[sundy-li]

Summary

• Add host-controlled WorkerCommand::allow_network, defaulting to false, to provide a temporary compatibility path for existing network-dependent Python UDFs without disabling the mandatory Linux sandbox.
• Pass the policy separately from function metadata in the startup frame; an absent policy remains deny-by-default. Permit IPv4/IPv6 stream/datagram clients and read-only resolver/public CA data only when enabled, including public CA symlink targets and configured SSL certificate paths.
• Retain filesystem/process confinement and deny Unix/raw sockets and bind/listen. This is not a destination allowlist: loopback/internal services are reachable when enabled, subject to deployment egress policy. Hosts must keep this policy administrator-controlled.
• Tests: cargo test -p arrow-udf-python-worker (7 unit tests and real Linux worker coverage), cargo clippy -p arrow-udf-python-worker --all-targets -- -D warnings, formatting and diff checks passed. Coverage includes omitted-policy compatibility, socket types/families, preserved restrictions, local DNS/HTTP and public CA loading.
• Companion Databend PR: feat(query): add admin Python UDF network exception databendlabs/databend#20874 wires the administrator configuration and SQL regression coverage; its dependency is pinned to cc08c3e538f8347545540020dc289cc498c7d3e5. Merge this dependency PR first.

AI assistance

• AI usage: An AI coding agent drafted the worker policy, tests, documentation and PR description; the responsible human reviewed the complete diff before submission.
• Responsible human: @sundy-li
• The responsible human has read every line of this diff and can explain each change