Create a Sandbox - IDYL Docs

Use a Sandbox when you need a disposable Linux environment inside an IDYL subnet. Every Sandbox has a required TTL. IDYL removes the Sandbox after the TTL expires unless you delete it earlier.

1. Create a Sandbox

Create a Sandbox from an image, TTL, and subnet:

idyl create sandbox --image ubuntu:24.04 --ttl 2h --subnet <subnet>

If you omit --name, the CLI generates a concrete Sandbox name before creating the resource. Output similar to:

✓ Sandbox ubuntu-24-04-sandbox-a1b2c3 created
  ubuntu:24.04 · subnet <subnet>

Use --name when you want to choose the resource name:

idyl create sandbox --name dev --image ubuntu:24.04 --ttl 2h --subnet <subnet>

TTL values are duration strings such as 15m, 2h, or 24h.

2. Request an isolation class

Use --isolation-class when the target subnet allows the requested isolation class:

idyl create sandbox \
  --name dev \
  --image ubuntu:24.04 \
  --ttl 2h \
  --subnet <subnet> \
  --isolation-class secure-container

Supported values are container, secure-container, and microvm. Use secure-container for untrusted code: the Sandbox’s system calls are served by an application kernel instead of the host kernel. Use microvm when the Sandbox needs its own guest kernel; it is in preview and requires provider nodes on hosts with KVM. The value maps to the Sandbox pod template and must be admitted by the target subnet. For the guarantee each class gives, see Workload isolation.

3. Inspect Sandboxes

List Sandboxes in the current namespace:

idyl get sandboxes

Inspect one Sandbox:

idyl get sandbox dev

When available, Sandbox status includes the associated pod for the environment. Use structured output when a script needs the resource:

idyl get sandbox dev -o yaml

4. Apply a Sandbox manifest

Use a manifest when the Sandbox definition should be repeatable. Manifest workflows require metadata.name.

kind: Sandbox
metadata:
  name: dev
  subnet: <subnet>
spec:
  ttl: 2h
  template:
    spec:
      containers:
        - name: main
          imageURI: ubuntu:24.04
          command: ["sleep", "infinity"]
      isolation:
        class: secure-container

Apply the manifest:

idyl apply -f sandbox.yaml

You can also provide the subnet for one command:

idyl apply -f sandbox.yaml --subnet <subnet>

5. Delete the Sandbox

Delete a Sandbox before its TTL expires:

idyl delete sandbox dev

​1. Create a Sandbox

​2. Request an isolation class

​3. Inspect Sandboxes

​4. Apply a Sandbox manifest

​5. Delete the Sandbox

​Related pages

1. Create a Sandbox

2. Request an isolation class

3. Inspect Sandboxes

4. Apply a Sandbox manifest

5. Delete the Sandbox

Related pages