Server-side wait budget in seconds; valid only with wait_for.
Required range: x >= 0
Body
application/json
Option 1
Option 2
Option 3
Option 4
What the user sends in POST /v1/sandboxes.
The body carries the shared microsandbox [CloudCreateSandboxRequest] union.
Its source-specific and common [CloudSandboxSpec] fields stay flat on the
wire beside the cloud-only SSH slug and registry-credential selection.
Registry-credential selection for the image pull. Absent ⇒ Auto
(infer the credential from the image's registry host). Credential-only:
this never changes where the image is pulled from - the image string
controls that - only which stored credential, if any, is presented.
Optional globally-unique slug - the SSH username token. Lowercase
letters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary
slug is generated. Must be globally unique (409 on conflict).
{"docsConfig":{"theme":"maple","$schema":"https://mintlify.com/docs.json","name":"microsandbox","description":"Easy, fast microVMs for untrusted workloads, on your machine or in the cloud","colors":{"primary":"#BF84FE","light":"#BF84FE","dark":"#BF84FE"},"logo":{"light":"https://mintcdn.com/superradcompanyinc/h2JI9gRxoad-oxxo/images/microsandbox-banner-light.svg?fit=max\u0026auto=format\u0026n=h2JI9gRxoad-oxxo\u0026q=85\u0026s=b45f81c0c0786037c520040351776f0c","dark":"https://mintcdn.com/superradcompanyinc/h2JI9gRxoad-oxxo/images/microsandbox-banner-dark.svg?fit=max\u0026auto=format\u0026n=h2JI9gRxoad-oxxo\u0026q=85\u0026s=a19d15bf347ffed562357e83a8e47e57","href":"https://microsandbox.dev"},"favicon":"https://mintcdn.com/superradcompanyinc/acZNVSWndEYxkwDF/logo/favicon.png?fit=max\u0026auto=format\u0026n=acZNVSWndEYxkwDF\u0026q=85\u0026s=8bc5e2cfbfa18635f6aff80ba2b42a3b","appearance":{"default":"system"},"navbar":{"primary":{"type":"github","href":"https://github.com/superradcompany/microsandbox"}},"footer":{"socials":{"github":"https://github.com/superradcompany/microsandbox","discord":"https://discord.gg/T95Y3XnEAK","linkedin":"https://www.linkedin.com/company/superradcompany","x":"https://x.com/microsandbox"}},"seo":{"organization":{"id":"https://microsandbox.dev/#organization","name":"microsandbox","url":"https://microsandbox.dev","sameAs":["https://github.com/superradcompany/microsandbox","https://www.linkedin.com/company/superradcompany","https://x.com/microsandbox"]}},"integrations":{"posthog":{"apiKey":"phc_mMJPTEQbarHl4JMTdFBcgw5v612dmQrvKv5mcK3KJ3O","apiHost":"https://g.microsandbox.dev"}},"thumbnails":{"appearance":"dark","background":"https://mintcdn.com/superradcompanyinc/M0SEbicZwCrDiLn2/images/og-background.png?fit=max\u0026auto=format\u0026n=M0SEbicZwCrDiLn2\u0026q=85\u0026s=8ada316c199c838c0d675c4573563b9c"},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"superradcompanyinc","hasAudioNarration":false,"actualSubdomain":"superradcompanyinc","customDomains":["docs.microsandbox.dev"],"gitSource":{"type":"github","owner":"superradcompany","repo":"microsandbox","deployBranch":"mintlify","contentDirectory":"docs","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ae0ab6c0a4e18d2a6baef66","collectionId":"a28577f8-feda-4f4c-9dd7-9ebcef0dfdb4","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ae0ab6c0a4e18d2a6baef66"},"feedback":{"thumbs":true,"agentFeedback":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ae0ab6c0a4e18d2a6baef66","clientVersion":"0.0.4043","searchFilterCounts":[{"language":"default","tag":"API Reference","count":124},{"language":"default","tag":"How-to guides","count":82},{"language":"default","tag":"Personal tokens","count":74},{"language":"default","tag":"SDKs \u0026 CLI","count":73},{"language":"default","tag":"SDKs","count":59},{"language":"default","tag":"API keys","count":49},{"language":"default","tag":"Changelog","count":38},{"language":"default","tag":"Sandboxes","count":38},{"language":"default","tag":"Volumes","count":31},{"language":"default","tag":"Documentation","count":30}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true,"deflection":{"enabled":true,"email":"engineering@microsandbox.dev"}},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","content":"body{font-size:12px}nav[aria-label=Pages] a>div:has(>img[src*=\"/images/recipes/agents/\"]){width:1rem;background-color:#9ca3af;-webkit-mask-image:var(--msb-agent-icon);-webkit-mask-position:center;-webkit-mask-repeat:no-repeat;-webkit-mask-size:1rem 1rem;mask-image:var(--msb-agent-icon);mask-position:center;mask-repeat:no-repeat;mask-size:1rem 1rem}.dark nav[aria-label=Pages] a>div:has(>img[src*=\"/images/recipes/agents/\"]){background-color:#6b7280}nav[aria-label=Pages] a[aria-current=page]>div:has(>img[src*=\"/images/recipes/agents/\"]){background-color:#bf84fe}#table-of-contents-content li[data-msb-expanded=false]>ul,.msb-guide-group li::before,nav[aria-label=Pages] img[src*=\"/images/recipes/agents/\"]{display:none}nav[aria-label=Pages] a>div:has(>img[src*=\"/claude-code.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/claude-code.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/codex.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/codex.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/opencode.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/opencode.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/openclaw.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/openclaw.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/goose.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/goose.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/gemini-cli.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/gemini-cli.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/hermes-agent.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/hermes-agent.svg\")}nav[aria-label=Pages] a>div:has(>img[src*=\"/pi.svg\"]){--msb-agent-icon:url(\"/images/recipes/agents/pi.svg\")}@media (min-width:1280px){#content-area{max-width:72rem!important;width:calc(100% - 20rem)!important}}:root{--msb-code-surface:#fdfbff;--msb-code-surface-strong:#faf5ff;--msb-code-border:rgba(109, 75, 196, 0.16);--msb-code-header:#f6efff;--msb-code-header-hover:#f0e4ff;--msb-code-header-text:#5f3caf;--msb-code-control-surface:rgba(246, 239, 255, 0.22);--msb-code-control-surface-hover:rgba(240, 228, 255, 0.38);--msb-code-control-icon:rgba(95, 60, 175, 0.72);--msb-code-control-icon-hover:#5f3caf;--msb-interactive-accent:rgba(109, 75, 196, 0.42);--msb-code-fade-10:rgba(255, 255, 255, 0.06);--msb-code-fade-25:rgba(255, 255, 255, 0.14);--msb-code-fade-35:rgba(255, 255, 255, 0.24);--msb-code-fade-45:rgba(255, 255, 255, 0.34)}.dark{--msb-code-surface:#171221;--msb-code-surface-strong:#1b1428;--msb-code-border:rgba(191, 132, 254, 0.24);--msb-code-header:#211832;--msb-code-header-hover:#2a1d40;--msb-code-header-text:#d8c0ff;--msb-code-control-surface:rgba(33, 24, 50, 0.22);--msb-code-control-surface-hover:rgba(42, 29, 64, 0.38);--msb-code-control-icon:rgba(216, 192, 255, 0.72);--msb-code-control-icon-hover:#d8c0ff;--msb-interactive-accent:rgba(191, 132, 254, 0.52);--msb-code-fade-10:rgba(11, 12, 14, 0.06);--msb-code-fade-25:rgba(11, 12, 14, 0.14);--msb-code-fade-35:rgba(11, 12, 14, 0.24);--msb-code-fade-45:rgba(11, 12, 14, 0.34)}.msb-platform-strip{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:1px;overflow:hidden;margin:.75rem 0 1.5rem;border:1px solid rgba(109,75,196,.16);border-radius:.75rem;background:rgba(109,75,196,.16)}.msb-platform-strip-three{grid-template-columns:repeat(3,minmax(0,1fr))}.msb-platform-item{display:flex;min-width:0;align-items:center;gap:.625rem;padding:.7rem .8rem;color:inherit;background:#fff;text-decoration:none}.msb-platform-icon{display:grid;flex:0 0 1.25rem;width:1.25rem;place-items:center;color:#a770ef}.msb-platform-copy{display:grid;min-width:0;line-height:1.2}.msb-platform-copy strong{font-size:.84rem;font-weight:650}.msb-platform-copy>span{overflow:hidden;margin-top:.18rem;font-size:.72rem;opacity:.65;text-overflow:ellipsis;white-space:nowrap}.msb-platform-link:hover{background:#faf5ff}.msb-platform-link{border-bottom:0!important}.msb-platform-link:focus-visible{outline:2px solid #a770ef;outline-offset:-2px}.dark .msb-platform-strip{border-color:rgba(191,132,254,.2);background:rgba(191,132,254,.2)}.dark .msb-platform-item{background:#111014}.dark .msb-platform-link:hover{background:#1b1428}@media (max-width:760px){.msb-platform-strip{grid-template-columns:repeat(2,minmax(0,1fr))}}@media (max-width:420px){.msb-platform-strip{grid-template-columns:1fr}}.msb-examples-cta{display:grid;grid-template-columns:auto minmax(0,1fr) auto;align-items:center;gap:.9rem;margin:1.25rem 0 2rem;padding:.9rem 1rem;border:1px solid var(--msb-code-border)!important;border-radius:.9rem;color:inherit;background:linear-gradient(135deg,rgba(167,112,239,.09),rgba(167,112,239,.025) 62%,transparent);box-shadow:0 1px 2px rgba(49,31,83,.04);font-weight:400;text-decoration:none;transition:border-color 90ms ease-out,box-shadow 90ms ease-out}.msb-examples-cta:hover{border-color:var(--msb-interactive-accent)!important;box-shadow:0 3px 10px rgba(78,45,132,.07)}.msb-examples-cta:focus-visible{outline:2px solid #a770ef;outline-offset:3px}.msb-examples-cta-icon{display:grid;width:2.35rem;height:2.35rem;place-items:center;border:1px solid rgba(109,75,196,.18);border-radius:.7rem;color:#8f5cda;background:rgba(255,255,255,.72)}.msb-examples-cta-copy{display:grid;min-width:0;line-height:1.25}.msb-examples-cta-label{margin-bottom:.15rem;color:#8f5cda;font-size:.65rem;font-weight:650;letter-spacing:.07em;text-transform:uppercase}.msb-examples-cta-title{font-size:.93rem;font-weight:500}.msb-examples-cta-copy>span:last-child{overflow:hidden;margin-top:.2rem;font-size:.78rem;font-weight:400;opacity:.68;text-overflow:ellipsis;white-space:nowrap}.msb-examples-cta-action{display:inline-flex;align-items:center;gap:.4rem;color:#7b4bc2;font-size:.78rem;font-weight:600;white-space:nowrap}.msb-examples-cta:hover .msb-examples-cta-action{color:#62349f}.dark .msb-examples-cta{background:linear-gradient(135deg,rgba(191,132,254,.12),rgba(191,132,254,.035) 62%,transparent);box-shadow:0 1px 2px rgba(0,0,0,.22)}.dark .msb-examples-cta:hover{box-shadow:0 3px 10px rgba(0,0,0,.24)}.dark .msb-examples-cta-icon{border-color:rgba(191,132,254,.24);color:#c9a4ff;background:rgba(27,20,40,.82)}.dark .msb-examples-cta-action,.dark .msb-examples-cta-label{color:#c9a4ff}.dark .msb-examples-cta:hover .msb-examples-cta-action{color:#dfc9ff}@media (max-width:640px){.msb-examples-cta{grid-template-columns:auto minmax(0,1fr)}.msb-examples-cta-copy>span:last-child{white-space:normal}.msb-examples-cta-action{grid-column:2}}@media (prefers-reduced-motion:reduce){.msb-examples-cta{transition:none}}.msb-backref a,.msb-type{border-bottom:0!important}h4:has(.msb-hn){margin-top:5rem!important}.msb-backref+h4:has(.msb-hn),.msb-member-group+h4:has(.msb-hn),h2+div+h4:has(.msb-hn),h2+div+p+h4:has(.msb-hn),h2+div+p+p+h4:has(.msb-hn),h2+div+p+span+h4:has(.msb-hn),h2+div+span+h4:has(.msb-hn),h2+h4:has(.msb-hn),h2+p+h4:has(.msb-hn),h2+p+p+h4:has(.msb-hn),h2+p+span+h4:has(.msb-hn),h2+span+h4:has(.msb-hn),h3+h4:has(.msb-hn){margin-top:1.5rem!important}.msb-hn,.msb-recv{font-family:var(--font-mono, monospace);font-weight:500}.msb-recv{font-weight:400;color:#a3a29c}.dark .msb-recv{color:#6f6e68}.msb-member-group{margin:3rem 0 .75rem;font-size:.875rem;font-weight:650;letter-spacing:.02em;opacity:.72}h2+.msb-member-group{margin-top:1.5rem}#table-of-contents-content li:has(>.msb-toc-toggle){position:relative}#table-of-contents-content .msb-toc-toggle{position:absolute;z-index:1;top:.2rem;left:-1.35rem;display:grid;width:1.25rem;height:1.25rem;place-items:center;border:0;padding:0;color:inherit;opacity:.75;background:0 0;cursor:pointer}#table-of-contents-content .msb-toc-toggle:focus-visible,#table-of-contents-content .msb-toc-toggle:hover{opacity:1}#table-of-contents-content .msb-toc-toggle span{width:.42rem;height:.42rem;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform 120ms ease}#table-of-contents-content .msb-toc-toggle[aria-expanded=true] span{transform:rotate(45deg) translate(-.08rem,-.08rem)}.msb-type{color:#6d4bc4}.dark .msb-type{color:#c9a4ff}.msb-label{font-size:11px;font-weight:600;letter-spacing:.05em;text-transform:uppercase;opacity:.55;margin:16px 0 6px}.msb-params{margin:4px 0 0;display:grid;grid-template-columns:minmax(170px,min(34%,320px)) minmax(0,1fr);column-gap:18px}.msb-param{display:grid;grid-template-columns:subgrid;grid-column:1/-1;row-gap:4px;padding:9px 0;border-top:1px solid rgba(135,134,128,.18)}.msb-param-key code{font-size:13px}.msb-param-key .msb-type{font-size:12px;display:inline-block;margin-top:3px;margin-left:6px}.msb-param-desc{font-size:14px;opacity:.85}.msb-backref{font-size:13px;opacity:.7;margin:4px 0 12px}.msb-backref a{font-family:var(--font-mono, monospace);font-size:12.5px;text-decoration:none}:has(>table){overflow-x:auto;max-width:100%}table{table-layout:auto}table td,table th{vertical-align:top}table td{max-width:48ch}table td code,table th code{white-space:nowrap}.code-block,.code-group{border-color:var(--msb-code-border)!important}.code-block-background[data-component-part=code-block-root],html.dark body .code-block-background[data-component-part=code-block-root]{background-color:var(--msb-code-surface)!important}#pagination,.code-group{background-color:var(--msb-code-surface-strong)!important}.code-group [data-component-part=code-group-tab-bar] [role=tab]>div:first-child{transition:background-color 120ms ease,color 120ms ease}.code-group [data-component-part=code-group-tab-bar] [role=tab]:focus-visible>div:first-child,.code-group [data-component-part=code-group-tab-bar] [role=tab]:hover>div:first-child{background-color:var(--msb-code-header-hover)!important;color:var(--msb-code-header-text)!important}.tabs [data-component-part=tab-button][data-active=false]:hover{border-color:var(--msb-interactive-accent)!important;color:var(--msb-code-header-text)!important}.nav-tabs-item>div:last-child,.tabs [data-component-part=tab-button]{transition:border-color 120ms ease,background-color 120ms ease,color 120ms ease}.nav-tabs-item:not([data-active=true]):hover>div:last-child{background-color:var(--msb-interactive-accent)!important}.steps [data-component-part=step-number]>div{background-color:var(--msb-code-header)!important;box-shadow:inset 0 0 0 1px var(--msb-code-border);color:var(--msb-code-header-text)!important}#pagination a:hover>div:first-child{box-shadow:0 0 0 1px var(--msb-interactive-accent)!important}.accordion-group,details.accordion{background-color:var(--msb-code-surface)!important;border-color:var(--msb-code-border)!important}details.accordion>summary{background-color:var(--msb-code-header)!important;color:var(--msb-code-header-text)!important}details.accordion>summary:focus-visible,details.accordion>summary:hover{background-color:var(--msb-code-header-hover)!important}details.accordion>[data-component-part=accordion-content]{padding-top:.75rem}.code-block [data-floating-buttons=true],.code-group [data-floating-buttons=true]{z-index:2}.code-block [aria-label*=assistant i],.code-block [data-floating-buttons=true] a,.code-block [data-floating-buttons=true] button,.code-block [data-testid=copy-code-button],.code-group [aria-label*=assistant i],.code-group [data-floating-buttons=true] a,.code-group [data-floating-buttons=true] button,.code-group [data-testid=copy-code-button]{background-color:var(--msb-code-control-surface)!important;box-shadow:0 0 0 1px var(--msb-code-border);color:var(--msb-code-control-icon)!important}.code-block [aria-label*=assistant i]:hover,.code-block [data-floating-buttons=true] a:hover,.code-block [data-floating-buttons=true] button:hover,.code-block [data-testid=copy-code-button]:hover,.code-group [aria-label*=assistant i]:hover,.code-group [data-floating-buttons=true] a:hover,.code-group [data-floating-buttons=true] button:hover,.code-group [data-testid=copy-code-button]:hover{background-color:var(--msb-code-control-surface-hover)!important;color:var(--msb-code-control-icon-hover)!important}.code-block [aria-label*=assistant i] svg,.code-block [data-floating-buttons=true] svg,.code-block [data-testid=copy-code-button] svg,.code-group [aria-label*=assistant i] svg,.code-group [data-floating-buttons=true] svg,.code-group [data-testid=copy-code-button] svg{color:currentColor!important}.code-block [data-fade-overlay=true],.code-group [data-fade-overlay=true]{background-image:linear-gradient(to right,transparent 0,var(--msb-code-fade-10) 10px,var(--msb-code-fade-25) 25px,var(--msb-code-fade-35) 35px,var(--msb-code-fade-45) 45px)!important}details.accordion:has(.code-block):not(.msb-accordion-group *,.accordion-group *)>:not(summary){margin:.75rem!important}details.accordion:has(.code-block):not(.msb-accordion-group *,.accordion-group *) .code-block{margin:0!important}.code-block:has(+details.accordion:not(.msb-accordion-group *,.accordion-group *)){margin-bottom:0!important}.code-block+details.accordion:not(.msb-accordion-group *,.accordion-group *){margin-top:1rem!important}details.accordion:has(.code-block):not(.msb-accordion-group *,.accordion-group *){margin-top:.5rem!important}@media (max-width:640px){.msb-params{grid-template-columns:1fr}.msb-param{row-gap:2px}}.msb-badge-local,.msb-badge-version{display:inline-block;margin-top:-.35rem;padding:.1rem .5rem;border-radius:9999px;font-size:.7rem;font-weight:600;letter-spacing:.02em;color:#5f3caf;background:#f6efff;border:1px solid rgba(109,75,196,.25)}.dark .msb-badge-local,.dark .msb-badge-version{color:#c9b1ff;background:rgba(191,132,254,.12);border-color:rgba(191,132,254,.3)}.msb-badge-version{display:inline-flex;align-items:center;gap:.25rem}.msb-badge-version:focus-visible{outline:2px solid currentColor;outline-offset:2px}span:has(>.msb-badge-cloud),span:has(>.msb-badge-limited),span:has(>.msb-badge-local),span:has(>.msb-badge-version){text-decoration:none!important}.msb-badge-limited svg,.msb-badge-local [class*=mask],.msb-badge-local svg{display:inline-block;vertical-align:-.12em;margin-left:.1rem}.msb-badge-cloud,.msb-badge-limited{display:inline-block;margin-top:-.35rem;padding:.1rem .5rem;border-radius:9999px;font-size:.7rem;font-weight:600;letter-spacing:.02em}.msb-badge-limited{color:#8a5a00;background:#fdf6e7;border:1px solid rgba(180,120,0,.28)}.dark .msb-badge-limited{color:#e8c37a;background:rgba(232,195,122,.1);border-color:rgba(232,195,122,.28)}.msb-badge-limited [class*=mask]{display:inline-block;vertical-align:-.12em;margin-left:.1rem}.msb-badge-limited [class*=mask],.msb-badge-limited svg,.msb-badge-local [class*=mask],.msb-badge-local svg{background-color:currentColor!important}.msb-badge-cloud{color:#0b6bcb;background:#eef6ff;border:1px solid rgba(11,107,203,.25)}.dark .msb-badge-cloud{color:#8ec2f2;background:rgba(142,194,242,.1);border-color:rgba(142,194,242,.28)}.msb-badge-cloud [class*=mask],.msb-badge-cloud svg{display:inline-block;vertical-align:-.12em;margin-left:.1rem;background-color:currentColor!important}.enterprise-contact-form{color-scheme:light;background:#fff;border-radius:12px}.dark .enterprise-contact-form{filter:invert(1) hue-rotate(180deg);mix-blend-mode:screen}.dark .enterprise-contact-surface{background:rgb(var(--background-dark));isolation:isolate}.msb-guides-grid{column-count:2;column-gap:2.5rem;margin:1.5rem 0 2rem}.msb-guide-group{break-inside:avoid;margin-bottom:2rem}.msb-guide-group h2{display:flex;align-items:center;gap:.6rem;margin:0 0 .65rem!important;padding:0 0 .7rem;border-bottom:1px solid var(--msb-code-border);font-size:.95rem;font-weight:600;line-height:1.5}.msb-guide-heading{display:inline-flex;align-items:center;gap:.6rem}.msb-guide-heading>:first-child{flex-shrink:0}.msb-guides-overview .msb-guide-group ul{margin:0;padding:0;list-style:none}.msb-guides-overview .msb-guide-group li,.msb-release-contributors li{margin:0;padding:0}.msb-guide-group li a{display:flex;align-items:center;justify-content:space-between;gap:.75rem;padding:.45rem 0;border-bottom:0!important;color:inherit;font-size:.875rem;font-weight:400;line-height:1.5;text-decoration:none}.msb-guide-group li a>:last-child{flex-shrink:0;opacity:.55}.msb-guide-group li a:hover{color:var(--msb-code-header-text)}.msb-guide-group a:focus-visible{outline:2px solid var(--msb-code-header-text);outline-offset:3px;border-radius:.25rem}body:has(.msb-guides-overview) #table-of-contents-layout{display:none}@media (min-width:1280px){.msb-guides-grid{column-count:3;column-gap:1.75rem}#content-area:has(.msb-guides-overview){width:100%!important;max-width:72rem!important}}@media (max-width:760px){.msb-guides-grid{column-count:1}}.msb-moved-command{display:none}.msb-moved-command:target{display:block;margin:1rem 0}.msb-release-contributors{display:flex;flex-wrap:wrap;gap:.75rem 1.5rem;margin:1rem 0;padding:0;list-style:none}.msb-release-contributors a{display:inline-flex;align-items:center;gap:.5rem;font-size:.875rem}.msb-release-contributors img{width:2rem;height:2rem;margin:0;border-radius:50%}"}],"page":{"pagePath":"api-reference/personal/sandboxes/create-a-sandbox","slug":"/api-reference/personal/sandboxes/create-a-sandbox","pageMetadata":{"title":"Create a sandbox","description":"By default, the sandbox is created without starting. Use `start=true` to\nstart it immediately and `wait_for=running` to wait until it is ready.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/sandboxes","href":"/api-reference/personal/sandboxes/create-a-sandbox","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n code: \"code\",\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_components.p, {\n children: [\"By default, the sandbox is created without starting. Use \", _jsx(_components.code, {\n children: \"start=true\"\n }), \" to\\nstart it immediately and \", _jsx(_components.code, {\n children: \"wait_for=running\"\n }), \" to wait until it is ready.\"]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Create a sandbox","description":"By default, the sandbox is created without starting. Use `start=true` to\nstart it immediately and `wait_for=running` to wait until it is ready.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/sandboxes","href":"/api-reference/personal/sandboxes/create-a-sandbox","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/superradcompanyinc/13030a400c5bdcc0/toc-collapse.js"],"openApiReferenceData":{"operation":{"tags":["Sandboxes"],"summary":"Create a sandbox","description":"By default, the sandbox is created without starting. Use `start=true` to\nstart it immediately and `wait_for=running` to wait until it is ready.","operationId":"create_sandbox","parameters":["4c367147-ae59-4746-ac22-a170a4535fe9","4e06bd69-0237-4502-b3b3-41c745ab3292","f4b4a3d1-2cf7-4074-89b8-aad4444bd78e","9c0efc2e-a247-408f-95c4-086de91504bc"],"requestBody":"949ac484-da5f-4d1b-ba28-ad2a40ac48a6","responses":{"200":"e29be6e6-c96b-4fa2-af6b-04e114bccc3e","400":"baabd84e-3f45-48ed-b5f6-622b8995f8c1","401":"3cd51e65-0ef5-4fc8-ab23-257e859e8795","409":"9bf7b1ff-eb00-45c5-9baf-94ed6496c2e5","429":"1238308b-4d50-4d73-9d88-c5f577f960a1","502":"44d33067-0968-4690-bdd5-58988bea2d1d"},"security":["e587cab0-1188-4c52-bbab-5da312fb3013"],"method":"post","type":"path","servers":["20699da7-735e-434b-ada4-05c003030c74"],"path":"/v1/orgs/{slug}/sandboxes","baseUrlOptions":["https://api.microsandbox.dev"],"title":"Create a sandbox","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"4c367147-ae59-4746-ac22-a170a4535fe9":{"name":"slug","in":"path","description":"Organization slug","required":true,"schema":{"type":"string","isRequired":true,"description":"Organization slug","uniqueKey":"","typeLabel":"string"}},"4e06bd69-0237-4502-b3b3-41c745ab3292":{"name":"start","in":"query","description":"If `true`, durably queue the sandbox for immediate orchestrator dispatch.","required":false,"schema":{"type":"boolean","isRequired":false,"description":"If `true`, durably queue the sandbox for immediate orchestrator dispatch.","uniqueKey":"","typeLabel":"boolean"}},"f4b4a3d1-2cf7-4074-89b8-aad4444bd78e":{"name":"wait_for","in":"query","description":"Optional lifecycle state to wait for after durable start admission.","required":false,"schema":{"oneOf":[{"type":"null","description":"Optional lifecycle state to wait for after durable start admission.","uniqueKey":"oneOf.0","typeLabel":"null"},{"type":"string","description":"Optional lifecycle state to wait for after durable start admission.\nLifecycle state an opt-in create request may wait to observe.","enum":["running"],"uniqueKey":"oneOf.1","typeLabel":"enum\u003cstring>"}],"isRequired":false,"uniqueKey":"","typeLabel":"null | enum\u003cstring>"}},"9c0efc2e-a247-408f-95c4-086de91504bc":{"name":"wait_timeout","in":"query","description":"Server-side wait budget in seconds; valid only with `wait_for`.","required":false,"schema":{"oneOf":[{"type":"integer","format":"int64","minimum":0,"description":"Server-side wait budget in seconds; valid only with `wait_for`.","uniqueKey":"oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","minimum":0,"description":"Server-side wait budget in seconds; valid only with `wait_for`.","uniqueKey":"oneOf.1","typeLabel":"null"}],"isRequired":false,"uniqueKey":"","typeLabel":"integer\u003cint64> | null"}}},"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","description":"What the user sends in `POST /v1/sandboxes`.\n\nThe body carries the shared microsandbox [`CloudCreateSandboxRequest`] union.\nIts source-specific and common [`CloudSandboxSpec`] fields stay flat on the\nwire beside the cloud-only SSH `slug` and registry-credential selection.","required":["source","reference","name"],"properties":{"name":{"type":"string","description":"Unique sandbox name.","default":"","isRequired":true,"uniqueKey":"oneOf.0.name","typeLabel":"string"},"reference":{"type":"string","description":"OCI image reference.","isRequired":true,"uniqueKey":"oneOf.0.reference","typeLabel":"string"},"source":{"type":"string","enum":["oci"],"isRequired":true,"uniqueKey":"oneOf.0.source","typeLabel":"enum\u003cstring>"},"env":{"type":"array","items":{"type":"object","description":"Environment variable entry.","required":["key","value"],"properties":{"key":{"type":"string","description":"Environment variable name.","isRequired":true,"uniqueKey":"oneOf.0.env.items.[INDEX].key","typeLabel":"string"},"value":{"type":"string","description":"Environment variable value.","isRequired":true,"uniqueKey":"oneOf.0.env.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.0.env.items.[INDEX]","typeLabel":"object"},"description":"Environment variables visible to commands in the sandbox.","default":[],"uniqueKey":"oneOf.0.env","typeLabel":"object[]"},"init":{"oneOf":[{"type":"null","uniqueKey":"oneOf.0.init.oneOf.0","typeLabel":"null"},{"type":"object","description":"Hand off PID 1 to a guest init binary after agentd setup.","required":["cmd"],"properties":{"cmd":{"type":"string","description":"Init binary: absolute path inside the guest rootfs, or the literal `auto`.\n\nAlways a Linux-style `/`-separated path - never build it with host OS path APIs, whose semantics diverge on Windows (`\\` separators, `/sbin/init` treated as relative).","isRequired":true,"uniqueKey":"oneOf.0.init.oneOf.1.cmd","typeLabel":"string"},"args":{"type":"array","items":{"type":"string","uniqueKey":"oneOf.0.init.oneOf.1.args.items.[INDEX]","typeLabel":"string"},"description":"Supplemental argv. `argv[0]` is implicitly `cmd`.","uniqueKey":"oneOf.0.init.oneOf.1.args","typeLabel":"string[]"},"env":{"type":"array","items":{"type":"object","_tupleOriginal":true,"properties":{"[0]":{"type":"string","uniqueKey":"oneOf.0.init.oneOf.1.env.items.[INDEX].[0]","typeLabel":"string"},"[1]":{"type":"string","uniqueKey":"oneOf.0.init.oneOf.1.env.items.[INDEX].[1]","typeLabel":"string"}},"uniqueKey":"oneOf.0.init.oneOf.1.env.items.[INDEX]","typeLabel":"tuple"},"description":"Extra env vars merged on top of the inherited env.","uniqueKey":"oneOf.0.init.oneOf.1.env","typeLabel":"tuple[]"}},"uniqueKey":"oneOf.0.init.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.0.init","typeLabel":"null | object"},"labels":{"type":"object","description":"User-defined labels attached to the sandbox.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.0.labels.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.0.labels","typeLabel":"object"},"lifecycle":{"type":"object","description":"Sandbox lifecycle policy.","default":{"ephemeral":false,"idle_timeout_secs":null,"max_duration_secs":null},"properties":{"ephemeral":{"type":"boolean","description":"Whether the sandbox is ephemeral.\n\nEphemeral sandboxes are one-off: the host runtime that owns the\nprocess removes the persisted DB row and on-disk state when the VM\nreaches a terminal status, and other host runtimes opportunistically\nclean up ephemeral leftovers from runtimes that died before they\ncould self-clean. Defaults to `false` (persistent); named and created\nsandboxes stay inspectable and restartable after they stop.","uniqueKey":"oneOf.0.lifecycle.ephemeral","typeLabel":"boolean"},"idle_timeout_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.0.lifecycle.idle_timeout_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.0.lifecycle.idle_timeout_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.lifecycle.idle_timeout_secs","typeLabel":"integer\u003cint64> | null"},"max_duration_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.0.lifecycle.max_duration_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.0.lifecycle.max_duration_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.lifecycle.max_duration_secs","typeLabel":"integer\u003cint64> | null"}},"uniqueKey":"oneOf.0.lifecycle","typeLabel":"object"},"mounts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.guest","typeLabel":"string"},"host":{"type":"string","description":"Host directory to bind into the guest.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.host","typeLabel":"string"},"type":{"type":"string","enum":["bind"],"isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.options","typeLabel":"object"},"quota_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.quota_mib","typeLabel":"integer\u003cint32> | null"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["name","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.guest","typeLabel":"string"},"name":{"type":"string","description":"Named volume to mount.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.name","typeLabel":"string"},"type":{"type":"string","enum":["named"],"isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.options","typeLabel":"object"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.guest","typeLabel":"string"},"type":{"type":"string","enum":["tmpfs"],"isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.options","typeLabel":"object"},"size_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2.size_mib","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","format","type"],"properties":{"format":{"type":"string","description":"Disk image format.","enum":["qcow2","raw","vmdk"],"isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.format","typeLabel":"enum\u003cstring>"},"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.guest","typeLabel":"string"},"host":{"type":"string","description":"Host path to the disk image file.","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.host","typeLabel":"string"},"type":{"type":"string","enum":["disk_image"],"isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"},"fstype":{"oneOf":[{"type":"string","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.fstype.oneOf.0","typeLabel":"string"},{"type":"null","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.fstype.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.fstype","typeLabel":"string | null"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3.options","typeLabel":"object"}},"uniqueKey":"oneOf.0.mounts.items.[INDEX].oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.0.mounts.items.[INDEX]","typeLabel":"object"},"description":"Volume mounts.","default":[],"uniqueKey":"oneOf.0.mounts","typeLabel":"object[]"},"network":{"type":"object","description":"Network specification.","default":{"enabled":true,"strict":true},"properties":{"enabled":{"type":"boolean","description":"Whether networking is enabled for this sandbox.","default":true,"uniqueKey":"oneOf.0.network.enabled","typeLabel":"boolean"},"max_connections":{"oneOf":[{"type":"integer","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.0.network.max_connections.oneOf.0","typeLabel":"integer"},{"type":"null","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.0.network.max_connections.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.network.max_connections","typeLabel":"integer | null"},"policy":{"oneOf":[{"type":"null","uniqueKey":"oneOf.0.network.policy.oneOf.0","typeLabel":"null"},{"type":"object","description":"Egress/ingress policy.","properties":{"default_egress":{"type":"string","description":"Default action for egress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.0.network.policy.oneOf.1.default_egress","typeLabel":"enum\u003cstring>"},"default_ingress":{"type":"string","description":"Default action for ingress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.0.network.policy.oneOf.1.default_ingress","typeLabel":"enum\u003cstring>"},"rules":{"type":"array","items":{"type":"object","description":"A single egress/ingress policy rule. Evaluated first-match-wins per\ndirection.","required":["direction","destination","action"],"properties":{"action":{"type":"string","description":"Action to take on a match.","enum":["allow","deny"],"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].action","typeLabel":"enum\u003cstring>"},"destination":{"oneOf":[{"type":"string","description":"Destination filter (direction-dependent interpretation).","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["cidr"],"properties":{"cidr":{"type":"string","description":"IP address or CIDR block (e.g. `\"1.2.3.4\"`, `\"10.0.0.0/8\"`).","isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1.cidr","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain"],"properties":{"domain":{"type":"string","description":"Exact domain name (e.g. `\"example.com\"`).","isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2.domain","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain_suffix"],"properties":{"domain_suffix":{"type":"string","description":"Domain suffix - the apex and any subdomain of it.","isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3.domain_suffix","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["group"],"properties":{"group":{"type":"string","description":"A pre-defined destination group.","enum":["public","loopback","private","link_local","metadata","multicast","host"],"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4.group","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].destination","typeLabel":"enum\u003cstring> · object · object · object · object"},"direction":{"type":"string","description":"Direction this rule applies to.","enum":["egress","ingress","any"],"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].direction","typeLabel":"enum\u003cstring>"},"ports":{"type":"array","items":{"type":"object","description":"Inclusive guest-side port range for a [`Rule`] match.","required":["start","end"],"properties":{"end":{"type":"integer","format":"int32","description":"End port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].end","typeLabel":"integer\u003cint32>"},"start":{"type":"integer","format":"int32","description":"Start port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].start","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX]","typeLabel":"object"},"description":"Guest-side port-range set; empty matches any port.","uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].ports","typeLabel":"object[]"},"protocols":{"type":"array","items":{"type":"string","description":"Protocol filter for a [`Rule`].","enum":["tcp","udp","icmpv4","icmpv6"],"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].protocols.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"Protocol set; empty matches any protocol.","uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX].protocols","typeLabel":"enum\u003cstring>[]"}},"uniqueKey":"oneOf.0.network.policy.oneOf.1.rules.items.[INDEX]","typeLabel":"object"},"description":"Ordered rules, evaluated first-match-wins per direction.","uniqueKey":"oneOf.0.network.policy.oneOf.1.rules","typeLabel":"object[]"}},"uniqueKey":"oneOf.0.network.policy.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.policy","typeLabel":"null | object"},"secrets":{"oneOf":[{"type":"null","uniqueKey":"oneOf.0.network.secrets.oneOf.0","typeLabel":"null"},{"type":"object","description":"Secret-injection config.","properties":{"entries":{"type":"array","items":{"type":"object","description":"A single cloud secret entry. Twin of domain [`SecretEntry`].","required":["env_var","placeholder"],"properties":{"env_var":{"type":"string","description":"Environment variable name exposed to the sandbox.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].env_var","typeLabel":"string"},"placeholder":{"type":"string","description":"Placeholder the sandbox sees instead of the real value.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].placeholder","typeLabel":"string"},"allowed_hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts allowed to receive this secret.","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts","typeLabel":"object[]"},"injection":{"type":"object","description":"Where the secret may be injected.","properties":{"basic_auth":{"type":"boolean","description":"Substitute in HTTP Basic Auth (default: true).","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].injection.basic_auth","typeLabel":"boolean"},"body":{"type":"boolean","description":"Substitute in request body (default: false).\n\nFixed-length HTTP/1 bodies up to 16 MiB update `Content-Length`;\nlarger fixed-length bodies are blocked. Chunked HTTP/1 bodies are\ndecoded and re-encoded with fresh chunk sizes. Encoded bodies pass\nthrough unchanged. HTTP/2 DATA-frame body substitution is not\nsupported; matching body placeholders are blocked.","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].injection.body","typeLabel":"boolean"},"headers":{"type":"boolean","description":"Substitute in HTTP headers (default: true).","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].injection.headers","typeLabel":"boolean"},"query_params":{"type":"boolean","description":"Substitute in URL query parameters (default: false).","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].injection.query_params","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].injection","typeLabel":"object"},"on_violation":{"oneOf":[{"type":"null","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.0","typeLabel":"null"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].on_violation","typeLabel":"null · object · object · object · object"},"require_tls_identity":{"type":"boolean","description":"Require verified TLS identity before substituting (default: true).","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].require_tls_identity","typeLabel":"boolean"},"source":{"oneOf":[{"type":"null","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.0","typeLabel":"null"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["var","type"],"properties":{"type":{"type":"string","enum":["env"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.type","typeLabel":"enum\u003cstring>"},"var":{"type":"string","description":"Host environment variable name.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.var","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1","typeLabel":"object"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["reference","type"],"properties":{"reference":{"type":"string","description":"Store-specific secret reference.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.reference","typeLabel":"string"},"type":{"type":"string","enum":["store"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].source","typeLabel":"null · object · object"},"value":{"type":"string","description":"The secret value (empty when `source` carries a reference instead).","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries.items.[INDEX]","typeLabel":"object"},"description":"Secrets to inject.","uniqueKey":"oneOf.0.network.secrets.oneOf.1.entries","typeLabel":"object[]"},"on_violation":{"oneOf":[{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.0.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.0","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets.oneOf.1.on_violation","typeLabel":"object"}},"uniqueKey":"oneOf.0.network.secrets.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.0.network.secrets","typeLabel":"null | object"},"strict":{"type":"boolean","description":"Require hostname-based policy allows to use inspectable application authority.","default":true,"uniqueKey":"oneOf.0.network.strict","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.network","typeLabel":"object"},"rlimits":{"type":"array","items":{"type":"object","description":"A POSIX resource limit. Twin of [`Rlimit`] using [`CloudRlimitResource`].","required":["resource","soft","hard"],"properties":{"hard":{"type":"integer","format":"int64","description":"Hard limit (ceiling, requires privileges to raise).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.0.rlimits.items.[INDEX].hard","typeLabel":"integer\u003cint64>"},"resource":{"type":"string","description":"Resource type.","enum":["cpu","fsize","data","stack","core","rss","nproc","nofile","memlock","as","locks","sigpending","msgqueue","nice","rtprio","rttime"],"isRequired":true,"uniqueKey":"oneOf.0.rlimits.items.[INDEX].resource","typeLabel":"enum\u003cstring>"},"soft":{"type":"integer","format":"int64","description":"Soft limit (can be raised up to the hard limit by the process).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.0.rlimits.items.[INDEX].soft","typeLabel":"integer\u003cint64>"}},"uniqueKey":"oneOf.0.rlimits.items.[INDEX]","typeLabel":"object"},"description":"Sandbox-wide resource limits inherited by guest processes.","default":[],"uniqueKey":"oneOf.0.rlimits","typeLabel":"object[]"},"runtime":{"type":"object","description":"Guest runtime options.","default":{"cmd":null,"entrypoint":null,"log_level":null,"scripts":{},"shell":null,"user":null,"workdir":null},"properties":{"cmd":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.0.runtime.cmd.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.0.runtime.cmd.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.0.runtime.cmd.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.runtime.cmd","typeLabel":"string[] | null"},"entrypoint":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.0.runtime.entrypoint.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.0.runtime.entrypoint.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.0.runtime.entrypoint.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.runtime.entrypoint","typeLabel":"string[] | null"},"log_level":{"oneOf":[{"type":"null","uniqueKey":"oneOf.0.runtime.log_level.oneOf.0","typeLabel":"null"},{"type":"string","description":"Runtime log level.","enum":["error","warn","info","debug","trace"],"uniqueKey":"oneOf.0.runtime.log_level.oneOf.1","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.0.runtime.log_level","typeLabel":"null | enum\u003cstring>"},"scripts":{"type":"object","description":"Named in-guest scripts.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.0.runtime.scripts.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.0.runtime.scripts","typeLabel":"object"},"shell":{"oneOf":[{"type":"string","description":"Default shell.","default":null,"uniqueKey":"oneOf.0.runtime.shell.oneOf.0","typeLabel":"string"},{"type":"null","description":"Default shell.","default":null,"uniqueKey":"oneOf.0.runtime.shell.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.runtime.shell","typeLabel":"string | null"},"user":{"oneOf":[{"type":"string","description":"Guest user.","default":null,"uniqueKey":"oneOf.0.runtime.user.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest user.","default":null,"uniqueKey":"oneOf.0.runtime.user.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.runtime.user","typeLabel":"string | null"},"workdir":{"oneOf":[{"type":"string","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.0.runtime.workdir.oneOf.0","typeLabel":"string"},{"type":"null","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.0.runtime.workdir.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.runtime.workdir","typeLabel":"string | null"}},"uniqueKey":"oneOf.0.runtime","typeLabel":"object"},"security_profile":{"type":"string","description":"In-guest security profile.","default":"default","enum":["default","restricted"],"uniqueKey":"oneOf.0.security_profile","typeLabel":"enum\u003cstring>"},"patches":{"type":"array","items":{"oneOf":[{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","replace","type"],"properties":{"content":{"type":"string","description":"Text content to write.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.content","typeLabel":"string"},"path":{"type":"string","description":"Absolute guest path, such as `/etc/app.conf`.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.path","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.replace","typeLabel":"boolean"},"type":{"type":"string","enum":["text"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","replace","type"],"properties":{"content":{"type":"array","items":{"type":"integer","format":"int32","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.content.items.[INDEX]","typeLabel":"integer\u003cint32>"},"description":"Raw byte content to write.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.content","typeLabel":"integer\u003cint32>[]"},"path":{"type":"string","description":"Absolute guest path.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.path","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.replace","typeLabel":"boolean"},"type":{"type":"string","enum":["file"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["src","dst","replace","type"],"properties":{"dst":{"type":"string","description":"Absolute guest destination path.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.dst","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.replace","typeLabel":"boolean"},"src":{"type":"string","description":"Host path to copy from.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.src","typeLabel":"string"},"type":{"type":"string","enum":["copy_file"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions. `None` preserves source permissions.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions. `None` preserves source permissions.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["src","dst","replace","type"],"properties":{"dst":{"type":"string","description":"Absolute guest destination path.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.3.dst","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing files that already exist in the rootfs.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.3.replace","typeLabel":"boolean"},"src":{"type":"string","description":"Host directory to copy from.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.3.src","typeLabel":"string"},"type":{"type":"string","enum":["copy_dir"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["target","link","replace","type"],"properties":{"link":{"type":"string","description":"Absolute guest path where the symlink is created.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.4.link","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a path that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.4.replace","typeLabel":"boolean"},"target":{"type":"string","description":"Symlink target path.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.4.target","typeLabel":"string"},"type":{"type":"string","enum":["symlink"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.4","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","type"],"properties":{"path":{"type":"string","description":"Absolute guest path.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.5.path","typeLabel":"string"},"type":{"type":"string","enum":["mkdir"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.5.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"Directory permissions, such as `0o755`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.5.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Directory permissions, such as `0o755`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.5.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.5.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.5","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","type"],"properties":{"path":{"type":"string","description":"Absolute guest path to remove.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.6.path","typeLabel":"string"},"type":{"type":"string","enum":["remove"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.6.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.6","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","type"],"properties":{"content":{"type":"string","description":"Content to append.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.7.content","typeLabel":"string"},"path":{"type":"string","description":"Absolute guest path of the file to append to.","isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.7.path","typeLabel":"string"},"type":{"type":"string","enum":["append"],"isRequired":true,"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.7.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.patches.items.[INDEX].oneOf.7","typeLabel":"object"}],"uniqueKey":"oneOf.0.patches.items.[INDEX]","typeLabel":"object"},"description":"Rootfs patches applied before VM start.","uniqueKey":"oneOf.0.patches","typeLabel":"object[]"},"pull_policy":{"type":"string","description":"OCI image pull policy.","enum":["if_missing","always","never"],"uniqueKey":"oneOf.0.pull_policy","typeLabel":"enum\u003cstring>"},"resources":{"type":"object","description":"CPU, memory, and writable-disk resources.","properties":{"disk_size_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Writable disk size in MiB. Applies only to OCI root filesystems.","default":null,"minimum":0,"uniqueKey":"oneOf.0.resources.disk_size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Writable disk size in MiB. Applies only to OCI root filesystems.","default":null,"minimum":0,"uniqueKey":"oneOf.0.resources.disk_size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.resources.disk_size_mib","typeLabel":"integer\u003cint32> | null"},"memory_mib":{"type":"integer","format":"int32","description":"Guest memory in MiB.","default":512,"minimum":0,"uniqueKey":"oneOf.0.resources.memory_mib","typeLabel":"integer\u003cint32>"},"vcpus":{"type":"integer","format":"int32","description":"Number of virtual CPUs.","default":1,"minimum":0,"uniqueKey":"oneOf.0.resources.vcpus","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.0.resources","typeLabel":"object"},"registry":{"oneOf":[{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["auto"],"isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.0.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.registry.oneOf.0","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["anonymous"],"isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.1.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.registry.oneOf.1","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["credential_id","mode"],"properties":{"credential_id":{"type":"string","format":"uuid","description":"Id of a configured `OrgRegistryCredential` belonging to the org.","isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.2.credential_id","typeLabel":"string\u003cuuid>"},"mode":{"type":"string","enum":["specific"],"isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.2.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.registry.oneOf.2","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["username","password","mode"],"properties":{"mode":{"type":"string","enum":["inline"],"isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.3.mode","typeLabel":"enum\u003cstring>"},"password":{"type":"string","format":"password","description":"Registry password or access token. Always redacted from `Debug`.","isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.3.password","typeLabel":"string\u003cpassword>"},"username":{"type":"string","description":"Registry username.","isRequired":true,"uniqueKey":"oneOf.0.registry.oneOf.3.username","typeLabel":"string"}},"uniqueKey":"oneOf.0.registry.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.0.registry","typeLabel":"object"},"slug":{"oneOf":[{"type":"string","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.0.slug.oneOf.0","typeLabel":"string"},{"type":"null","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.0.slug.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.slug","typeLabel":"string | null"}},"uniqueKey":"oneOf.0","typeLabel":"object"},{"type":"object","description":"What the user sends in `POST /v1/sandboxes`.\n\nThe body carries the shared microsandbox [`CloudCreateSandboxRequest`] union.\nIts source-specific and common [`CloudSandboxSpec`] fields stay flat on the\nwire beside the cloud-only SSH `slug` and registry-credential selection.","required":["source","path","name"],"properties":{"name":{"type":"string","description":"Unique sandbox name.","default":"","isRequired":true,"uniqueKey":"oneOf.1.name","typeLabel":"string"},"path":{"type":"string","description":"Host directory used as the root filesystem.","isRequired":true,"uniqueKey":"oneOf.1.path","typeLabel":"string"},"source":{"type":"string","enum":["bind"],"isRequired":true,"uniqueKey":"oneOf.1.source","typeLabel":"enum\u003cstring>"},"env":{"type":"array","items":{"type":"object","description":"Environment variable entry.","required":["key","value"],"properties":{"key":{"type":"string","description":"Environment variable name.","isRequired":true,"uniqueKey":"oneOf.1.env.items.[INDEX].key","typeLabel":"string"},"value":{"type":"string","description":"Environment variable value.","isRequired":true,"uniqueKey":"oneOf.1.env.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.1.env.items.[INDEX]","typeLabel":"object"},"description":"Environment variables visible to commands in the sandbox.","default":[],"uniqueKey":"oneOf.1.env","typeLabel":"object[]"},"init":{"oneOf":[{"type":"null","uniqueKey":"oneOf.1.init.oneOf.0","typeLabel":"null"},{"type":"object","description":"Hand off PID 1 to a guest init binary after agentd setup.","required":["cmd"],"properties":{"cmd":{"type":"string","description":"Init binary: absolute path inside the guest rootfs, or the literal `auto`.\n\nAlways a Linux-style `/`-separated path - never build it with host OS path APIs, whose semantics diverge on Windows (`\\` separators, `/sbin/init` treated as relative).","isRequired":true,"uniqueKey":"oneOf.1.init.oneOf.1.cmd","typeLabel":"string"},"args":{"type":"array","items":{"type":"string","uniqueKey":"oneOf.1.init.oneOf.1.args.items.[INDEX]","typeLabel":"string"},"description":"Supplemental argv. `argv[0]` is implicitly `cmd`.","uniqueKey":"oneOf.1.init.oneOf.1.args","typeLabel":"string[]"},"env":{"type":"array","items":{"type":"object","_tupleOriginal":true,"properties":{"[0]":{"type":"string","uniqueKey":"oneOf.1.init.oneOf.1.env.items.[INDEX].[0]","typeLabel":"string"},"[1]":{"type":"string","uniqueKey":"oneOf.1.init.oneOf.1.env.items.[INDEX].[1]","typeLabel":"string"}},"uniqueKey":"oneOf.1.init.oneOf.1.env.items.[INDEX]","typeLabel":"tuple"},"description":"Extra env vars merged on top of the inherited env.","uniqueKey":"oneOf.1.init.oneOf.1.env","typeLabel":"tuple[]"}},"uniqueKey":"oneOf.1.init.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.1.init","typeLabel":"null | object"},"labels":{"type":"object","description":"User-defined labels attached to the sandbox.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.1.labels.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.1.labels","typeLabel":"object"},"lifecycle":{"type":"object","description":"Sandbox lifecycle policy.","default":{"ephemeral":false,"idle_timeout_secs":null,"max_duration_secs":null},"properties":{"ephemeral":{"type":"boolean","description":"Whether the sandbox is ephemeral.\n\nEphemeral sandboxes are one-off: the host runtime that owns the\nprocess removes the persisted DB row and on-disk state when the VM\nreaches a terminal status, and other host runtimes opportunistically\nclean up ephemeral leftovers from runtimes that died before they\ncould self-clean. Defaults to `false` (persistent); named and created\nsandboxes stay inspectable and restartable after they stop.","uniqueKey":"oneOf.1.lifecycle.ephemeral","typeLabel":"boolean"},"idle_timeout_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.1.lifecycle.idle_timeout_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.1.lifecycle.idle_timeout_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.lifecycle.idle_timeout_secs","typeLabel":"integer\u003cint64> | null"},"max_duration_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.1.lifecycle.max_duration_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.1.lifecycle.max_duration_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.lifecycle.max_duration_secs","typeLabel":"integer\u003cint64> | null"}},"uniqueKey":"oneOf.1.lifecycle","typeLabel":"object"},"mounts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.guest","typeLabel":"string"},"host":{"type":"string","description":"Host directory to bind into the guest.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.host","typeLabel":"string"},"type":{"type":"string","enum":["bind"],"isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.options","typeLabel":"object"},"quota_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.quota_mib","typeLabel":"integer\u003cint32> | null"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["name","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.guest","typeLabel":"string"},"name":{"type":"string","description":"Named volume to mount.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.name","typeLabel":"string"},"type":{"type":"string","enum":["named"],"isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.options","typeLabel":"object"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.guest","typeLabel":"string"},"type":{"type":"string","enum":["tmpfs"],"isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.options","typeLabel":"object"},"size_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2.size_mib","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","format","type"],"properties":{"format":{"type":"string","description":"Disk image format.","enum":["qcow2","raw","vmdk"],"isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.format","typeLabel":"enum\u003cstring>"},"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.guest","typeLabel":"string"},"host":{"type":"string","description":"Host path to the disk image file.","isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.host","typeLabel":"string"},"type":{"type":"string","enum":["disk_image"],"isRequired":true,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"},"fstype":{"oneOf":[{"type":"string","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.fstype.oneOf.0","typeLabel":"string"},{"type":"null","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.fstype.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.fstype","typeLabel":"string | null"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3.options","typeLabel":"object"}},"uniqueKey":"oneOf.1.mounts.items.[INDEX].oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.1.mounts.items.[INDEX]","typeLabel":"object"},"description":"Volume mounts.","default":[],"uniqueKey":"oneOf.1.mounts","typeLabel":"object[]"},"network":{"type":"object","description":"Network specification.","default":{"enabled":true,"strict":true},"properties":{"enabled":{"type":"boolean","description":"Whether networking is enabled for this sandbox.","default":true,"uniqueKey":"oneOf.1.network.enabled","typeLabel":"boolean"},"max_connections":{"oneOf":[{"type":"integer","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.1.network.max_connections.oneOf.0","typeLabel":"integer"},{"type":"null","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.1.network.max_connections.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.network.max_connections","typeLabel":"integer | null"},"policy":{"oneOf":[{"type":"null","uniqueKey":"oneOf.1.network.policy.oneOf.0","typeLabel":"null"},{"type":"object","description":"Egress/ingress policy.","properties":{"default_egress":{"type":"string","description":"Default action for egress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.1.network.policy.oneOf.1.default_egress","typeLabel":"enum\u003cstring>"},"default_ingress":{"type":"string","description":"Default action for ingress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.1.network.policy.oneOf.1.default_ingress","typeLabel":"enum\u003cstring>"},"rules":{"type":"array","items":{"type":"object","description":"A single egress/ingress policy rule. Evaluated first-match-wins per\ndirection.","required":["direction","destination","action"],"properties":{"action":{"type":"string","description":"Action to take on a match.","enum":["allow","deny"],"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].action","typeLabel":"enum\u003cstring>"},"destination":{"oneOf":[{"type":"string","description":"Destination filter (direction-dependent interpretation).","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["cidr"],"properties":{"cidr":{"type":"string","description":"IP address or CIDR block (e.g. `\"1.2.3.4\"`, `\"10.0.0.0/8\"`).","isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1.cidr","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain"],"properties":{"domain":{"type":"string","description":"Exact domain name (e.g. `\"example.com\"`).","isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2.domain","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain_suffix"],"properties":{"domain_suffix":{"type":"string","description":"Domain suffix - the apex and any subdomain of it.","isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3.domain_suffix","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["group"],"properties":{"group":{"type":"string","description":"A pre-defined destination group.","enum":["public","loopback","private","link_local","metadata","multicast","host"],"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4.group","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination","typeLabel":"enum\u003cstring> · object · object · object · object"},"direction":{"type":"string","description":"Direction this rule applies to.","enum":["egress","ingress","any"],"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].direction","typeLabel":"enum\u003cstring>"},"ports":{"type":"array","items":{"type":"object","description":"Inclusive guest-side port range for a [`Rule`] match.","required":["start","end"],"properties":{"end":{"type":"integer","format":"int32","description":"End port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].end","typeLabel":"integer\u003cint32>"},"start":{"type":"integer","format":"int32","description":"Start port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].start","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX]","typeLabel":"object"},"description":"Guest-side port-range set; empty matches any port.","uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports","typeLabel":"object[]"},"protocols":{"type":"array","items":{"type":"string","description":"Protocol filter for a [`Rule`].","enum":["tcp","udp","icmpv4","icmpv6"],"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].protocols.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"Protocol set; empty matches any protocol.","uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].protocols","typeLabel":"enum\u003cstring>[]"}},"uniqueKey":"oneOf.1.network.policy.oneOf.1.rules.items.[INDEX]","typeLabel":"object"},"description":"Ordered rules, evaluated first-match-wins per direction.","uniqueKey":"oneOf.1.network.policy.oneOf.1.rules","typeLabel":"object[]"}},"uniqueKey":"oneOf.1.network.policy.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.policy","typeLabel":"null | object"},"secrets":{"oneOf":[{"type":"null","uniqueKey":"oneOf.1.network.secrets.oneOf.0","typeLabel":"null"},{"type":"object","description":"Secret-injection config.","properties":{"entries":{"type":"array","items":{"type":"object","description":"A single cloud secret entry. Twin of domain [`SecretEntry`].","required":["env_var","placeholder"],"properties":{"env_var":{"type":"string","description":"Environment variable name exposed to the sandbox.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].env_var","typeLabel":"string"},"placeholder":{"type":"string","description":"Placeholder the sandbox sees instead of the real value.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].placeholder","typeLabel":"string"},"allowed_hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts allowed to receive this secret.","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts","typeLabel":"object[]"},"injection":{"type":"object","description":"Where the secret may be injected.","properties":{"basic_auth":{"type":"boolean","description":"Substitute in HTTP Basic Auth (default: true).","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].injection.basic_auth","typeLabel":"boolean"},"body":{"type":"boolean","description":"Substitute in request body (default: false).\n\nFixed-length HTTP/1 bodies up to 16 MiB update `Content-Length`;\nlarger fixed-length bodies are blocked. Chunked HTTP/1 bodies are\ndecoded and re-encoded with fresh chunk sizes. Encoded bodies pass\nthrough unchanged. HTTP/2 DATA-frame body substitution is not\nsupported; matching body placeholders are blocked.","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].injection.body","typeLabel":"boolean"},"headers":{"type":"boolean","description":"Substitute in HTTP headers (default: true).","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].injection.headers","typeLabel":"boolean"},"query_params":{"type":"boolean","description":"Substitute in URL query parameters (default: false).","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].injection.query_params","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].injection","typeLabel":"object"},"on_violation":{"oneOf":[{"type":"null","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.0","typeLabel":"null"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].on_violation","typeLabel":"null · object · object · object · object"},"require_tls_identity":{"type":"boolean","description":"Require verified TLS identity before substituting (default: true).","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].require_tls_identity","typeLabel":"boolean"},"source":{"oneOf":[{"type":"null","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.0","typeLabel":"null"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["var","type"],"properties":{"type":{"type":"string","enum":["env"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.type","typeLabel":"enum\u003cstring>"},"var":{"type":"string","description":"Host environment variable name.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.var","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1","typeLabel":"object"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["reference","type"],"properties":{"reference":{"type":"string","description":"Store-specific secret reference.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.reference","typeLabel":"string"},"type":{"type":"string","enum":["store"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].source","typeLabel":"null · object · object"},"value":{"type":"string","description":"The secret value (empty when `source` carries a reference instead).","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries.items.[INDEX]","typeLabel":"object"},"description":"Secrets to inject.","uniqueKey":"oneOf.1.network.secrets.oneOf.1.entries","typeLabel":"object[]"},"on_violation":{"oneOf":[{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.0.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.0","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets.oneOf.1.on_violation","typeLabel":"object"}},"uniqueKey":"oneOf.1.network.secrets.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.1.network.secrets","typeLabel":"null | object"},"strict":{"type":"boolean","description":"Require hostname-based policy allows to use inspectable application authority.","default":true,"uniqueKey":"oneOf.1.network.strict","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.network","typeLabel":"object"},"rlimits":{"type":"array","items":{"type":"object","description":"A POSIX resource limit. Twin of [`Rlimit`] using [`CloudRlimitResource`].","required":["resource","soft","hard"],"properties":{"hard":{"type":"integer","format":"int64","description":"Hard limit (ceiling, requires privileges to raise).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.1.rlimits.items.[INDEX].hard","typeLabel":"integer\u003cint64>"},"resource":{"type":"string","description":"Resource type.","enum":["cpu","fsize","data","stack","core","rss","nproc","nofile","memlock","as","locks","sigpending","msgqueue","nice","rtprio","rttime"],"isRequired":true,"uniqueKey":"oneOf.1.rlimits.items.[INDEX].resource","typeLabel":"enum\u003cstring>"},"soft":{"type":"integer","format":"int64","description":"Soft limit (can be raised up to the hard limit by the process).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.1.rlimits.items.[INDEX].soft","typeLabel":"integer\u003cint64>"}},"uniqueKey":"oneOf.1.rlimits.items.[INDEX]","typeLabel":"object"},"description":"Sandbox-wide resource limits inherited by guest processes.","default":[],"uniqueKey":"oneOf.1.rlimits","typeLabel":"object[]"},"runtime":{"type":"object","description":"Guest runtime options.","default":{"cmd":null,"entrypoint":null,"log_level":null,"scripts":{},"shell":null,"user":null,"workdir":null},"properties":{"cmd":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.1.runtime.cmd.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.1.runtime.cmd.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.1.runtime.cmd.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.runtime.cmd","typeLabel":"string[] | null"},"entrypoint":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.1.runtime.entrypoint.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.1.runtime.entrypoint.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.1.runtime.entrypoint.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.runtime.entrypoint","typeLabel":"string[] | null"},"log_level":{"oneOf":[{"type":"null","uniqueKey":"oneOf.1.runtime.log_level.oneOf.0","typeLabel":"null"},{"type":"string","description":"Runtime log level.","enum":["error","warn","info","debug","trace"],"uniqueKey":"oneOf.1.runtime.log_level.oneOf.1","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.1.runtime.log_level","typeLabel":"null | enum\u003cstring>"},"scripts":{"type":"object","description":"Named in-guest scripts.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.1.runtime.scripts.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.1.runtime.scripts","typeLabel":"object"},"shell":{"oneOf":[{"type":"string","description":"Default shell.","default":null,"uniqueKey":"oneOf.1.runtime.shell.oneOf.0","typeLabel":"string"},{"type":"null","description":"Default shell.","default":null,"uniqueKey":"oneOf.1.runtime.shell.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.runtime.shell","typeLabel":"string | null"},"user":{"oneOf":[{"type":"string","description":"Guest user.","default":null,"uniqueKey":"oneOf.1.runtime.user.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest user.","default":null,"uniqueKey":"oneOf.1.runtime.user.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.runtime.user","typeLabel":"string | null"},"workdir":{"oneOf":[{"type":"string","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.1.runtime.workdir.oneOf.0","typeLabel":"string"},{"type":"null","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.1.runtime.workdir.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.runtime.workdir","typeLabel":"string | null"}},"uniqueKey":"oneOf.1.runtime","typeLabel":"object"},"security_profile":{"type":"string","description":"In-guest security profile.","default":"default","enum":["default","restricted"],"uniqueKey":"oneOf.1.security_profile","typeLabel":"enum\u003cstring>"},"patches":{"type":"array","items":{"oneOf":[{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","replace","type"],"properties":{"content":{"type":"string","description":"Text content to write.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.content","typeLabel":"string"},"path":{"type":"string","description":"Absolute guest path, such as `/etc/app.conf`.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.path","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.replace","typeLabel":"boolean"},"type":{"type":"string","enum":["text"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","replace","type"],"properties":{"content":{"type":"array","items":{"type":"integer","format":"int32","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.content.items.[INDEX]","typeLabel":"integer\u003cint32>"},"description":"Raw byte content to write.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.content","typeLabel":"integer\u003cint32>[]"},"path":{"type":"string","description":"Absolute guest path.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.path","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.replace","typeLabel":"boolean"},"type":{"type":"string","enum":["file"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["src","dst","replace","type"],"properties":{"dst":{"type":"string","description":"Absolute guest destination path.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.dst","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.replace","typeLabel":"boolean"},"src":{"type":"string","description":"Host path to copy from.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.src","typeLabel":"string"},"type":{"type":"string","enum":["copy_file"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions. `None` preserves source permissions.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions. `None` preserves source permissions.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["src","dst","replace","type"],"properties":{"dst":{"type":"string","description":"Absolute guest destination path.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.3.dst","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing files that already exist in the rootfs.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.3.replace","typeLabel":"boolean"},"src":{"type":"string","description":"Host directory to copy from.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.3.src","typeLabel":"string"},"type":{"type":"string","enum":["copy_dir"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["target","link","replace","type"],"properties":{"link":{"type":"string","description":"Absolute guest path where the symlink is created.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.4.link","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a path that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.4.replace","typeLabel":"boolean"},"target":{"type":"string","description":"Symlink target path.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.4.target","typeLabel":"string"},"type":{"type":"string","enum":["symlink"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.4","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","type"],"properties":{"path":{"type":"string","description":"Absolute guest path.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.5.path","typeLabel":"string"},"type":{"type":"string","enum":["mkdir"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.5.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"Directory permissions, such as `0o755`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.5.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Directory permissions, such as `0o755`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.5.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.5.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.5","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","type"],"properties":{"path":{"type":"string","description":"Absolute guest path to remove.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.6.path","typeLabel":"string"},"type":{"type":"string","enum":["remove"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.6.