Skip to main content
Use a Sandbox when you need a disposable Linux environment inside an IDYL subnet. Every Sandbox has a required TTL. IDYL removes the Sandbox after the TTL expires unless you delete it earlier.

1. Create a Sandbox

Create a Sandbox from an image, TTL, and subnet:
If you omit --name, the CLI generates a concrete Sandbox name before creating the resource. Output similar to:
Use --name when you want to choose the resource name:
TTL values are duration strings such as 15m, 2h, or 24h.

2. Request an isolation class

Use --isolation-class when the target subnet allows the requested isolation class:
Supported public values are container and microvm. The value maps to the Sandbox pod template and must be admitted by the target subnet.

3. Inspect Sandboxes

List Sandboxes in the current namespace:
Inspect one Sandbox:
When available, Sandbox status includes the associated pod for the environment. Use structured output when a script needs the resource:

4. Apply a Sandbox manifest

Use a manifest when the Sandbox definition should be repeatable. Manifest workflows require metadata.name.
Apply the manifest:
You can also provide the subnet for one command:

5. Delete the Sandbox

Delete a Sandbox before its TTL expires: