Deno "Requires net access" (--allow-net) in CI

By Kaveh Alemi·Latchkey

Deno runs with no permissions by default. Code that opens a network connection fails until you grant --allow-net (optionally scoped to specific hosts). This is the sandbox working as designed.

What this error means

A script fails at runtime with "PermissionDenied: Requires net access to <host>, run again with the --allow-net flag". In CI (non-interactive) there is no prompt, so it just errors.

error: Uncaught (in promise) PermissionDenied: Requires net access to "api.example.com",
run again with the --allow-net flag
    at ... fetch ("https://api.example.com/...")

Common causes

Network permission not granted

Deno’s default-deny sandbox blocks network access until --allow-net is passed. The code is fine; the permission is missing.

No interactive prompt in CI

Locally Deno can prompt to grant access; in CI it is non-interactive, so an ungranted permission is a hard failure.

How to fix it

Grant scoped network access

Pass --allow-net, ideally limited to the hosts you actually call.

deno run --allow-net=api.example.com main.ts
# or define it in a task so CI uses the same flags:
# "tasks": { "start": "deno run --allow-net=api.example.com main.ts" }

Encode permissions in the task

1. Put the exact --allow-* flags in the deno.json task so local and CI match.
2. Avoid -A (all permissions) in production tasks; grant the minimum needed.
3. List every host the job contacts in the --allow-net scope.

How to prevent it

• Grant the minimum scoped permissions, not blanket -A.
• Encode --allow-* flags in the deno.json task.
• Document which hosts a task needs so the scope stays accurate.

Frequently asked questions

Related guides

References

• GitHub Actions documentation