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.6","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","type"],"properties":{"content":{"type":"string","description":"Content to append.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.7.content","typeLabel":"string"},"path":{"type":"string","description":"Absolute guest path of the file to append to.","isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.7.path","typeLabel":"string"},"type":{"type":"string","enum":["append"],"isRequired":true,"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.7.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.patches.items.[INDEX].oneOf.7","typeLabel":"object"}],"uniqueKey":"oneOf.1.patches.items.[INDEX]","typeLabel":"object"},"description":"Rootfs patches applied before VM start.","uniqueKey":"oneOf.1.patches","typeLabel":"object[]"},"resources":{"type":"object","description":"CPU and memory resources.","properties":{"memory_mib":{"type":"integer","format":"int32","description":"Guest memory in MiB.","default":512,"minimum":0,"uniqueKey":"oneOf.1.resources.memory_mib","typeLabel":"integer\u003cint32>"},"vcpus":{"type":"integer","format":"int32","description":"Number of virtual CPUs.","default":1,"minimum":0,"uniqueKey":"oneOf.1.resources.vcpus","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.1.resources","typeLabel":"object"},"registry":{"oneOf":[{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["auto"],"isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.0.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.registry.oneOf.0","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["anonymous"],"isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.1.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.registry.oneOf.1","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["credential_id","mode"],"properties":{"credential_id":{"type":"string","format":"uuid","description":"Id of a configured `OrgRegistryCredential` belonging to the org.","isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.2.credential_id","typeLabel":"string\u003cuuid>"},"mode":{"type":"string","enum":["specific"],"isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.2.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.registry.oneOf.2","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["username","password","mode"],"properties":{"mode":{"type":"string","enum":["inline"],"isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.3.mode","typeLabel":"enum\u003cstring>"},"password":{"type":"string","format":"password","description":"Registry password or access token. Always redacted from `Debug`.","isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.3.password","typeLabel":"string\u003cpassword>"},"username":{"type":"string","description":"Registry username.","isRequired":true,"uniqueKey":"oneOf.1.registry.oneOf.3.username","typeLabel":"string"}},"uniqueKey":"oneOf.1.registry.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.1.registry","typeLabel":"object"},"slug":{"oneOf":[{"type":"string","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.1.slug.oneOf.0","typeLabel":"string"},{"type":"null","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.1.slug.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.slug","typeLabel":"string | null"}},"uniqueKey":"oneOf.1","typeLabel":"object"},{"type":"object","description":"What the user sends in `POST /v1/sandboxes`.\n\nThe body carries the shared microsandbox [`CloudCreateSandboxRequest`] union.\nIts source-specific and common [`CloudSandboxSpec`] fields stay flat on the\nwire beside the cloud-only SSH `slug` and registry-credential selection.","required":["source","path","format","name"],"properties":{"name":{"type":"string","description":"Unique sandbox name.","default":"","isRequired":true,"uniqueKey":"oneOf.2.name","typeLabel":"string"},"format":{"type":"string","description":"Disk image format.","enum":["qcow2","raw","vmdk"],"isRequired":true,"uniqueKey":"oneOf.2.format","typeLabel":"enum\u003cstring>"},"path":{"type":"string","description":"Host path to the disk image.","isRequired":true,"uniqueKey":"oneOf.2.path","typeLabel":"string"},"source":{"type":"string","enum":["disk_image"],"isRequired":true,"uniqueKey":"oneOf.2.source","typeLabel":"enum\u003cstring>"},"env":{"type":"array","items":{"type":"object","description":"Environment variable entry.","required":["key","value"],"properties":{"key":{"type":"string","description":"Environment variable name.","isRequired":true,"uniqueKey":"oneOf.2.env.items.[INDEX].key","typeLabel":"string"},"value":{"type":"string","description":"Environment variable value.","isRequired":true,"uniqueKey":"oneOf.2.env.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.2.env.items.[INDEX]","typeLabel":"object"},"description":"Environment variables visible to commands in the sandbox.","default":[],"uniqueKey":"oneOf.2.env","typeLabel":"object[]"},"init":{"oneOf":[{"type":"null","uniqueKey":"oneOf.2.init.oneOf.0","typeLabel":"null"},{"type":"object","description":"Hand off PID 1 to a guest init binary after agentd setup.","required":["cmd"],"properties":{"cmd":{"type":"string","description":"Init binary: absolute path inside the guest rootfs, or the literal `auto`.\n\nAlways a Linux-style `/`-separated path - never build it with host OS path APIs, whose semantics diverge on Windows (`\\` separators, `/sbin/init` treated as relative).","isRequired":true,"uniqueKey":"oneOf.2.init.oneOf.1.cmd","typeLabel":"string"},"args":{"type":"array","items":{"type":"string","uniqueKey":"oneOf.2.init.oneOf.1.args.items.[INDEX]","typeLabel":"string"},"description":"Supplemental argv. `argv[0]` is implicitly `cmd`.","uniqueKey":"oneOf.2.init.oneOf.1.args","typeLabel":"string[]"},"env":{"type":"array","items":{"type":"object","_tupleOriginal":true,"properties":{"[0]":{"type":"string","uniqueKey":"oneOf.2.init.oneOf.1.env.items.[INDEX].[0]","typeLabel":"string"},"[1]":{"type":"string","uniqueKey":"oneOf.2.init.oneOf.1.env.items.[INDEX].[1]","typeLabel":"string"}},"uniqueKey":"oneOf.2.init.oneOf.1.env.items.[INDEX]","typeLabel":"tuple"},"description":"Extra env vars merged on top of the inherited env.","uniqueKey":"oneOf.2.init.oneOf.1.env","typeLabel":"tuple[]"}},"uniqueKey":"oneOf.2.init.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.2.init","typeLabel":"null | object"},"labels":{"type":"object","description":"User-defined labels attached to the sandbox.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.2.labels.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.2.labels","typeLabel":"object"},"lifecycle":{"type":"object","description":"Sandbox lifecycle policy.","default":{"ephemeral":false,"idle_timeout_secs":null,"max_duration_secs":null},"properties":{"ephemeral":{"type":"boolean","description":"Whether the sandbox is ephemeral.\n\nEphemeral sandboxes are one-off: the host runtime that owns the\nprocess removes the persisted DB row and on-disk state when the VM\nreaches a terminal status, and other host runtimes opportunistically\nclean up ephemeral leftovers from runtimes that died before they\ncould self-clean. Defaults to `false` (persistent); named and created\nsandboxes stay inspectable and restartable after they stop.","uniqueKey":"oneOf.2.lifecycle.ephemeral","typeLabel":"boolean"},"idle_timeout_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.2.lifecycle.idle_timeout_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.2.lifecycle.idle_timeout_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.lifecycle.idle_timeout_secs","typeLabel":"integer\u003cint64> | null"},"max_duration_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.2.lifecycle.max_duration_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.2.lifecycle.max_duration_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.lifecycle.max_duration_secs","typeLabel":"integer\u003cint64> | null"}},"uniqueKey":"oneOf.2.lifecycle","typeLabel":"object"},"mounts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.guest","typeLabel":"string"},"host":{"type":"string","description":"Host directory to bind into the guest.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.host","typeLabel":"string"},"type":{"type":"string","enum":["bind"],"isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.options","typeLabel":"object"},"quota_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.quota_mib","typeLabel":"integer\u003cint32> | null"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["name","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.guest","typeLabel":"string"},"name":{"type":"string","description":"Named volume to mount.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.name","typeLabel":"string"},"type":{"type":"string","enum":["named"],"isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.options","typeLabel":"object"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.guest","typeLabel":"string"},"type":{"type":"string","enum":["tmpfs"],"isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.options","typeLabel":"object"},"size_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2.size_mib","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","format","type"],"properties":{"format":{"type":"string","description":"Disk image format.","enum":["qcow2","raw","vmdk"],"isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.format","typeLabel":"enum\u003cstring>"},"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.guest","typeLabel":"string"},"host":{"type":"string","description":"Host path to the disk image file.","isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.host","typeLabel":"string"},"type":{"type":"string","enum":["disk_image"],"isRequired":true,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"},"fstype":{"oneOf":[{"type":"string","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.fstype.oneOf.0","typeLabel":"string"},{"type":"null","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.fstype.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.fstype","typeLabel":"string | null"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3.options","typeLabel":"object"}},"uniqueKey":"oneOf.2.mounts.items.[INDEX].oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.2.mounts.items.[INDEX]","typeLabel":"object"},"description":"Volume mounts.","default":[],"uniqueKey":"oneOf.2.mounts","typeLabel":"object[]"},"network":{"type":"object","description":"Network specification.","default":{"enabled":true,"strict":true},"properties":{"enabled":{"type":"boolean","description":"Whether networking is enabled for this sandbox.","default":true,"uniqueKey":"oneOf.2.network.enabled","typeLabel":"boolean"},"max_connections":{"oneOf":[{"type":"integer","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.2.network.max_connections.oneOf.0","typeLabel":"integer"},{"type":"null","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.2.network.max_connections.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.network.max_connections","typeLabel":"integer | null"},"policy":{"oneOf":[{"type":"null","uniqueKey":"oneOf.2.network.policy.oneOf.0","typeLabel":"null"},{"type":"object","description":"Egress/ingress policy.","properties":{"default_egress":{"type":"string","description":"Default action for egress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.2.network.policy.oneOf.1.default_egress","typeLabel":"enum\u003cstring>"},"default_ingress":{"type":"string","description":"Default action for ingress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.2.network.policy.oneOf.1.default_ingress","typeLabel":"enum\u003cstring>"},"rules":{"type":"array","items":{"type":"object","description":"A single egress/ingress policy rule. Evaluated first-match-wins per\ndirection.","required":["direction","destination","action"],"properties":{"action":{"type":"string","description":"Action to take on a match.","enum":["allow","deny"],"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].action","typeLabel":"enum\u003cstring>"},"destination":{"oneOf":[{"type":"string","description":"Destination filter (direction-dependent interpretation).","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["cidr"],"properties":{"cidr":{"type":"string","description":"IP address or CIDR block (e.g. `\"1.2.3.4\"`, `\"10.0.0.0/8\"`).","isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1.cidr","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain"],"properties":{"domain":{"type":"string","description":"Exact domain name (e.g. `\"example.com\"`).","isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2.domain","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain_suffix"],"properties":{"domain_suffix":{"type":"string","description":"Domain suffix - the apex and any subdomain of it.","isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3.domain_suffix","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["group"],"properties":{"group":{"type":"string","description":"A pre-defined destination group.","enum":["public","loopback","private","link_local","metadata","multicast","host"],"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4.group","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].destination","typeLabel":"enum\u003cstring> · object · object · object · object"},"direction":{"type":"string","description":"Direction this rule applies to.","enum":["egress","ingress","any"],"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].direction","typeLabel":"enum\u003cstring>"},"ports":{"type":"array","items":{"type":"object","description":"Inclusive guest-side port range for a [`Rule`] match.","required":["start","end"],"properties":{"end":{"type":"integer","format":"int32","description":"End port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].end","typeLabel":"integer\u003cint32>"},"start":{"type":"integer","format":"int32","description":"Start port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].start","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX]","typeLabel":"object"},"description":"Guest-side port-range set; empty matches any port.","uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].ports","typeLabel":"object[]"},"protocols":{"type":"array","items":{"type":"string","description":"Protocol filter for a [`Rule`].","enum":["tcp","udp","icmpv4","icmpv6"],"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].protocols.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"Protocol set; empty matches any protocol.","uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX].protocols","typeLabel":"enum\u003cstring>[]"}},"uniqueKey":"oneOf.2.network.policy.oneOf.1.rules.items.[INDEX]","typeLabel":"object"},"description":"Ordered rules, evaluated first-match-wins per direction.","uniqueKey":"oneOf.2.network.policy.oneOf.1.rules","typeLabel":"object[]"}},"uniqueKey":"oneOf.2.network.policy.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.policy","typeLabel":"null | object"},"secrets":{"oneOf":[{"type":"null","uniqueKey":"oneOf.2.network.secrets.oneOf.0","typeLabel":"null"},{"type":"object","description":"Secret-injection config.","properties":{"entries":{"type":"array","items":{"type":"object","description":"A single cloud secret entry. Twin of domain [`SecretEntry`].","required":["env_var","placeholder"],"properties":{"env_var":{"type":"string","description":"Environment variable name exposed to the sandbox.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].env_var","typeLabel":"string"},"placeholder":{"type":"string","description":"Placeholder the sandbox sees instead of the real value.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].placeholder","typeLabel":"string"},"allowed_hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts allowed to receive this secret.","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts","typeLabel":"object[]"},"injection":{"type":"object","description":"Where the secret may be injected.","properties":{"basic_auth":{"type":"boolean","description":"Substitute in HTTP Basic Auth (default: true).","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].injection.basic_auth","typeLabel":"boolean"},"body":{"type":"boolean","description":"Substitute in request body (default: false).\n\nFixed-length HTTP/1 bodies up to 16 MiB update `Content-Length`;\nlarger fixed-length bodies are blocked. Chunked HTTP/1 bodies are\ndecoded and re-encoded with fresh chunk sizes. Encoded bodies pass\nthrough unchanged. HTTP/2 DATA-frame body substitution is not\nsupported; matching body placeholders are blocked.","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].injection.body","typeLabel":"boolean"},"headers":{"type":"boolean","description":"Substitute in HTTP headers (default: true).","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].injection.headers","typeLabel":"boolean"},"query_params":{"type":"boolean","description":"Substitute in URL query parameters (default: false).","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].injection.query_params","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].injection","typeLabel":"object"},"on_violation":{"oneOf":[{"type":"null","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.0","typeLabel":"null"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].on_violation","typeLabel":"null · object · object · object · object"},"require_tls_identity":{"type":"boolean","description":"Require verified TLS identity before substituting (default: true).","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].require_tls_identity","typeLabel":"boolean"},"source":{"oneOf":[{"type":"null","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.0","typeLabel":"null"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["var","type"],"properties":{"type":{"type":"string","enum":["env"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.type","typeLabel":"enum\u003cstring>"},"var":{"type":"string","description":"Host environment variable name.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.var","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1","typeLabel":"object"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["reference","type"],"properties":{"reference":{"type":"string","description":"Store-specific secret reference.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.reference","typeLabel":"string"},"type":{"type":"string","enum":["store"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].source","typeLabel":"null · object · object"},"value":{"type":"string","description":"The secret value (empty when `source` carries a reference instead).","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries.items.[INDEX]","typeLabel":"object"},"description":"Secrets to inject.","uniqueKey":"oneOf.2.network.secrets.oneOf.1.entries","typeLabel":"object[]"},"on_violation":{"oneOf":[{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.0.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.0","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets.oneOf.1.on_violation","typeLabel":"object"}},"uniqueKey":"oneOf.2.network.secrets.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.2.network.secrets","typeLabel":"null | object"},"strict":{"type":"boolean","description":"Require hostname-based policy allows to use inspectable application authority.","default":true,"uniqueKey":"oneOf.2.network.strict","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.network","typeLabel":"object"},"rlimits":{"type":"array","items":{"type":"object","description":"A POSIX resource limit. Twin of [`Rlimit`] using [`CloudRlimitResource`].","required":["resource","soft","hard"],"properties":{"hard":{"type":"integer","format":"int64","description":"Hard limit (ceiling, requires privileges to raise).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.2.rlimits.items.[INDEX].hard","typeLabel":"integer\u003cint64>"},"resource":{"type":"string","description":"Resource type.","enum":["cpu","fsize","data","stack","core","rss","nproc","nofile","memlock","as","locks","sigpending","msgqueue","nice","rtprio","rttime"],"isRequired":true,"uniqueKey":"oneOf.2.rlimits.items.[INDEX].resource","typeLabel":"enum\u003cstring>"},"soft":{"type":"integer","format":"int64","description":"Soft limit (can be raised up to the hard limit by the process).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.2.rlimits.items.[INDEX].soft","typeLabel":"integer\u003cint64>"}},"uniqueKey":"oneOf.2.rlimits.items.[INDEX]","typeLabel":"object"},"description":"Sandbox-wide resource limits inherited by guest processes.","default":[],"uniqueKey":"oneOf.2.rlimits","typeLabel":"object[]"},"runtime":{"type":"object","description":"Guest runtime options.","default":{"cmd":null,"entrypoint":null,"log_level":null,"scripts":{},"shell":null,"user":null,"workdir":null},"properties":{"cmd":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.2.runtime.cmd.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.2.runtime.cmd.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.2.runtime.cmd.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.runtime.cmd","typeLabel":"string[] | null"},"entrypoint":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.2.runtime.entrypoint.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.2.runtime.entrypoint.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.2.runtime.entrypoint.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.runtime.entrypoint","typeLabel":"string[] | null"},"log_level":{"oneOf":[{"type":"null","uniqueKey":"oneOf.2.runtime.log_level.oneOf.0","typeLabel":"null"},{"type":"string","description":"Runtime log level.","enum":["error","warn","info","debug","trace"],"uniqueKey":"oneOf.2.runtime.log_level.oneOf.1","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.2.runtime.log_level","typeLabel":"null | enum\u003cstring>"},"scripts":{"type":"object","description":"Named in-guest scripts.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.2.runtime.scripts.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.2.runtime.scripts","typeLabel":"object"},"shell":{"oneOf":[{"type":"string","description":"Default shell.","default":null,"uniqueKey":"oneOf.2.runtime.shell.oneOf.0","typeLabel":"string"},{"type":"null","description":"Default shell.","default":null,"uniqueKey":"oneOf.2.runtime.shell.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.runtime.shell","typeLabel":"string | null"},"user":{"oneOf":[{"type":"string","description":"Guest user.","default":null,"uniqueKey":"oneOf.2.runtime.user.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest user.","default":null,"uniqueKey":"oneOf.2.runtime.user.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.runtime.user","typeLabel":"string | null"},"workdir":{"oneOf":[{"type":"string","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.2.runtime.workdir.oneOf.0","typeLabel":"string"},{"type":"null","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.2.runtime.workdir.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.runtime.workdir","typeLabel":"string | null"}},"uniqueKey":"oneOf.2.runtime","typeLabel":"object"},"security_profile":{"type":"string","description":"In-guest security profile.","default":"default","enum":["default","restricted"],"uniqueKey":"oneOf.2.security_profile","typeLabel":"enum\u003cstring>"},"fstype":{"oneOf":[{"type":"string","description":"Inner filesystem type, when it cannot be detected automatically.","uniqueKey":"oneOf.2.fstype.oneOf.0","typeLabel":"string"},{"type":"null","description":"Inner filesystem type, when it cannot be detected automatically.","uniqueKey":"oneOf.2.fstype.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.fstype","typeLabel":"string | null"},"patches":{"type":"array","items":{"oneOf":[{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","replace","type"],"properties":{"content":{"type":"string","description":"Text content to write.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.content","typeLabel":"string"},"path":{"type":"string","description":"Absolute guest path, such as `/etc/app.conf`.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.path","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.replace","typeLabel":"boolean"},"type":{"type":"string","enum":["text"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","replace","type"],"properties":{"content":{"type":"array","items":{"type":"integer","format":"int32","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.content.items.[INDEX]","typeLabel":"integer\u003cint32>"},"description":"Raw byte content to write.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.content","typeLabel":"integer\u003cint32>[]"},"path":{"type":"string","description":"Absolute guest path.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.path","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.replace","typeLabel":"boolean"},"type":{"type":"string","enum":["file"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions, such as `0o644`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["src","dst","replace","type"],"properties":{"dst":{"type":"string","description":"Absolute guest destination path.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.dst","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a file that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.replace","typeLabel":"boolean"},"src":{"type":"string","description":"Host path to copy from.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.src","typeLabel":"string"},"type":{"type":"string","enum":["copy_file"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"File permissions. `None` preserves source permissions.