Add network isolation via ALLOWED_CIDRS and BLOCK_NETWORK

Configurable outbound CIDR allowlist and full network blocking
for sandbox isolation. Update DEPLOY.md with GPU and network
configuration docs.

Author: manascb1344

DEPLOY.md

@@ -55,8 +55,7 @@ This guide outlines the steps to deploy this project using Modal.
       WEBHOOK_SECRET=your_webhook_secret_here \
       ALLOWED_REPOS="owner/repo1,owner/repo2" \
       RUNNER_VERSION="2.311.0" \
-      RUNNER_GROUP_ID="1" \
-      RUNNER_LABELS='["self-hosted", "modal"]'
+      RUNNER_GROUP_ID="1"
     ```
 
 5.  **Deploy the app:**
@@ -78,6 +77,14 @@ This guide outlines the steps to deploy this project using Modal.
     runs-on: [self-hosted, modal]
     ```
 
+    **GPU jobs:** Add a `gpu:` label to request GPU acceleration.
+
+    ```yaml
+    runs-on: [self-hosted, modal, gpu:t4]
+    ```
+
+    Supported GPU types: `gpu:t4`, `gpu:l4`, `gpu:a100`, `gpu:a100-80gb`, `gpu:h100`
+
 ### ⚠️ Security Considerations
 
 *   **Trust Model:** This runner executes with root privileges in isolated Modal sandboxes. Only allow trusted repositories via `ALLOWED_REPOS`.
@@ -101,7 +108,9 @@ Every time a job is queued, Modal will spawn an ephemeral sandbox that runs the
 | `GITHUB_TOKEN` | Yes | - | GitHub PAT for runner registration |
 | `WEBHOOK_SECRET` | Yes | - | Secret for webhook signature validation |
 | `ALLOWED_REPOS` | No | (all) | Comma-separated allowlist of `owner/repo` |
-| `RUNNER_VERSION` | No | `2.311.0` | GitHub Actions runner version |
+| `RUNNER_VERSION` | No | `2.333.1` | GitHub Actions runner version |
 | `RUNNER_GROUP_ID` | No | `1` | Runner group ID |
-| `RUNNER_LABELS` | No | `["self-hosted", "modal"]` | JSON array of runner labels |
+| `MAX_CONCURRENT_PER_REPO` | No | (unlimited) | Max concurrent sandboxes per repo |
+| `ALLOWED_CIDRS` | No | (allow all) | Comma-separated CIDR ranges for outbound |
+| `BLOCK_NETWORK` | No | `false` | Fully isolate sandbox network |
 | `GITHUB_ENTERPRISE_DOMAIN` | No | - | Custom domain for GitHub Enterprise |

app.py

@@ -101,6 +101,10 @@ def format(self, record: logging.LogRecord) -> str:
     "h100": "H100",
 }
 
+ALLOWED_CIDRS_STR = os.environ.get("ALLOWED_CIDRS", "")
+ALLOWED_CIDRS = [c.strip() for c in ALLOWED_CIDRS_STR.split(",") if c.strip()] if ALLOWED_CIDRS_STR else None
+BLOCK_NETWORK = os.environ.get("BLOCK_NETWORK", "").lower() in ("true", "1", "yes")
+
 
 def _get_gpu_config(gpu_key: str):
     attr_name = GPU_LABEL_TO_ATTR.get(gpu_key)
@@ -673,6 +677,8 @@ async def github_webhook(request: Request):
             timeout=TIMEOUT_SECONDS,
             env={"GHA_JIT_CONFIG": jit_config},
             gpu=gpu_config,
+            cidr_allowlist=ALLOWED_CIDRS,
+            block_network=BLOCK_NETWORK,
             experimental_options={"enable_docker": True},
         )