Users can set the environment variable DRAKE_ALLOW_NETWORK to a colon-separated list to limit which components are permitted network access.

If DRAKE_ALLOW_NETWORK is unset or set to the empty string, then all networking is allowed.

The component values supported by Drake are:

lcm (see drake::lcm::DrakeLcm)
meshcat (see drake::geometry::Meshcat)
package_map (see drake::multibody::PackageMap)
render_gltf_client (see drake::geometry::MakeRenderEngineVtk())

... as well as the special value none.

The environment variable only governs the network access of the component. If the component also supports other mechanisms (e.g., files or memory buffers) those are unaffected.

For example, to allow only lcm and meshcat, run this command in your terminal:

export DRAKE_ALLOW_NETWORK=lcm:meshcat

To disable all networking, run this command in your terminal:

export DRAKE_ALLOW_NETWORK=none