problems.