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"File permissions. `None` preserves source permissions.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["src","dst","replace","type"],"properties":{"dst":{"type":"string","description":"Absolute guest destination path.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.3.dst","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing files that already exist in the rootfs.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.3.replace","typeLabel":"boolean"},"src":{"type":"string","description":"Host directory to copy from.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.3.src","typeLabel":"string"},"type":{"type":"string","enum":["copy_dir"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["target","link","replace","type"],"properties":{"link":{"type":"string","description":"Absolute guest path where the symlink is created.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.4.link","typeLabel":"string"},"replace":{"type":"boolean","description":"Allow replacing a path that already exists in the rootfs.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.4.replace","typeLabel":"boolean"},"target":{"type":"string","description":"Symlink target path.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.4.target","typeLabel":"string"},"type":{"type":"string","enum":["symlink"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.4","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","type"],"properties":{"path":{"type":"string","description":"Absolute guest path.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.5.path","typeLabel":"string"},"type":{"type":"string","enum":["mkdir"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.5.type","typeLabel":"enum\u003cstring>"},"mode":{"oneOf":[{"type":"integer","format":"int32","description":"Directory permissions, such as `0o755`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.5.mode.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Directory permissions, such as `0o755`. `None` uses the default.","minimum":0,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.5.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.5.mode","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.5","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","type"],"properties":{"path":{"type":"string","description":"Absolute guest path to remove.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.6.path","typeLabel":"string"},"type":{"type":"string","enum":["remove"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.6.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.6","typeLabel":"object"},{"type":"object","description":"Filesystem change applied before the sandbox starts. The type field selects the operation.","required":["path","content","type"],"properties":{"content":{"type":"string","description":"Content to append.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.7.content","typeLabel":"string"},"path":{"type":"string","description":"Absolute guest path of the file to append to.","isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.7.path","typeLabel":"string"},"type":{"type":"string","enum":["append"],"isRequired":true,"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.7.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.patches.items.[INDEX].oneOf.7","typeLabel":"object"}],"uniqueKey":"oneOf.2.patches.items.[INDEX]","typeLabel":"object"},"description":"Rootfs patches applied before VM start.","uniqueKey":"oneOf.2.patches","typeLabel":"object[]"},"resources":{"type":"object","description":"CPU and memory resources.","properties":{"memory_mib":{"type":"integer","format":"int32","description":"Guest memory in MiB.","default":512,"minimum":0,"uniqueKey":"oneOf.2.resources.memory_mib","typeLabel":"integer\u003cint32>"},"vcpus":{"type":"integer","format":"int32","description":"Number of virtual CPUs.","default":1,"minimum":0,"uniqueKey":"oneOf.2.resources.vcpus","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.2.resources","typeLabel":"object"},"registry":{"oneOf":[{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["auto"],"isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.0.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.registry.oneOf.0","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["anonymous"],"isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.1.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.registry.oneOf.1","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["credential_id","mode"],"properties":{"credential_id":{"type":"string","format":"uuid","description":"Id of a configured `OrgRegistryCredential` belonging to the org.","isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.2.credential_id","typeLabel":"string\u003cuuid>"},"mode":{"type":"string","enum":["specific"],"isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.2.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.registry.oneOf.2","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["username","password","mode"],"properties":{"mode":{"type":"string","enum":["inline"],"isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.3.mode","typeLabel":"enum\u003cstring>"},"password":{"type":"string","format":"password","description":"Registry password or access token. Always redacted from `Debug`.","isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.3.password","typeLabel":"string\u003cpassword>"},"username":{"type":"string","description":"Registry username.","isRequired":true,"uniqueKey":"oneOf.2.registry.oneOf.3.username","typeLabel":"string"}},"uniqueKey":"oneOf.2.registry.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.2.registry","typeLabel":"object"},"slug":{"oneOf":[{"type":"string","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.2.slug.oneOf.0","typeLabel":"string"},{"type":"null","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.2.slug.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.2.slug","typeLabel":"string | null"}},"uniqueKey":"oneOf.2","typeLabel":"object"},{"type":"object","description":"What the user sends in `POST /v1/sandboxes`.\n\nThe body carries the shared microsandbox [`CloudCreateSandboxRequest`] union.\nIts source-specific and common [`CloudSandboxSpec`] fields stay flat on the\nwire beside the cloud-only SSH `slug` and registry-credential selection.","required":["source","disk_snapshot_ref","name"],"properties":{"name":{"type":"string","description":"Unique sandbox name.","default":"","isRequired":true,"uniqueKey":"oneOf.3.name","typeLabel":"string"},"disk_snapshot_ref":{"oneOf":[{"type":"object","description":"Disk snapshot to restore.","required":["id","type"],"properties":{"id":{"type":"string","description":"Identifier of the stored artifact.","isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","enum":["managed"],"isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref.oneOf.0.type","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref.oneOf.0","typeLabel":"object"},{"type":"object","description":"Disk snapshot to restore.","required":["path","type"],"properties":{"path":{"type":"string","description":"Artifact directory path on the host volume.","isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref.oneOf.1.path","typeLabel":"string"},"type":{"type":"string","enum":["host_volume"],"isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref.oneOf.1","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.3.disk_snapshot_ref","typeLabel":"object"},"source":{"type":"string","enum":["disk_snapshot"],"isRequired":true,"uniqueKey":"oneOf.3.source","typeLabel":"enum\u003cstring>"},"env":{"type":"array","items":{"type":"object","description":"Environment variable entry.","required":["key","value"],"properties":{"key":{"type":"string","description":"Environment variable name.","isRequired":true,"uniqueKey":"oneOf.3.env.items.[INDEX].key","typeLabel":"string"},"value":{"type":"string","description":"Environment variable value.","isRequired":true,"uniqueKey":"oneOf.3.env.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.3.env.items.[INDEX]","typeLabel":"object"},"description":"Environment variables visible to commands in the sandbox.","default":[],"uniqueKey":"oneOf.3.env","typeLabel":"object[]"},"init":{"oneOf":[{"type":"null","uniqueKey":"oneOf.3.init.oneOf.0","typeLabel":"null"},{"type":"object","description":"Hand off PID 1 to a guest init binary after agentd setup.","required":["cmd"],"properties":{"cmd":{"type":"string","description":"Init binary: absolute path inside the guest rootfs, or the literal `auto`.\n\nAlways a Linux-style `/`-separated path - never build it with host OS path APIs, whose semantics diverge on Windows (`\\` separators, `/sbin/init` treated as relative).","isRequired":true,"uniqueKey":"oneOf.3.init.oneOf.1.cmd","typeLabel":"string"},"args":{"type":"array","items":{"type":"string","uniqueKey":"oneOf.3.init.oneOf.1.args.items.[INDEX]","typeLabel":"string"},"description":"Supplemental argv. `argv[0]` is implicitly `cmd`.","uniqueKey":"oneOf.3.init.oneOf.1.args","typeLabel":"string[]"},"env":{"type":"array","items":{"type":"object","_tupleOriginal":true,"properties":{"[0]":{"type":"string","uniqueKey":"oneOf.3.init.oneOf.1.env.items.[INDEX].[0]","typeLabel":"string"},"[1]":{"type":"string","uniqueKey":"oneOf.3.init.oneOf.1.env.items.[INDEX].[1]","typeLabel":"string"}},"uniqueKey":"oneOf.3.init.oneOf.1.env.items.[INDEX]","typeLabel":"tuple"},"description":"Extra env vars merged on top of the inherited env.","uniqueKey":"oneOf.3.init.oneOf.1.env","typeLabel":"tuple[]"}},"uniqueKey":"oneOf.3.init.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.3.init","typeLabel":"null | object"},"labels":{"type":"object","description":"User-defined labels attached to the sandbox.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.3.labels.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.3.labels","typeLabel":"object"},"lifecycle":{"type":"object","description":"Sandbox lifecycle policy.","default":{"ephemeral":false,"idle_timeout_secs":null,"max_duration_secs":null},"properties":{"ephemeral":{"type":"boolean","description":"Whether the sandbox is ephemeral.\n\nEphemeral sandboxes are one-off: the host runtime that owns the\nprocess removes the persisted DB row and on-disk state when the VM\nreaches a terminal status, and other host runtimes opportunistically\nclean up ephemeral leftovers from runtimes that died before they\ncould self-clean. Defaults to `false` (persistent); named and created\nsandboxes stay inspectable and restartable after they stop.","uniqueKey":"oneOf.3.lifecycle.ephemeral","typeLabel":"boolean"},"idle_timeout_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.3.lifecycle.idle_timeout_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"oneOf.3.lifecycle.idle_timeout_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.lifecycle.idle_timeout_secs","typeLabel":"integer\u003cint64> | null"},"max_duration_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.3.lifecycle.max_duration_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"oneOf.3.lifecycle.max_duration_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.lifecycle.max_duration_secs","typeLabel":"integer\u003cint64> | null"}},"uniqueKey":"oneOf.3.lifecycle","typeLabel":"object"},"mounts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.guest","typeLabel":"string"},"host":{"type":"string","description":"Host directory to bind into the guest.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.host","typeLabel":"string"},"type":{"type":"string","enum":["bind"],"isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.options","typeLabel":"object"},"quota_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional guest-write quota in MiB.","minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.quota_mib","typeLabel":"integer\u003cint32> | null"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["name","guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.guest","typeLabel":"string"},"name":{"type":"string","description":"Named volume to mount.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.name","typeLabel":"string"},"type":{"type":"string","enum":["named"],"isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"host_permissions":{"type":"string","description":"Host permission policy applied to the mount.","enum":["private","mirror"],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.options","typeLabel":"object"},"stat_virtualization":{"type":"string","description":"How guest `stat()` results are virtualized.","enum":["strict","relaxed","off"],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1.stat_virtualization","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["guest","type"],"properties":{"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.guest","typeLabel":"string"},"type":{"type":"string","enum":["tmpfs"],"isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.options","typeLabel":"object"},"size_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Optional size cap in MiB.","minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2.size_mib","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Persistent volume mounted at a path inside the sandbox.","required":["host","guest","format","type"],"properties":{"format":{"type":"string","description":"Disk image format.","enum":["qcow2","raw","vmdk"],"isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.format","typeLabel":"enum\u003cstring>"},"guest":{"type":"string","description":"Guest path to mount at.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.guest","typeLabel":"string"},"host":{"type":"string","description":"Host path to the disk image file.","isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.host","typeLabel":"string"},"type":{"type":"string","enum":["disk_image"],"isRequired":true,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"},"fstype":{"oneOf":[{"type":"string","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.fstype.oneOf.0","typeLabel":"string"},{"type":"null","description":"Inner filesystem type (auto-detected if absent).","uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.fstype.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.fstype","typeLabel":"string | null"},"options":{"type":"object","description":"Mount options (read-only, no-exec, …).","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options.readonly","typeLabel":"boolean"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3.options","typeLabel":"object"}},"uniqueKey":"oneOf.3.mounts.items.[INDEX].oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.3.mounts.items.[INDEX]","typeLabel":"object"},"description":"Volume mounts.","default":[],"uniqueKey":"oneOf.3.mounts","typeLabel":"object[]"},"network":{"type":"object","description":"Network specification.","default":{"enabled":true,"strict":true},"properties":{"enabled":{"type":"boolean","description":"Whether networking is enabled for this sandbox.","default":true,"uniqueKey":"oneOf.3.network.enabled","typeLabel":"boolean"},"max_connections":{"oneOf":[{"type":"integer","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.3.network.max_connections.oneOf.0","typeLabel":"integer"},{"type":"null","description":"Max concurrent guest connections.","default":null,"minimum":0,"uniqueKey":"oneOf.3.network.max_connections.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.network.max_connections","typeLabel":"integer | null"},"policy":{"oneOf":[{"type":"null","uniqueKey":"oneOf.3.network.policy.oneOf.0","typeLabel":"null"},{"type":"object","description":"Egress/ingress policy.","properties":{"default_egress":{"type":"string","description":"Default action for egress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.3.network.policy.oneOf.1.default_egress","typeLabel":"enum\u003cstring>"},"default_ingress":{"type":"string","description":"Default action for ingress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"oneOf.3.network.policy.oneOf.1.default_ingress","typeLabel":"enum\u003cstring>"},"rules":{"type":"array","items":{"type":"object","description":"A single egress/ingress policy rule. Evaluated first-match-wins per\ndirection.","required":["direction","destination","action"],"properties":{"action":{"type":"string","description":"Action to take on a match.","enum":["allow","deny"],"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].action","typeLabel":"enum\u003cstring>"},"destination":{"oneOf":[{"type":"string","description":"Destination filter (direction-dependent interpretation).","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["cidr"],"properties":{"cidr":{"type":"string","description":"IP address or CIDR block (e.g. `\"1.2.3.4\"`, `\"10.0.0.0/8\"`).","isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1.cidr","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain"],"properties":{"domain":{"type":"string","description":"Exact domain name (e.g. `\"example.com\"`).","isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2.domain","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain_suffix"],"properties":{"domain_suffix":{"type":"string","description":"Domain suffix - the apex and any subdomain of it.","isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3.domain_suffix","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["group"],"properties":{"group":{"type":"string","description":"A pre-defined destination group.","enum":["public","loopback","private","link_local","metadata","multicast","host"],"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4.group","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].destination","typeLabel":"enum\u003cstring> · object · object · object · object"},"direction":{"type":"string","description":"Direction this rule applies to.","enum":["egress","ingress","any"],"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].direction","typeLabel":"enum\u003cstring>"},"ports":{"type":"array","items":{"type":"object","description":"Inclusive guest-side port range for a [`Rule`] match.","required":["start","end"],"properties":{"end":{"type":"integer","format":"int32","description":"End port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].end","typeLabel":"integer\u003cint32>"},"start":{"type":"integer","format":"int32","description":"Start port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].start","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX]","typeLabel":"object"},"description":"Guest-side port-range set; empty matches any port.","uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].ports","typeLabel":"object[]"},"protocols":{"type":"array","items":{"type":"string","description":"Protocol filter for a [`Rule`].","enum":["tcp","udp","icmpv4","icmpv6"],"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].protocols.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"Protocol set; empty matches any protocol.","uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX].protocols","typeLabel":"enum\u003cstring>[]"}},"uniqueKey":"oneOf.3.network.policy.oneOf.1.rules.items.[INDEX]","typeLabel":"object"},"description":"Ordered rules, evaluated first-match-wins per direction.","uniqueKey":"oneOf.3.network.policy.oneOf.1.rules","typeLabel":"object[]"}},"uniqueKey":"oneOf.3.network.policy.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.policy","typeLabel":"null | object"},"secrets":{"oneOf":[{"type":"null","uniqueKey":"oneOf.3.network.secrets.oneOf.0","typeLabel":"null"},{"type":"object","description":"Secret-injection config.","properties":{"entries":{"type":"array","items":{"type":"object","description":"A single cloud secret entry. Twin of domain [`SecretEntry`].","required":["env_var","placeholder"],"properties":{"env_var":{"type":"string","description":"Environment variable name exposed to the sandbox.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].env_var","typeLabel":"string"},"placeholder":{"type":"string","description":"Placeholder the sandbox sees instead of the real value.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].placeholder","typeLabel":"string"},"allowed_hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts allowed to receive this secret.","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].allowed_hosts","typeLabel":"object[]"},"injection":{"type":"object","description":"Where the secret may be injected.","properties":{"basic_auth":{"type":"boolean","description":"Substitute in HTTP Basic Auth (default: true).","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].injection.basic_auth","typeLabel":"boolean"},"body":{"type":"boolean","description":"Substitute in request body (default: false).\n\nFixed-length HTTP/1 bodies up to 16 MiB update `Content-Length`;\nlarger fixed-length bodies are blocked. Chunked HTTP/1 bodies are\ndecoded and re-encoded with fresh chunk sizes. Encoded bodies pass\nthrough unchanged. HTTP/2 DATA-frame body substitution is not\nsupported; matching body placeholders are blocked.","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].injection.body","typeLabel":"boolean"},"headers":{"type":"boolean","description":"Substitute in HTTP headers (default: true).","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].injection.headers","typeLabel":"boolean"},"query_params":{"type":"boolean","description":"Substitute in URL query parameters (default: false).","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].injection.query_params","typeLabel":"boolean"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].injection","typeLabel":"object"},"on_violation":{"oneOf":[{"type":"null","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.0","typeLabel":"null"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.3","typeLabel":"object"},{"type":"object","description":"Per-secret violation action overriding the config default.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation.oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].on_violation","typeLabel":"null · object · object · object · object"},"require_tls_identity":{"type":"boolean","description":"Require verified TLS identity before substituting (default: true).","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].require_tls_identity","typeLabel":"boolean"},"source":{"oneOf":[{"type":"null","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.0","typeLabel":"null"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["var","type"],"properties":{"type":{"type":"string","enum":["env"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.type","typeLabel":"enum\u003cstring>"},"var":{"type":"string","description":"Host environment variable name.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1.var","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.1","typeLabel":"object"},{"type":"object","description":"Host-side source resolved into `value` at spawn time.","required":["reference","type"],"properties":{"reference":{"type":"string","description":"Store-specific secret reference.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.reference","typeLabel":"string"},"type":{"type":"string","enum":["store"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].source","typeLabel":"null · object · object"},"value":{"type":"string","description":"The secret value (empty when `source` carries a reference instead).","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries.items.[INDEX]","typeLabel":"object"},"description":"Secrets to inject.","uniqueKey":"oneOf.3.network.secrets.oneOf.1.entries","typeLabel":"object[]"},"on_violation":{"oneOf":[{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.0.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.0","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_log"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.1","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["type"],"properties":{"type":{"type":"string","enum":["block_and_terminate"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.2","typeLabel":"object"},{"type":"object","description":"Default action when a placeholder leaks to a disallowed host.","required":["hosts","type"],"properties":{"hosts":{"type":"array","items":{"oneOf":[{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["exact"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Hostname to match exactly.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0.value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["value","type"],"properties":{"type":{"type":"string","enum":["wildcard"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"},"value":{"type":"string","description":"Wildcard pattern.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1.value","typeLabel":"string"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Host allowlist pattern for cloud secrets. Twin of [`HostPattern`], with the\ndomain's scalar variants normalized to `{ value }` for a uniform union.","required":["type"],"properties":{"type":{"type":"string","enum":["any"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX].oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts.items.[INDEX]","typeLabel":"object"},"description":"Hosts for which the placeholder passes through unchanged.","isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.hosts","typeLabel":"object[]"},"type":{"type":"string","enum":["passthrough"],"isRequired":true,"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets.oneOf.1.on_violation","typeLabel":"object"}},"uniqueKey":"oneOf.3.network.secrets.oneOf.1","typeLabel":"object"}],"uniqueKey":"oneOf.3.network.secrets","typeLabel":"null | object"},"strict":{"type":"boolean","description":"Require hostname-based policy allows to use inspectable application authority.","default":true,"uniqueKey":"oneOf.3.network.strict","typeLabel":"boolean"}},"uniqueKey":"oneOf.3.network","typeLabel":"object"},"rlimits":{"type":"array","items":{"type":"object","description":"A POSIX resource limit. Twin of [`Rlimit`] using [`CloudRlimitResource`].","required":["resource","soft","hard"],"properties":{"hard":{"type":"integer","format":"int64","description":"Hard limit (ceiling, requires privileges to raise).