emma_s
Databricks Employee
Databricks Employee

‎12-23-2025 07:31 AM

Hi,

Here are some troubleshooting steps:

1. Network Connectivity Configuration (NCC)

  • Confirm that the correct NCC (such as ncc_public_internet) is attached specifically to Serverless compute, not just to SQL Warehouses or other resources.
  • After making changes, allow several minutes for NCC propagation. Sometimes settings take time to apply.

2. Network Policies & Workspace Settings

  • Check whether workspace-level network policies restrict serverless notebook egress to the internet.
  • Review unified network policies (IAM roles, security groups, VPC endpoints) associated with your workspace for restrictions especially affecting serverless compute resources.
  • Ensure there are no workspace-level blocklists for outbound traffic, particularly for public DNS (UDP 53) or HTTP/HTTPS ports (TCP 80/443).

3. Serverless Egress Controls

  • Validate that serverless notebooks are allowed to make external outbound requests via public internet—some workspaces restrict egress for compliance.
  • Confirm that there are no workspace or admin settings that disable “Serverless Workspace egress to public internet.”
  • For Unity Catalog-enabled workspaces, verify egress settings within UC context, as newer workspace configurations sometimes require explicit enablement.

4. DNS Configuration

  • Some organizations use custom DNS resolvers or private DNS, which may block serverless resources from reaching the public DNS.
  • Check that public DNS resolution (e.g., Google’s 8.8.8.8, AWS’s default) is available, and that your workspace isn’t explicitly configured to use a resolver without internet access.

5. Workspace Isolation/Security Features

  • Inspect whether workspace “secure access” or “private link” features are enabled, as these may block all internet or DNS traffic unless explicitly permitted.
  • If PrivateLink or VPC-only network models are in use, ensure there are allowed egress rules.

6. Test Alternative Outbound Methods

  • As a diagnostic, attempt DNS resolution with different libraries (e.g., using socket.gethostbyname("www.google.com") or through ping) to determine if DNS works at all, or whether any outbound traffic is possible.
  • Try accessing other common endpoints besides Google (e.g., http://example.com)—sometimes specific domains are blocked but not all traffic.
0 Kudos