> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/network-requirements.md).

# Network requirements

All Seal traffic is outbound HTTPS to seal-owned hostnames. If your environment uses a firewall, egress proxy, or strict network policy, allow-list the hostnames below. There is no inbound traffic from Seal into your environment.

You can also allow-list the parent domain (`*.sealsecurity.io`) and any AWS CloudFront edges, which is functionally equivalent and easier to maintain. The per-hostname list is provided for environments that require specific entries.

## Always required

| Domain                          | Purpose                              |
| ------------------------------- | ------------------------------------ |
| `app.sealsecurity.io`           | The Seal UI.                         |
| `authorization.sealsecurity.io` | Authentication and token validation. |
| `d2zko6i8myndc4.cloudfront.net` | UI assets.                           |
| `d2yf0nsg4eo6kr.cloudfront.net` | UI assets.                           |
| `d1xflzzelmcieu.cloudfront.net` | Generated reports.                   |

## When the Seal CLI runs

Hosts that run the Seal CLI (CI runners, build agents, developer machines) additionally need:

| Domain                | Purpose                                                                |
| --------------------- | ---------------------------------------------------------------------- |
| `cli.sealsecurity.io` | CLI configuration, Sealing Rule retrieval, and project initialization. |

## When pulling sealed packages

Anywhere sealed package artifacts are actually fetched (your CI build, a host running `seal fix --os`, a mirroring proxy) needs reachability to the artifact-server hostnames for the ecosystems you consume. The list is independent of how the pull is invoked.

| Domain                      | Ecosystem                          |
| --------------------------- | ---------------------------------- |
| `npm.sealsecurity.io`       | Node.js (npm, Yarn, pnpm)          |
| `pypi.sealsecurity.io`      | Python (pip, Poetry)               |
| `maven.sealsecurity.io`     | Java (Maven, Gradle)               |
| `go.sealsecurity.io`        | Go modules                         |
| `packagist.sealsecurity.io` | PHP (Composer)                     |
| `ruby.sealsecurity.io`      | Ruby (RubyGems, Bundler)           |
| `nuget.sealsecurity.io`     | .NET (NuGet)                       |
| `rpm.sealsecurity.io`       | RHEL, CentOS, Fedora, Amazon Linux |
| `deb.sealsecurity.io`       | Debian, Ubuntu                     |
| `apk.sealsecurity.io`       | Alpine Linux                       |

## When pulling sealed container images

Hosts that pull sealed container images (Seal Base Images, Seal My Container output, Seal Vendor Apps output) need reachability to the Seal-issued **registry hostname** for your tenant. Your Seal account team provides this hostname; it differs per tenant.

See [Authenticating with Seal's image registry](/setup-containers/seal-base-images/authenticating.md).

## Related

* [Choosing your deployment method](/setup-apps-os/choosing-deployment-method.md)