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.3.rlimits.items.[INDEX].hard","typeLabel":"integer\u003cint64>"},"resource":{"type":"string","description":"Resource type.","enum":["cpu","fsize","data","stack","core","rss","nproc","nofile","memlock","as","locks","sigpending","msgqueue","nice","rtprio","rttime"],"isRequired":true,"uniqueKey":"oneOf.3.rlimits.items.[INDEX].resource","typeLabel":"enum\u003cstring>"},"soft":{"type":"integer","format":"int64","description":"Soft limit (can be raised up to the hard limit by the process).","minimum":0,"isRequired":true,"uniqueKey":"oneOf.3.rlimits.items.[INDEX].soft","typeLabel":"integer\u003cint64>"}},"uniqueKey":"oneOf.3.rlimits.items.[INDEX]","typeLabel":"object"},"description":"Sandbox-wide resource limits inherited by guest processes.","default":[],"uniqueKey":"oneOf.3.rlimits","typeLabel":"object[]"},"runtime":{"type":"object","description":"Guest runtime options.","default":{"cmd":null,"entrypoint":null,"log_level":null,"scripts":{},"shell":null,"user":null,"workdir":null},"properties":{"cmd":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.3.runtime.cmd.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.3.runtime.cmd.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Command override.","default":null,"uniqueKey":"oneOf.3.runtime.cmd.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.runtime.cmd","typeLabel":"string[] | null"},"entrypoint":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"oneOf.3.runtime.entrypoint.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.3.runtime.entrypoint.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Entrypoint override.","default":null,"uniqueKey":"oneOf.3.runtime.entrypoint.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.runtime.entrypoint","typeLabel":"string[] | null"},"log_level":{"oneOf":[{"type":"null","uniqueKey":"oneOf.3.runtime.log_level.oneOf.0","typeLabel":"null"},{"type":"string","description":"Runtime log level.","enum":["error","warn","info","debug","trace"],"uniqueKey":"oneOf.3.runtime.log_level.oneOf.1","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.3.runtime.log_level","typeLabel":"null | enum\u003cstring>"},"scripts":{"type":"object","description":"Named in-guest scripts.","default":{},"additionalProperties":{"type":"string","uniqueKey":"oneOf.3.runtime.scripts.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"oneOf.3.runtime.scripts","typeLabel":"object"},"shell":{"oneOf":[{"type":"string","description":"Default shell.","default":null,"uniqueKey":"oneOf.3.runtime.shell.oneOf.0","typeLabel":"string"},{"type":"null","description":"Default shell.","default":null,"uniqueKey":"oneOf.3.runtime.shell.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.runtime.shell","typeLabel":"string | null"},"user":{"oneOf":[{"type":"string","description":"Guest user.","default":null,"uniqueKey":"oneOf.3.runtime.user.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest user.","default":null,"uniqueKey":"oneOf.3.runtime.user.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.runtime.user","typeLabel":"string | null"},"workdir":{"oneOf":[{"type":"string","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.3.runtime.workdir.oneOf.0","typeLabel":"string"},{"type":"null","description":"Working directory for guest commands.","default":null,"uniqueKey":"oneOf.3.runtime.workdir.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.runtime.workdir","typeLabel":"string | null"}},"uniqueKey":"oneOf.3.runtime","typeLabel":"object"},"security_profile":{"type":"string","description":"In-guest security profile.","default":"default","enum":["default","restricted"],"uniqueKey":"oneOf.3.security_profile","typeLabel":"enum\u003cstring>"},"pull_policy":{"type":"string","description":"Pull policy used if the snapshot's pinned base image must be fetched.","enum":["if_missing","always","never"],"uniqueKey":"oneOf.3.pull_policy","typeLabel":"enum\u003cstring>"},"resources":{"type":"object","description":"CPU and memory resources.","properties":{"memory_mib":{"type":"integer","format":"int32","description":"Guest memory in MiB.","default":512,"minimum":0,"uniqueKey":"oneOf.3.resources.memory_mib","typeLabel":"integer\u003cint32>"},"vcpus":{"type":"integer","format":"int32","description":"Number of virtual CPUs.","default":1,"minimum":0,"uniqueKey":"oneOf.3.resources.vcpus","typeLabel":"integer\u003cint32>"}},"uniqueKey":"oneOf.3.resources","typeLabel":"object"},"registry":{"oneOf":[{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["auto"],"isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.0.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.registry.oneOf.0","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["mode"],"properties":{"mode":{"type":"string","enum":["anonymous"],"isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.1.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.registry.oneOf.1","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["credential_id","mode"],"properties":{"credential_id":{"type":"string","format":"uuid","description":"Id of a configured `OrgRegistryCredential` belonging to the org.","isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.2.credential_id","typeLabel":"string\u003cuuid>"},"mode":{"type":"string","enum":["specific"],"isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.2.mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.3.registry.oneOf.2","typeLabel":"object"},{"type":"object","description":"Registry-credential selection for the image pull. Absent ⇒ `Auto`\n(infer the credential from the image's registry host). Credential-only:\nthis never changes *where* the image is pulled from - the image string\ncontrols that - only *which* stored credential, if any, is presented.","required":["username","password","mode"],"properties":{"mode":{"type":"string","enum":["inline"],"isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.3.mode","typeLabel":"enum\u003cstring>"},"password":{"type":"string","format":"password","description":"Registry password or access token. Always redacted from `Debug`.","isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.3.password","typeLabel":"string\u003cpassword>"},"username":{"type":"string","description":"Registry username.","isRequired":true,"uniqueKey":"oneOf.3.registry.oneOf.3.username","typeLabel":"string"}},"uniqueKey":"oneOf.3.registry.oneOf.3","typeLabel":"object"}],"uniqueKey":"oneOf.3.registry","typeLabel":"object"},"slug":{"oneOf":[{"type":"string","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.3.slug.oneOf.0","typeLabel":"string"},{"type":"null","description":"Optional globally-unique slug - the SSH username token. Lowercase\nletters, digits, and single hyphens; 3-63 chars. Omitted ⇒ a dictionary\nslug is generated. Must be globally unique (409 on conflict).","uniqueKey":"oneOf.3.slug.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.3.slug","typeLabel":"string | null"}},"uniqueKey":"oneOf.3","typeLabel":"object"}],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"name":"","reference":"\u003cstring>","source":"oci","env":[],"init":{"cmd":"\u003cstring>","args":["\u003cstring>"],"env":[["\u003cstring>","\u003cstring>"]]},"labels":{},"lifecycle":{"ephemeral":false,"idle_timeout_secs":null,"max_duration_secs":null},"mounts":[],"network":{"enabled":true,"strict":true},"rlimits":[],"runtime":{"cmd":null,"entrypoint":null,"log_level":null,"scripts":{},"shell":null,"user":null,"workdir":null},"security_profile":"default","patches":[{"content":"\u003cstring>","path":"\u003cstring>","replace":true,"type":"text","mode":1}],"resources":{"disk_size_mib":null,"memory_mib":512,"vcpus":1},"registry":{"mode":"auto"},"slug":"\u003cstring>"}}},"exampleType":"generated"}},"required":true,"exampleType":"generated"},"responses":{"e29be6e6-c96b-4fa2-af6b-04e114bccc3e":{"description":"Sandbox created","content":{"application/json":{"schema":{"type":"object","description":"Sandbox details and resolved configuration.","required":["id","org_id","name","slug","status","ephemeral","created_at"],"properties":{"created_at":{"type":"string","format":"date-time","isRequired":true,"uniqueKey":"created_at","typeLabel":"string\u003cdate-time>"},"ephemeral":{"type":"boolean","isRequired":true,"uniqueKey":"ephemeral","typeLabel":"boolean"},"id":{"type":"string","format":"uuid","isRequired":true,"uniqueKey":"id","typeLabel":"string\u003cuuid>"},"name":{"type":"string","isRequired":true,"uniqueKey":"name","typeLabel":"string"},"org_id":{"type":"string","format":"uuid","isRequired":true,"uniqueKey":"org_id","typeLabel":"string\u003cuuid>"},"slug":{"type":"string","isRequired":true,"uniqueKey":"slug","typeLabel":"string"},"status":{"type":"string","description":"Sandbox lifecycle status.","enum":["created","starting","running","temporarily_unavailable","recovery_decision_required","stopping","stopped","failed"],"isRequired":true,"uniqueKey":"status","typeLabel":"enum\u003cstring>"},"automatic_recovery_ends_at":{"oneOf":[{"type":"string","format":"date-time","description":"When an explicit recovery choice becomes necessary.","uniqueKey":"automatic_recovery_ends_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"When an explicit recovery choice becomes necessary.","uniqueKey":"automatic_recovery_ends_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"automatic_recovery_ends_at","typeLabel":"string\u003cdate-time> | null"},"last_failure_message":{"oneOf":[{"type":"string","description":"Human-readable reason for the last failure.","uniqueKey":"last_failure_message.oneOf.0","typeLabel":"string"},{"type":"null","description":"Human-readable reason for the last failure.","uniqueKey":"last_failure_message.oneOf.1","typeLabel":"null"}],"uniqueKey":"last_failure_message","typeLabel":"string | null"},"spec":{"oneOf":[{"type":"null","uniqueKey":"spec.oneOf.0","typeLabel":"null"},{"type":"object","description":"Curated projection of the resolved spec; absent until resolved.","required":["resources","runtime","env","labels","rlimits","lifecycle","mounts","network"],"properties":{"env":{"type":"array","items":{"type":"object","description":"Environment variable entry.","required":["key","value"],"properties":{"key":{"type":"string","description":"Environment variable name.","isRequired":true,"uniqueKey":"spec.oneOf.1.env.items.[INDEX].key","typeLabel":"string"},"value":{"type":"string","description":"Environment variable value.","isRequired":true,"uniqueKey":"spec.oneOf.1.env.items.[INDEX].value","typeLabel":"string"}},"uniqueKey":"spec.oneOf.1.env.items.[INDEX]","typeLabel":"object"},"description":"Environment variables.","isRequired":true,"uniqueKey":"spec.oneOf.1.env","typeLabel":"object[]"},"labels":{"type":"object","description":"User-defined labels.","additionalProperties":{"type":"string","uniqueKey":"spec.oneOf.1.labels.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"isRequired":true,"uniqueKey":"spec.oneOf.1.labels","typeLabel":"object"},"lifecycle":{"type":"object","description":"Lifecycle policy.","properties":{"ephemeral":{"type":"boolean","description":"Whether the sandbox is ephemeral.\n\nEphemeral sandboxes are one-off: the host runtime that owns the\nprocess removes the persisted DB row and on-disk state when the VM\nreaches a terminal status, and other host runtimes opportunistically\nclean up ephemeral leftovers from runtimes that died before they\ncould self-clean. Defaults to `false` (persistent); named and created\nsandboxes stay inspectable and restartable after they stop.","uniqueKey":"spec.oneOf.1.lifecycle.ephemeral","typeLabel":"boolean"},"idle_timeout_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"spec.oneOf.1.lifecycle.idle_timeout_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Idle timeout in seconds. `None` = no idle detection.","minimum":0,"uniqueKey":"spec.oneOf.1.lifecycle.idle_timeout_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.lifecycle.idle_timeout_secs","typeLabel":"integer\u003cint64> | null"},"max_duration_secs":{"oneOf":[{"type":"integer","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"spec.oneOf.1.lifecycle.max_duration_secs.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Hard cap on total sandbox lifetime in seconds. `None` = run forever.","minimum":0,"uniqueKey":"spec.oneOf.1.lifecycle.max_duration_secs.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.lifecycle.max_duration_secs","typeLabel":"integer\u003cint64> | null"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.lifecycle","typeLabel":"object"},"mounts":{"type":"array","items":{"oneOf":[{"type":"object","description":"A mount, projected for the user: guest path + options, never the resolved\nvolume id / source.","required":["guest","options","stat_virtualization","host_permissions","type"],"properties":{"guest":{"type":"string","isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.guest","typeLabel":"string"},"host_permissions":{"type":"string","description":"Host permission propagation policy for a virtiofs-backed volume mount.\n\nSerializes/deserializes as the lowercase variant name (`\"private\"`, `\"mirror\"`) to align with the CLI and NAPI spellings.","enum":["private","mirror"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Guest mount behavior shared by every volume mount kind.","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options.readonly","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.options","typeLabel":"object"},"stat_virtualization":{"type":"string","description":"Stat virtualization policy for a virtiofs-backed volume mount.\n\nSerializes/deserializes as the lowercase variant name (`\"strict\"`, `\"relaxed\"`, `\"off\"`) so persisted JSON aligns with the CLI grammar (`stat-virt=strict|relaxed|off`) and the NAPI string contract.","enum":["strict","relaxed","off"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.stat_virtualization","typeLabel":"enum\u003cstring>"},"type":{"type":"string","enum":["Bind"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.type","typeLabel":"enum\u003cstring>"},"quota_mib":{"oneOf":[{"type":"integer","format":"int32","minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.quota_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0.quota_mib","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"A mount, projected for the user: guest path + options, never the resolved\nvolume id / source.","required":["guest","options","stat_virtualization","host_permissions","type"],"properties":{"guest":{"type":"string","isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.guest","typeLabel":"string"},"host_permissions":{"type":"string","description":"Host permission propagation policy for a virtiofs-backed volume mount.\n\nSerializes/deserializes as the lowercase variant name (`\"private\"`, `\"mirror\"`) to align with the CLI and NAPI spellings.","enum":["private","mirror"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.host_permissions","typeLabel":"enum\u003cstring>"},"options":{"type":"object","description":"Guest mount behavior shared by every volume mount kind.","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options.readonly","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.options","typeLabel":"object"},"stat_virtualization":{"type":"string","description":"Stat virtualization policy for a virtiofs-backed volume mount.\n\nSerializes/deserializes as the lowercase variant name (`\"strict\"`, `\"relaxed\"`, `\"off\"`) so persisted JSON aligns with the CLI grammar (`stat-virt=strict|relaxed|off`) and the NAPI string contract.","enum":["strict","relaxed","off"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.stat_virtualization","typeLabel":"enum\u003cstring>"},"type":{"type":"string","enum":["Named"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"A mount, projected for the user: guest path + options, never the resolved\nvolume id / source.","required":["guest","options","type"],"properties":{"guest":{"type":"string","isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.guest","typeLabel":"string"},"options":{"type":"object","description":"Guest mount behavior shared by every volume mount kind.","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options.readonly","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.options","typeLabel":"object"},"type":{"type":"string","enum":["Tmpfs"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.type","typeLabel":"enum\u003cstring>"},"size_mib":{"oneOf":[{"type":"integer","format":"int32","minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2.size_mib","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"A mount, projected for the user: guest path + options, never the resolved\nvolume id / source.","required":["guest","format","options","type"],"properties":{"format":{"type":"string","description":"Disk image format for virtio-blk root filesystems and volume mounts.","enum":["Qcow2","Raw","Vmdk"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.format","typeLabel":"enum\u003cstring>"},"guest":{"type":"string","isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.guest","typeLabel":"string"},"options":{"type":"object","description":"Guest mount behavior shared by every volume mount kind.","properties":{"nodev":{"type":"boolean","description":"Whether device files on the mount are ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.nodev","typeLabel":"boolean"},"noexec":{"type":"boolean","description":"Whether direct execution from the mount is disabled.\n\nThis prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.noexec","typeLabel":"boolean"},"nosuid":{"type":"boolean","description":"Whether setuid and setgid privilege elevation from files on the mount is ignored.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.nosuid","typeLabel":"boolean"},"override_gid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest gid presented for host files under this mount that carry no\nper-file stat override. See [`override_uid`](Self::override_uid); the two\nmust be set together.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_gid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_gid","typeLabel":"integer\u003cint32> | null"},"override_uid":{"oneOf":[{"type":"integer","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Guest uid presented for host files under this mount that carry no\nper-file stat override.\n\nHost-created files (written outside the guest) have no override, so\nwithout this they surface with the runtime's fallback owner. When set,\nsuch files are presented as this uid instead. Must be set together with\n[`override_gid`](Self::override_gid). `None` keeps the fallback.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_uid.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.override_uid","typeLabel":"integer\u003cint32> | null"},"readonly":{"type":"boolean","description":"Whether the mount is read-only.\n\nGuest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.","default":false,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options.readonly","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.options","typeLabel":"object"},"type":{"type":"string","enum":["DiskImage"],"isRequired":true,"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.type","typeLabel":"enum\u003cstring>"},"fstype":{"oneOf":[{"type":"string","uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.fstype.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.fstype.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3.fstype","typeLabel":"string | null"}},"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX].oneOf.3","typeLabel":"object"}],"uniqueKey":"spec.oneOf.1.mounts.items.[INDEX]","typeLabel":"object"},"description":"Volume mounts - guest path + options only; volume ids omitted.","isRequired":true,"uniqueKey":"spec.oneOf.1.mounts","typeLabel":"object[]"},"network":{"type":"object","description":"Network config - secret values/vault paths omitted.","required":["enabled","ports","trust_host_cas"],"properties":{"enabled":{"type":"boolean","isRequired":true,"uniqueKey":"spec.oneOf.1.network.enabled","typeLabel":"boolean"},"ports":{"type":"array","items":{"type":"object","description":"A published port mapping between host and guest.","required":["host_port","guest_port","host_bind"],"properties":{"guest_port":{"type":"integer","format":"int32","description":"Guest-side port to forward to.","minimum":0,"isRequired":true,"uniqueKey":"spec.oneOf.1.network.ports.items.[INDEX].guest_port","typeLabel":"integer\u003cint32>"},"host_bind":{"type":"string","description":"Host address to bind. Defaults to loopback.","isRequired":true,"uniqueKey":"spec.oneOf.1.network.ports.items.[INDEX].host_bind","typeLabel":"string"},"host_port":{"type":"integer","format":"int32","description":"Host-side port to bind.","minimum":0,"isRequired":true,"uniqueKey":"spec.oneOf.1.network.ports.items.[INDEX].host_port","typeLabel":"integer\u003cint32>"},"protocol":{"type":"string","description":"Transport protocol.","enum":["tcp","udp"],"uniqueKey":"spec.oneOf.1.network.ports.items.[INDEX].protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"spec.oneOf.1.network.ports.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"spec.oneOf.1.network.ports","typeLabel":"object[]"},"trust_host_cas":{"type":"boolean","isRequired":true,"uniqueKey":"spec.oneOf.1.network.trust_host_cas","typeLabel":"boolean"},"dns":{"oneOf":[{"type":"null","uniqueKey":"spec.oneOf.1.network.dns.oneOf.0","typeLabel":"null"},{"type":"object","description":"DNS interception and filtering settings. Carried in [`NetworkSpec::dns`].","properties":{"nameservers":{"type":"array","items":{"type":"string","uniqueKey":"spec.oneOf.1.network.dns.oneOf.1.nameservers.items.[INDEX]","typeLabel":"string"},"description":"Upstream nameservers as `IP`, `IP:PORT`, `HOST`, or `HOST:PORT`\nstrings. Empty falls back to the host's `/etc/resolv.conf`.","default":[],"uniqueKey":"spec.oneOf.1.network.dns.oneOf.1.nameservers","typeLabel":"string[]"},"query_timeout_ms":{"type":"integer","format":"int64","description":"Per-query timeout in milliseconds. Default: 5000.","default":5000,"minimum":0,"uniqueKey":"spec.oneOf.1.network.dns.oneOf.1.query_timeout_ms","typeLabel":"integer\u003cint64>"},"rebind_protection":{"type":"boolean","description":"Whether DNS-rebinding protection is enabled. Default: true.","default":true,"uniqueKey":"spec.oneOf.1.network.dns.oneOf.1.rebind_protection","typeLabel":"boolean"}},"uniqueKey":"spec.oneOf.1.network.dns.oneOf.1","typeLabel":"object"}],"uniqueKey":"spec.oneOf.1.network.dns","typeLabel":"null | object"},"interface":{"oneOf":[{"type":"null","uniqueKey":"spec.oneOf.1.network.interface.oneOf.0","typeLabel":"null"},{"type":"object","description":"Optional guest interface overrides. Unset fields are derived from the\nsandbox slot by the local network engine. Carried in\n[`NetworkSpec::interface`].","properties":{"ipv4_address":{"oneOf":[{"type":"string","description":"Guest IPv4 address (e.g. `172.16.0.2`). Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv4_address.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest IPv4 address (e.g. `172.16.0.2`). Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv4_address.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv4_address","typeLabel":"string | null"},"ipv4_pool":{"oneOf":[{"type":"string","description":"Guest IPv4 pool CIDR (e.g. `\"172.16.0.0/12\"`). Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv4_pool.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest IPv4 pool CIDR (e.g. `\"172.16.0.0/12\"`). Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv4_pool.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv4_pool","typeLabel":"string | null"},"ipv6_address":{"oneOf":[{"type":"string","description":"Guest IPv6 address. Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv6_address.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest IPv6 address. Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv6_address.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv6_address","typeLabel":"string | null"},"ipv6_pool":{"oneOf":[{"type":"string","description":"Guest IPv6 pool CIDR. Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv6_pool.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest IPv6 pool CIDR. Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv6_pool.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.ipv6_pool","typeLabel":"string | null"},"mac":{"oneOf":[{"type":"array","items":{"type":"integer","format":"int32","minimum":0,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mac.oneOf.0.items.[INDEX]","typeLabel":"integer\u003cint32>"},"description":"Guest MAC address as six octets. Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mac.oneOf.0","typeLabel":"integer\u003cint32>[]"},{"type":"null","items":{"type":"integer","format":"int32","minimum":0},"description":"Guest MAC address as six octets. Default: derived from slot.","default":null,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mac.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mac","typeLabel":"integer\u003cint32>[] | null"},"mtu":{"oneOf":[{"type":"integer","format":"int32","description":"Interface MTU. Default: 1500.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mtu.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Interface MTU. Default: 1500.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mtu.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1.mtu","typeLabel":"integer\u003cint32> | null"}},"uniqueKey":"spec.oneOf.1.network.interface.oneOf.1","typeLabel":"object"}],"uniqueKey":"spec.oneOf.1.network.interface","typeLabel":"null | object"},"max_connections":{"oneOf":[{"type":"integer","minimum":0,"uniqueKey":"spec.oneOf.1.network.max_connections.oneOf.0","typeLabel":"integer"},{"type":"null","minimum":0,"uniqueKey":"spec.oneOf.1.network.max_connections.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.max_connections","typeLabel":"integer | null"},"policy":{"oneOf":[{"type":"null","uniqueKey":"spec.oneOf.1.network.policy.oneOf.0","typeLabel":"null"},{"type":"object","description":"Egress/ingress network policy: an ordered [`Rule`] list plus a\nper-direction default [`Action`]. Carried in [`NetworkSpec::policy`].","properties":{"default_egress":{"type":"string","description":"Default action for egress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.default_egress","typeLabel":"enum\u003cstring>"},"default_ingress":{"type":"string","description":"Default action for ingress traffic matching no rule. Default: `Deny`.","enum":["allow","deny"],"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.default_ingress","typeLabel":"enum\u003cstring>"},"rules":{"type":"array","items":{"type":"object","description":"A single egress/ingress policy rule. Evaluated first-match-wins per\ndirection.","required":["direction","destination","action"],"properties":{"action":{"type":"string","description":"Action to take on a match.","enum":["allow","deny"],"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].action","typeLabel":"enum\u003cstring>"},"destination":{"oneOf":[{"type":"string","description":"Destination filter (direction-dependent interpretation).","enum":["any"],"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["cidr"],"properties":{"cidr":{"type":"string","description":"IP address or CIDR block (e.g. `\"1.2.3.4\"`, `\"10.0.0.0/8\"`).","isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1.cidr","typeLabel":"string"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.1","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain"],"properties":{"domain":{"type":"string","description":"Exact domain name (e.g. `\"example.com\"`).","isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2.domain","typeLabel":"string"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.2","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["domain_suffix"],"properties":{"domain_suffix":{"type":"string","description":"Domain suffix - the apex and any subdomain of it.","isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3.domain_suffix","typeLabel":"string"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.3","typeLabel":"object"},{"type":"object","description":"Destination filter (direction-dependent interpretation).","required":["group"],"properties":{"group":{"type":"string","description":"A pre-defined destination group.","enum":["public","loopback","private","link_local","metadata","multicast","host"],"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4.group","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination.oneOf.4","typeLabel":"object"}],"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].destination","typeLabel":"enum\u003cstring> · object · object · object · object"},"direction":{"type":"string","description":"Direction this rule applies to.","enum":["egress","ingress","any"],"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].direction","typeLabel":"enum\u003cstring>"},"ports":{"type":"array","items":{"type":"object","description":"Inclusive guest-side port range for a [`Rule`] match.","required":["start","end"],"properties":{"end":{"type":"integer","format":"int32","description":"End port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].end","typeLabel":"integer\u003cint32>"},"start":{"type":"integer","format":"int32","description":"Start port (inclusive).","minimum":0,"isRequired":true,"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX].start","typeLabel":"integer\u003cint32>"}},"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports.items.[INDEX]","typeLabel":"object"},"description":"Guest-side port-range set; empty matches any port.","uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].ports","typeLabel":"object[]"},"protocols":{"type":"array","items":{"type":"string","description":"Protocol filter for a [`Rule`].","enum":["tcp","udp","icmpv4","icmpv6"],"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].protocols.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"Protocol set; empty matches any protocol.","uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX].protocols","typeLabel":"enum\u003cstring>[]"}},"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules.items.[INDEX]","typeLabel":"object"},"description":"Ordered rules, evaluated first-match-wins per direction.","uniqueKey":"spec.oneOf.1.network.policy.oneOf.1.rules","typeLabel":"object[]"}},"uniqueKey":"spec.oneOf.1.network.policy.oneOf.1","typeLabel":"object"}],"uniqueKey":"spec.oneOf.1.network.policy","typeLabel":"null | object"},"secrets":{"type":"array","items":{"type":"object","description":"A network secret, projected for the user: the env var, placeholder, and its\nallow-list / injection policy. The value isn't in the resolved spec at all,\nand the OpenBao vault path is never exposed.","required":["env_var","placeholder","allowed_hosts","injection"],"properties":{"allowed_hosts":{"type":"array","items":{"type":"object","uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX].allowed_hosts.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX].allowed_hosts","typeLabel":"object[]"},"env_var":{"type":"string","isRequired":true,"uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX].env_var","typeLabel":"string"},"injection":{"type":"object","isRequired":true,"uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX].injection","typeLabel":"object"},"placeholder":{"type":"string","isRequired":true,"uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX].placeholder","typeLabel":"string"},"on_violation":{"type":"object","uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX].on_violation","typeLabel":"object"}},"uniqueKey":"spec.oneOf.1.network.secrets.items.[INDEX]","typeLabel":"object"},"uniqueKey":"spec.oneOf.1.network.secrets","typeLabel":"object[]"},"tls":{"oneOf":[{"type":"null","uniqueKey":"spec.oneOf.1.network.tls.oneOf.0","typeLabel":"null"},{"type":"object","description":"TLS interception configuration. Carried in [`NetworkSpec::tls`](NetworkSpec).\n\nThe local network engine terminates TCP at its in-process stack, so TLS MITM\nis handled by proxy tasks - these fields configure which ports/domains are\nintercepted and how the interception CA is sourced.","properties":{"block_quic_on_intercept":{"type":"boolean","description":"Drop UDP to intercepted ports when TLS interception is active, forcing\nQUIC traffic to fall back to TCP/TLS.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.block_quic_on_intercept","typeLabel":"boolean"},"bypass":{"type":"array","items":{"type":"string","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.bypass.items.[INDEX]","typeLabel":"string"},"description":"Domains to bypass (no MITM). Supports exact match and `*.suffix` wildcards.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.bypass","typeLabel":"string[]"},"cache":{"type":"object","description":"Per-domain certificate cache configuration.","properties":{"capacity":{"type":"integer","description":"Maximum number of cached certificates. Default: 1000.","minimum":0,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.cache.capacity","typeLabel":"integer"},"validity_hours":{"type":"integer","format":"int64","description":"Certificate validity duration in hours. Default: 24.","minimum":0,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.cache.validity_hours","typeLabel":"integer\u003cint64>"}},"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.cache","typeLabel":"object"},"enabled":{"type":"boolean","description":"Whether TLS interception is enabled.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.enabled","typeLabel":"boolean"},"intercept_ca":{"type":"object","description":"Interception CA configuration. The TLS proxy uses this CA to sign\nper-domain certs it presents to the guest during interception.","properties":{"cert_path":{"oneOf":[{"type":"string","description":"Path to an existing CA certificate PEM file. If `None`, a CA is\nauto-generated and persisted.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca.cert_path.oneOf.0","typeLabel":"string"},{"type":"null","description":"Path to an existing CA certificate PEM file. If `None`, a CA is\nauto-generated and persisted.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca.cert_path.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca.cert_path","typeLabel":"string | null"},"key_path":{"oneOf":[{"type":"string","description":"Path to an existing CA private key PEM file. If `None`, a key is\nauto-generated and persisted.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca.key_path.oneOf.0","typeLabel":"string"},{"type":"null","description":"Path to an existing CA private key PEM file. If `None`, a key is\nauto-generated and persisted.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca.key_path.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca.key_path","typeLabel":"string | null"}},"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercept_ca","typeLabel":"object"},"intercepted_ports":{"type":"array","items":{"type":"integer","format":"int32","minimum":0,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercepted_ports.items.[INDEX]","typeLabel":"integer\u003cint32>"},"description":"TCP ports subject to TLS interception (default: `[443]`).","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.intercepted_ports","typeLabel":"integer\u003cint32>[]"},"scoped_upstream_ca_cert":{"type":"array","items":{"type":"object","description":"A CA certificate PEM file trusted only for matching upstream hosts.","required":["pattern","path"],"properties":{"path":{"type":"string","description":"Path to the CA certificate PEM file.","isRequired":true,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_upstream_ca_cert.items.[INDEX].path","typeLabel":"string"},"pattern":{"type":"string","description":"Host pattern this CA applies to. Supports exact hosts and `*.suffix` wildcards.","isRequired":true,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_upstream_ca_cert.items.[INDEX].pattern","typeLabel":"string"}},"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_upstream_ca_cert.items.[INDEX]","typeLabel":"object"},"description":"Host-scoped CA certificate PEM files to trust for upstream server verification.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_upstream_ca_cert","typeLabel":"object[]"},"scoped_verify_upstream":{"type":"array","items":{"type":"object","description":"An upstream certificate verification override for matching hosts.","required":["pattern","verify"],"properties":{"pattern":{"type":"string","description":"Host pattern this override applies to. Supports exact hosts and `*.suffix` wildcards.","isRequired":true,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_verify_upstream.items.[INDEX].pattern","typeLabel":"string"},"verify":{"type":"boolean","description":"Whether to verify matching upstream server certificates.","isRequired":true,"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_verify_upstream.items.[INDEX].verify","typeLabel":"boolean"}},"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_verify_upstream.items.[INDEX]","typeLabel":"object"},"description":"Host-scoped upstream verification overrides.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.scoped_verify_upstream","typeLabel":"object[]"},"upstream_ca_cert":{"type":"array","items":{"type":"string","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.upstream_ca_cert.items.[INDEX]","typeLabel":"string"},"description":"CA certificate PEM files to trust for upstream server verification.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.upstream_ca_cert","typeLabel":"string[]"},"verify_upstream":{"type":"boolean","description":"Whether to verify the upstream server's TLS certificate.","uniqueKey":"spec.oneOf.1.network.tls.oneOf.1.verify_upstream","typeLabel":"boolean"}},"uniqueKey":"spec.oneOf.1.network.tls.oneOf.1","typeLabel":"object"}],"uniqueKey":"spec.oneOf.1.network.tls","typeLabel":"null | object"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.network","typeLabel":"object"},"resources":{"type":"object","description":"CPU, memory, and writable-disk sizing.","properties":{"disk_size_mib":{"oneOf":[{"type":"integer","format":"int32","description":"Writable disk size in MiB. Applies only to OCI root filesystems.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.resources.disk_size_mib.oneOf.0","typeLabel":"integer\u003cint32>"},{"type":"null","format":"int32","description":"Writable disk size in MiB. Applies only to OCI root filesystems.","default":null,"minimum":0,"uniqueKey":"spec.oneOf.1.resources.disk_size_mib.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.resources.disk_size_mib","typeLabel":"integer\u003cint32> | null"},"memory_mib":{"type":"integer","format":"int32","description":"Guest memory in MiB.","default":512,"minimum":0,"uniqueKey":"spec.oneOf.1.resources.memory_mib","typeLabel":"integer\u003cint32>"},"vcpus":{"type":"integer","format":"int32","description":"Number of virtual CPUs.","default":1,"minimum":0,"uniqueKey":"spec.oneOf.1.resources.vcpus","typeLabel":"integer\u003cint32>"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.resources","typeLabel":"object"},"rlimits":{"type":"array","items":{"type":"object","description":"A POSIX resource limit.","required":["resource","soft","hard"],"properties":{"hard":{"type":"integer","format":"int64","description":"Hard limit (ceiling, requires privileges to raise).","minimum":0,"isRequired":true,"uniqueKey":"spec.oneOf.1.rlimits.items.[INDEX].hard","typeLabel":"integer\u003cint64>"},"resource":{"type":"string","description":"Resource type.","enum":["Cpu","Fsize","Data","Stack","Core","Rss","Nproc","Nofile","Memlock","As","Locks","Sigpending","Msgqueue","Nice","Rtprio","Rttime"],"isRequired":true,"uniqueKey":"spec.oneOf.1.rlimits.items.[INDEX].resource","typeLabel":"enum\u003cstring>"},"soft":{"type":"integer","format":"int64","description":"Soft limit (can be raised up to hard limit by the process).","minimum":0,"isRequired":true,"uniqueKey":"spec.oneOf.1.rlimits.items.[INDEX].soft","typeLabel":"integer\u003cint64>"}},"uniqueKey":"spec.oneOf.1.rlimits.items.[INDEX]","typeLabel":"object"},"description":"Resource limits.","isRequired":true,"uniqueKey":"spec.oneOf.1.rlimits","typeLabel":"object[]"},"runtime":{"type":"object","description":"Guest runtime options.","properties":{"cmd":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"spec.oneOf.1.runtime.cmd.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Image command override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.cmd.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Image command override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.cmd.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.cmd","typeLabel":"string[] | null"},"disable_metrics_sample":{"type":"boolean","description":"Force-disable metrics sampling regardless of `metrics_sample_interval_ms`.","default":false,"uniqueKey":"spec.oneOf.1.runtime.disable_metrics_sample","typeLabel":"boolean"},"entrypoint":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"spec.oneOf.1.runtime.entrypoint.oneOf.0.items.[INDEX]","typeLabel":"string"},"description":"Image entrypoint override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.entrypoint.oneOf.0","typeLabel":"string[]"},{"type":"null","items":{"type":"string"},"description":"Image entrypoint override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.entrypoint.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.entrypoint","typeLabel":"string[] | null"},"hostname":{"oneOf":[{"type":"string","description":"Guest hostname override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.hostname.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest hostname override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.hostname.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.hostname","typeLabel":"string | null"},"log_level":{"oneOf":[{"type":"null","uniqueKey":"spec.oneOf.1.runtime.log_level.oneOf.0","typeLabel":"null"},{"type":"string","description":"Runtime log verbosity.","enum":["error","warn","info","debug","trace"],"uniqueKey":"spec.oneOf.1.runtime.log_level.oneOf.1","typeLabel":"enum\u003cstring>"}],"uniqueKey":"spec.oneOf.1.runtime.log_level","typeLabel":"null | enum\u003cstring>"},"metrics_sample_interval_ms":{"oneOf":[{"type":"integer","format":"int64","description":"Metrics sampling interval in milliseconds. `None` disables sampling.","default":1000,"minimum":0,"uniqueKey":"spec.oneOf.1.runtime.metrics_sample_interval_ms.oneOf.0","typeLabel":"integer\u003cint64>"},{"type":"null","format":"int64","description":"Metrics sampling interval in milliseconds. `None` disables sampling.","default":1000,"minimum":0,"uniqueKey":"spec.oneOf.1.runtime.metrics_sample_interval_ms.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.metrics_sample_interval_ms","typeLabel":"integer\u003cint64> | null"},"scripts":{"type":"object","description":"Named scripts available inside the guest.","default":{},"additionalProperties":{"type":"string","uniqueKey":"spec.oneOf.1.runtime.scripts.additionalProperties","typeLabel":"string"},"propertyNames":{"type":"string"},"uniqueKey":"spec.oneOf.1.runtime.scripts","typeLabel":"object"},"shell":{"oneOf":[{"type":"string","description":"Default shell for scripts and interactive sessions.","default":null,"uniqueKey":"spec.oneOf.1.runtime.shell.oneOf.0","typeLabel":"string"},{"type":"null","description":"Default shell for scripts and interactive sessions.","default":null,"uniqueKey":"spec.oneOf.1.runtime.shell.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.shell","typeLabel":"string | null"},"user":{"oneOf":[{"type":"string","description":"Guest user identity override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.user.oneOf.0","typeLabel":"string"},{"type":"null","description":"Guest user identity override.","default":null,"uniqueKey":"spec.oneOf.1.runtime.user.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.user","typeLabel":"string | null"},"workdir":{"oneOf":[{"type":"string","description":"Working directory inside the guest.","default":null,"uniqueKey":"spec.oneOf.1.runtime.workdir.oneOf.0","typeLabel":"string"},{"type":"null","description":"Working directory inside the guest.","default":null,"uniqueKey":"spec.oneOf.1.runtime.workdir.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.runtime.workdir","typeLabel":"string | null"}},"isRequired":true,"uniqueKey":"spec.oneOf.1.runtime","typeLabel":"object"},"image":{"oneOf":[{"type":"string","description":"OCI image reference the sandbox boots; `null` for a non-OCI rootfs.","uniqueKey":"spec.oneOf.1.image.oneOf.0","typeLabel":"string"},{"type":"null","description":"OCI image reference the sandbox boots; `null` for a non-OCI rootfs.","uniqueKey":"spec.oneOf.1.image.oneOf.1","typeLabel":"null"}],"uniqueKey":"spec.oneOf.1.image","typeLabel":"string | null"}},"uniqueKey":"spec.oneOf.1","typeLabel":"object"}],"uniqueKey":"spec","typeLabel":"null | object"},"started_at":{"oneOf":[{"type":"string","format":"date-time","description":"Latest run's start time; `null` if the sandbox has never run.","uniqueKey":"started_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"Latest run's start time; `null` if the sandbox has never run.","uniqueKey":"started_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"started_at","typeLabel":"string\u003cdate-time> | null"},"status_reason":{"oneOf":[{"type":"null","uniqueKey":"status_reason.oneOf.0","typeLabel":"null"},{"type":"string","description":"Scheduler condition while `status` is `starting`.","enum":["scheduling","insufficient_capacity"],"uniqueKey":"status_reason.oneOf.1","typeLabel":"enum\u003cstring>"}],"uniqueKey":"status_reason","typeLabel":"null | enum\u003cstring>"},"stopped_at":{"oneOf":[{"type":"string","format":"date-time","description":"Latest run's stop time; `null` while open or never run.","uniqueKey":"stopped_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"Latest run's stop time; `null` while open or never run.","uniqueKey":"stopped_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"stopped_at","typeLabel":"string\u003cdate-time> | null"},"temporarily_unavailable_since":{"oneOf":[{"type":"string","format":"date-time","description":"When the current worker outage became user-visible.","uniqueKey":"temporarily_unavailable_since.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"When the current worker outage became user-visible.","uniqueKey":"temporarily_unavailable_since.oneOf.1","typeLabel":"null"}],"uniqueKey":"temporarily_unavailable_since","typeLabel":"string\u003cdate-time> | null"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"created_at":"2023-11-07T05:31:56Z","ephemeral":true,"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","name":"\u003cstring>","org_id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","slug":"\u003cstring>","status":"created","automatic_recovery_ends_at":"2023-11-07T05:31:56Z","last_failure_message":"\u003cstring>","spec":{"env":[{"key":"\u003cstring>","value":"\u003cstring>"}],"labels":{},"lifecycle":{"ephemeral":true,"idle_timeout_secs":1,"max_duration_secs":1},"mounts":[{"guest":"\u003cstring>","host_permissions":"private","options":{"nodev":false,"noexec":false,"nosuid":false,"override_gid":null,"override_uid":null,"readonly":false},"stat_virtualization":"strict","type":"Bind","quota_mib":1}],"network":{"enabled":true,"ports":[{"guest_port":1,"host_bind":"\u003cstring>","host_port":1,"protocol":"tcp"}],"trust_host_cas":true,"dns":{"nameservers":[],"query_timeout_ms":5000,"rebind_protection":true},"interface":{"ipv4_address":null,"ipv4_pool":null,"ipv6_address":null,"ipv6_pool":null,"mac":null,"mtu":null},"max_connections":1,"policy":{"default_egress":"allow","default_ingress":"allow","rules":[{"action":"allow","destination":"any","direction":"egress","ports":[{"end":1,"start":1}],"protocols":["tcp"]}]},"secrets":[{"allowed_hosts":[{}],"env_var":"\u003cstring>","injection":{},"placeholder":"\u003cstring>","on_violation":{}}],"tls":{"block_quic_on_intercept":true,"bypass":["\u003cstring>"],"cache":{"capacity":1,"validity_hours":1},"enabled":true,"intercept_ca":{"cert_path":"\u003cstring>","key_path":"\u003cstring>"},"intercepted_ports":[1],"scoped_upstream_ca_cert":[{"path":"\u003cstring>","pattern":"\u003cstring>"}],"scoped_verify_upstream":[{"pattern":"\u003cstring>","verify":true}],"upstream_ca_cert":["\u003cstring>"],"verify_upstream":true}},"resources":{"disk_size_mib":null,"memory_mib":512,"vcpus":1},"rlimits":[{"hard":1,"resource":"Cpu","soft":1}],"runtime":{"cmd":null,"disable_metrics_sample":false,"entrypoint":null,"hostname":null,"log_level":"error","metrics_sample_interval_ms":1000,"scripts":{},"shell":null,"user":null,"workdir":null},"image":"\u003cstring>"},"started_at":"2023-11-07T05:31:56Z","status_reason":"scheduling","stopped_at":"2023-11-07T05:31:56Z","temporarily_unavailable_since":"2023-11-07T05:31:56Z"}}},"exampleType":"generated"}},"exampleType":"generated"},"baabd84e-3f45-48ed-b5f6-622b8995f8c1":{"description":"Invalid request","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"3cd51e65-0ef5-4fc8-ab23-257e859e8795":{"description":"Unauthorized","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"9bf7b1ff-eb00-45c5-9baf-94ed6496c2e5":{"description":"Name already exists","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"1238308b-4d50-4d73-9d88-c5f577f960a1":{"description":"Readiness wait capacity exhausted","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"44d33067-0968-4690-bdd5-58988bea2d1d":{"description":"Orchestrator unreachable","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}}},"security":{"e587cab0-1188-4c52-bbab-5da312fb3013":{"bearer":{"type":"http","scheme":"bearer","description":"Personal access token (msb_pat_…) or session JWT - the credential an agent acts with on a user's behalf.","scopes":[]}}},"servers":{"20699da7-735e-434b-ada4-05c003030c74":{"url":"https://api.microsandbox.dev"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"http","scheme":"bearer","description":"Personal access token (msb_pat_…) or session JWT - the credential an agent acts with on a user's behalf.","scopes":[]},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"Personal access token (msb_pat_…) or session JWT - the credential an agent acts with on a user's behalf.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"bearer","name":"Authorization"}],"title":"bearer"}]},"originalFileLocation":"api-reference/openapi.personal.json"},"subdomain":"superradcompanyinc","siteName":"microsandbox","title":"Create a sandbox - microsandbox","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-09-25T11:23:15.854Z","originalFileLocation":"api-reference/personal/sandboxes/create-a-sandbox.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"By default, the sandbox is created without starting. Use start=true to start it immediately and wait_for=running to wait until it is ready.\">\u003cmeta data-mint-head name=\"application-name\" content=\"microsandbox\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Create a sandbox - microsandbox\">\u003cmeta data-mint-head property=\"og:description\" content=\"By default, the sandbox is created without starting. Use start=true to start it immediately and wait_for=running to wait until it is ready.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"microsandbox\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://superradcompanyinc.mintlify.app/_mintlify/api/og/v2?division=Sandboxes\u0026amp;title=Create+a+sandbox\u0026amp;description=By+default%2C+the+sandbox+is+created+without+starting.+Use+%60start%3Dtrue%60+to%0Astart+it+immediately+and+%60wait_for%3Drunning%60+to+wait+until+it+is+ready.\u0026amp;theme=e6a860e1ee5ec499134ff755\u0026amp;signature=08fafba512668925f13df1e1cfce6162f3c9e87deff0fe1ad9238ce8d11cb2bf\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Create a sandbox - microsandbox\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"By default, the sandbox is created without starting. Use start=true to start it immediately and wait_for=running to wait until it is ready.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://superradcompanyinc.mintlify.app/_mintlify/api/og/v2?division=Sandboxes\u0026amp;title=Create+a+sandbox\u0026amp;description=By+default%2C+the+sandbox+is+created+without+starting.+Use+%60start%3Dtrue%60+to%0Astart+it+immediately+and+%60wait_for%3Drunning%60+to+wait+until+it+is+ready.\u0026amp;theme=e6a860e1ee5ec499134ff755\u0026amp;signature=08fafba512668925f13df1e1cfce6162f3c9e87deff0fe1ad9238ce8d11cb2bf\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/superradcompanyinc/h3Jg5czjZUv_Eh6R/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"microsandbox\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#BF84FE\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/personal/sandboxes/create-a-sandbox.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://microsandbox.dev/#organization\",\"name\":\"microsandbox\",\"url\":\"https://microsandbox.dev\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/superradcompanyinc/h2JI9gRxoad-oxxo/images/microsandbox-banner-light.svg?fit=max\u0026auto=format\u0026n=h2JI9gRxoad-oxxo\u0026q=85\u0026s=b45f81c0c0786037c520040351776f0c\"},\"sameAs\":[\"https://github.com/superradcompany/microsandbox\",\"https://www.linkedin.com/company/superradcompany\",\"https://x.com/microsandbox\"]},{\"@type\":\"WebSite\",\"@id\":\"https://docs.microsandbox.dev#website\",\"name\":\"microsandbox\",\"url\":\"https://docs.microsandbox.dev\",\"publisher\":{\"@id\":\"https://microsandbox.dev/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox#webpage\",\"url\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox\",\"name\":\"Create a sandbox\",\"description\":\"By default, the sandbox is created without starting. Use start=true to start it immediately and wait_for=running to wait until it is ready.\",\"dateModified\":\"2026-09-25T11:23:15.854Z\",\"isPartOf\":{\"@id\":\"https://docs.microsandbox.dev#website\"},\"breadcrumb\":{\"@id\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Personal tokens\",\"item\":\"https://docs.microsandbox.dev/api-reference/personal/account/get-your-profile\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Sandboxes\",\"item\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/check-sandbox-name-availability\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Create a sandbox\",\"item\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox#apireference\",\"headline\":\"Create a sandbox\",\"name\":\"Create a sandbox\",\"description\":\"By default, the sandbox is created without starting. Use start=true to start it immediately and wait_for=running to wait until it is ready.\",\"url\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox\",\"mainEntityOfPage\":{\"@id\":\"https://docs.microsandbox.dev/api-reference/personal/sandboxes/create-a-sandbox#webpage\"},\"dateModified\":\"2026-09-25T11:23:15.854Z\",\"publisher\":{\"@id\":\"https://microsandbox.dev/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.microsandbox.dev#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"microsandbox\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"microsandbox","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":"/getting-started/introduction"}]},{"tab":"SDKs \u0026 CLI","pages":[{"title":"SDKs \u0026 CLI","href":"/sdk/overview"}]},{"tab":"API Reference","groups":[{"group":"Getting Started","icon":"book-open","pages":[{"title":"Overview","icon":"book-open","href":"/api-reference/overview"}]},{"group":"API keys","icon":"key","pages":[{"group":"Sandboxes","pages":[{"title":"List sandboxes","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/sandboxes","href":"/api-reference/endpoints/sandboxes/list-sandboxes"},{"title":"Create a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/sandboxes","href":"/api-reference/endpoints/sandboxes/create-a-sandbox"},{"title":"Get a sandbox by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/sandboxes/by-name/{name}","href":"/api-reference/endpoints/sandboxes/get-a-sandbox-by-name"},{"title":"Delete a sandbox by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json delete /v1/sandboxes/by-name/{name}","href":"/api-reference/endpoints/sandboxes/delete-a-sandbox-by-name"},{"title":"Start a sandbox by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/sandboxes/by-name/{name}/start","href":"/api-reference/endpoints/sandboxes/start-a-sandbox-by-name"},{"title":"Stop a sandbox by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/sandboxes/by-name/{name}/stop","href":"/api-reference/endpoints/sandboxes/stop-a-sandbox-by-name"},{"title":"Get a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/sandboxes/{sandbox_id}","href":"/api-reference/endpoints/sandboxes/get-a-sandbox"},{"title":"Delete a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json delete /v1/sandboxes/{sandbox_id}","href":"/api-reference/endpoints/sandboxes/delete-a-sandbox"},{"title":"Update a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json patch /v1/sandboxes/{sandbox_id}","href":"/api-reference/endpoints/sandboxes/update-a-sandbox"},{"title":"Get sandbox metrics","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/sandboxes/{sandbox_id}/metrics","href":"/api-reference/endpoints/sandboxes/get-sandbox-metrics"},{"title":"Start a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/sandboxes/{sandbox_id}/start","href":"/api-reference/endpoints/sandboxes/start-a-sandbox"},{"title":"Stop a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/sandboxes/{sandbox_id}/stop","href":"/api-reference/endpoints/sandboxes/stop-a-sandbox"},{"title":"List mounted volumes","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/sandboxes/{sandbox_id}/volumes","href":"/api-reference/endpoints/sandboxes/list-mounted-volumes"}]},{"group":"Snapshots","pages":[{"title":"List snapshot candidates","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/sandboxes/snapshot-candidates","href":"/api-reference/endpoints/snapshots/list-snapshot-candidates"},{"title":"List snapshot operations","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/snapshot-operations","href":"/api-reference/endpoints/snapshots/list-snapshot-operations"},{"title":"Get a snapshot operation","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/snapshot-operations/{operation_id}","href":"/api-reference/endpoints/snapshots/get-a-snapshot-operation"},{"title":"List snapshots","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/snapshots","href":"/api-reference/endpoints/snapshots/list-snapshots"},{"title":"Create a snapshot","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/snapshots","href":"/api-reference/endpoints/snapshots/create-a-snapshot"},{"title":"Get a snapshot by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/snapshots/by-name/{name}","href":"/api-reference/endpoints/snapshots/get-a-snapshot-by-name"},{"title":"Delete a snapshot by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json delete /v1/snapshots/by-name/{name}","href":"/api-reference/endpoints/snapshots/delete-a-snapshot-by-name"},{"title":"Get a snapshot","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/snapshots/{snapshot_id}","href":"/api-reference/endpoints/snapshots/get-a-snapshot"},{"title":"Delete a snapshot","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json delete /v1/snapshots/{snapshot_id}","href":"/api-reference/endpoints/snapshots/delete-a-snapshot"}]},{"group":"Volumes","pages":[{"title":"List volumes","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes","href":"/api-reference/endpoints/volumes/list-volumes"},{"title":"Create a volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/volumes","href":"/api-reference/endpoints/volumes/create-a-volume"},{"title":"Get the default volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes/default","href":"/api-reference/endpoints/volumes/get-the-default-volume"},{"title":"Delete a volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json delete /v1/volumes/{id}","href":"/api-reference/endpoints/volumes/delete-a-volume"},{"title":"Update a volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json patch /v1/volumes/{id}","href":"/api-reference/endpoints/volumes/update-a-volume"},{"title":"List directory contents","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes/{id}/files","href":"/api-reference/endpoints/volumes/list-directory-contents"},{"title":"Delete a file or directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json delete /v1/volumes/{id}/files","href":"/api-reference/endpoints/volumes/delete-a-file-or-directory"},{"title":"Read a file","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes/{id}/files/content","href":"/api-reference/endpoints/volumes/read-a-file"},{"title":"Write a file","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json put /v1/volumes/{id}/files/content","href":"/api-reference/endpoints/volumes/write-a-file"},{"title":"Copy a file or directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/volumes/{id}/files/copy","href":"/api-reference/endpoints/volumes/copy-a-file-or-directory"},{"title":"Check if a file exists","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes/{id}/files/exists","href":"/api-reference/endpoints/volumes/check-if-a-file-exists"},{"title":"Create a directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/volumes/{id}/files/mkdir","href":"/api-reference/endpoints/volumes/create-a-directory"},{"title":"Move a file or directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /v1/volumes/{id}/files/rename","href":"/api-reference/endpoints/volumes/move-a-file-or-directory"},{"title":"Get file details","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes/{id}/files/stat","href":"/api-reference/endpoints/volumes/get-file-details"},{"title":"Get volume metrics","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/volumes/{id}/metrics","href":"/api-reference/endpoints/volumes/get-volume-metrics"}]},{"group":"Quotas","pages":[{"title":"Get quota usage","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/quotas","href":"/api-reference/endpoints/quotas/get-quota-usage"}]},{"group":"Billing","pages":[{"title":"Get billing summary","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing","href":"/api-reference/endpoints/billing/get-billing-summary"},{"title":"List invoices","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing/invoices","href":"/api-reference/endpoints/billing/list-invoices"},{"title":"Get an invoice","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing/invoices/{invoice_id}","href":"/api-reference/endpoints/billing/get-an-invoice"},{"title":"List billing plans","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing/plans","href":"/api-reference/endpoints/billing/list-billing-plans"},{"title":"Get a usage summary","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing/usage","href":"/api-reference/endpoints/billing/get-a-usage-summary"},{"title":"Get per-sandbox usage","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing/usage/sandbox","href":"/api-reference/endpoints/billing/get-per-sandbox-usage"},{"title":"Get per-volume storage usage","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/billing/usage/storage","href":"/api-reference/endpoints/billing/get-per-volume-storage-usage"}]},{"group":"Audit events","pages":[{"title":"List audit events","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/events","href":"/api-reference/endpoints/audit-events/list-audit-events"},{"title":"Get an audit event","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/events/{event_id}","href":"/api-reference/endpoints/audit-events/get-an-audit-event"}]},{"group":"Organization","pages":[{"title":"Get the current organization","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/me/org","href":"/api-reference/endpoints/organization/get-the-current-organization"}]},{"group":"Members","pages":[{"title":"List organization members","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /v1/members","href":"/api-reference/endpoints/members/list-organization-members"}]}]},{"group":"Personal tokens","icon":"user","pages":[{"group":"Account","pages":[{"title":"Get your profile","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/users/me","href":"/api-reference/personal/account/get-your-profile"},{"title":"Delete your account","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/users/me","href":"/api-reference/personal/account/delete-your-account"},{"title":"Update your profile","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json patch /v1/users/me","href":"/api-reference/personal/account/update-your-profile"}]},{"group":"Organization","pages":[{"title":"List your organizations","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs","href":"/api-reference/personal/organization/list-your-organizations"},{"title":"Create an organization","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs","href":"/api-reference/personal/organization/create-an-organization"},{"title":"Get an organization","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}","href":"/api-reference/personal/organization/get-an-organization"},{"title":"Delete an organization","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}","href":"/api-reference/personal/organization/delete-an-organization"},{"title":"Update an organization","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json patch /v1/orgs/{slug}","href":"/api-reference/personal/organization/update-an-organization"}]},{"group":"Members","pages":[{"title":"List organization members","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/members","href":"/api-reference/personal/members/list-organization-members"},{"title":"Remove a member","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/members/{user_id}","href":"/api-reference/personal/members/remove-a-member"},{"title":"Change a member's role","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json patch /v1/orgs/{slug}/members/{user_id}","href":"/api-reference/personal/members/change-a-members-role"}]},{"group":"Invites","pages":[{"title":"Accept an invite","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/invites/{token}/accept","href":"/api-reference/personal/invites/accept-an-invite"},{"title":"Decline an invite","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/invites/{token}/decline","href":"/api-reference/personal/invites/decline-an-invite"},{"title":"List pending invites","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/invites","href":"/api-reference/personal/invites/list-pending-invites"},{"title":"Invite a member","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/invites","href":"/api-reference/personal/invites/invite-a-member"},{"title":"Cancel an invite","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/invites/{invite_id}","href":"/api-reference/personal/invites/cancel-an-invite"}]},{"group":"OIDC","pages":[{"title":"Get organization SSO settings","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/oidc","href":"/api-reference/personal/oidc/get-organization-sso-settings"},{"title":"Configure organization SSO","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json put /v1/orgs/{slug}/oidc","href":"/api-reference/personal/oidc/configure-organization-sso"},{"title":"Remove organization SSO settings","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/oidc","href":"/api-reference/personal/oidc/remove-organization-sso-settings"}]},{"group":"Credentials","pages":[{"title":"List API keys","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/api-keys","href":"/api-reference/personal/credentials/list-api-keys"},{"title":"List personal tokens","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/users/me/pats","href":"/api-reference/personal/credentials/list-personal-tokens"},{"title":"Revoke a personal token","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/users/me/pats/{id}","href":"/api-reference/personal/credentials/revoke-a-personal-token"}]},{"group":"Registry credentials","pages":[{"title":"List registry credentials","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/registries","href":"/api-reference/personal/registry-credentials/list-registry-credentials"},{"title":"Create or update a registry credential","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json put /v1/orgs/{slug}/registries","href":"/api-reference/personal/registry-credentials/create-or-update-a-registry-credential"},{"title":"Delete a registry credential","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/registries/{id}","href":"/api-reference/personal/registry-credentials/delete-a-registry-credential"}]},{"group":"Sandboxes","pages":[{"title":"Check sandbox name availability","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandbox-slug/check","href":"/api-reference/personal/sandboxes/check-sandbox-name-availability"},{"title":"Suggest a sandbox name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandbox-slug/suggest","href":"/api-reference/personal/sandboxes/suggest-a-sandbox-name"},{"title":"List sandboxes","description":null,"deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandboxes","href":"/api-reference/personal/sandboxes/list-sandboxes"},{"title":"Create a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/sandboxes","href":"/api-reference/personal/sandboxes/create-a-sandbox"},{"title":"Get a sandbox","description":null,"deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandboxes/{sandbox_id}","href":"/api-reference/personal/sandboxes/get-a-sandbox"},{"title":"Delete a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/sandboxes/{sandbox_id}","href":"/api-reference/personal/sandboxes/delete-a-sandbox"},{"title":"Update a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json patch /v1/orgs/{slug}/sandboxes/{sandbox_id}","href":"/api-reference/personal/sandboxes/update-a-sandbox"},{"title":"Get sandbox metrics","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandboxes/{sandbox_id}/metrics","href":"/api-reference/personal/sandboxes/get-sandbox-metrics"},{"title":"Start a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/sandboxes/{sandbox_id}/start","href":"/api-reference/personal/sandboxes/start-a-sandbox"},{"title":"Stop a sandbox","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/sandboxes/{sandbox_id}/stop","href":"/api-reference/personal/sandboxes/stop-a-sandbox"},{"title":"List mounted volumes","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandboxes/{sandbox_id}/volumes","href":"/api-reference/personal/sandboxes/list-mounted-volumes"}]},{"group":"Snapshots","pages":[{"title":"List sandboxes available for snapshots","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/sandboxes/snapshot-candidates","href":"/api-reference/personal/snapshots/list-sandboxes-available-for-snapshots"},{"title":"List snapshot operations","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/snapshot-operations","href":"/api-reference/personal/snapshots/list-snapshot-operations"},{"title":"Get a snapshot operation","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/snapshot-operations/{operation_id}","href":"/api-reference/personal/snapshots/get-a-snapshot-operation"},{"title":"List snapshots","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/snapshots","href":"/api-reference/personal/snapshots/list-snapshots"},{"title":"Create a snapshot","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/snapshots","href":"/api-reference/personal/snapshots/create-a-snapshot"},{"title":"Get a snapshot by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/snapshots/by-name/{name}","href":"/api-reference/personal/snapshots/get-a-snapshot-by-name"},{"title":"Delete a snapshot by name","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/snapshots/by-name/{name}","href":"/api-reference/personal/snapshots/delete-a-snapshot-by-name"},{"title":"Get a snapshot by ID","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/snapshots/{snapshot_id}","href":"/api-reference/personal/snapshots/get-a-snapshot-by-id"},{"title":"Delete a snapshot by ID","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/snapshots/{snapshot_id}","href":"/api-reference/personal/snapshots/delete-a-snapshot-by-id"}]},{"group":"Volumes","pages":[{"title":"List volumes","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes","href":"/api-reference/personal/volumes/list-volumes"},{"title":"Create a volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/volumes","href":"/api-reference/personal/volumes/create-a-volume"},{"title":"Get the default volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes/default","href":"/api-reference/personal/volumes/get-the-default-volume"},{"title":"Delete a volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/volumes/{id}","href":"/api-reference/personal/volumes/delete-a-volume"},{"title":"Update a volume","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json patch /v1/orgs/{slug}/volumes/{id}","href":"/api-reference/personal/volumes/update-a-volume"},{"title":"List directory contents","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes/{id}/files","href":"/api-reference/personal/volumes/list-directory-contents"},{"title":"Delete a file or directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json delete /v1/orgs/{slug}/volumes/{id}/files","href":"/api-reference/personal/volumes/delete-a-file-or-directory"},{"title":"Read a file","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes/{id}/files/content","href":"/api-reference/personal/volumes/read-a-file"},{"title":"Write a file","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json put /v1/orgs/{slug}/volumes/{id}/files/content","href":"/api-reference/personal/volumes/write-a-file"},{"title":"Copy a file or directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/volumes/{id}/files/copy","href":"/api-reference/personal/volumes/copy-a-file-or-directory"},{"title":"Check if a file exists","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes/{id}/files/exists","href":"/api-reference/personal/volumes/check-if-a-file-exists"},{"title":"Check if files exist","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/volumes/{id}/files/exists","href":"/api-reference/personal/volumes/check-if-files-exist"},{"title":"Create a directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/volumes/{id}/files/mkdir","href":"/api-reference/personal/volumes/create-a-directory"},{"title":"Move a file or directory","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/volumes/{id}/files/rename","href":"/api-reference/personal/volumes/move-a-file-or-directory"},{"title":"Get file details","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes/{id}/files/stat","href":"/api-reference/personal/volumes/get-file-details"},{"title":"Get volume metrics","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/volumes/{id}/metrics","href":"/api-reference/personal/volumes/get-volume-metrics"}]},{"group":"Quotas","pages":[{"title":"Get quota usage","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/quotas","href":"/api-reference/personal/quotas/get-quota-usage"}]},{"group":"Billing","pages":[{"title":"Get billing summary","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing","href":"/api-reference/personal/billing/get-billing-summary"},{"title":"Cancel the subscription","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json post /v1/orgs/{slug}/billing/cancel","href":"/api-reference/personal/billing/cancel-the-subscription"},{"title":"List invoices","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/invoices","href":"/api-reference/personal/billing/list-invoices"},{"title":"Get an invoice","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/invoices/{invoice_id}","href":"/api-reference/personal/billing/get-an-invoice"},{"title":"Open the payment portal","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/payment-portal","href":"/api-reference/personal/billing/open-the-payment-portal"},{"title":"Change the billing plan","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json put /v1/orgs/{slug}/billing/plan","href":"/api-reference/personal/billing/change-the-billing-plan"},{"title":"List billing plans","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/plans","href":"/api-reference/personal/billing/list-billing-plans"},{"title":"Get estimated usage costs","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/usage","href":"/api-reference/personal/billing/get-estimated-usage-costs"},{"title":"Get sandbox usage","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/usage/sandbox","href":"/api-reference/personal/billing/get-sandbox-usage"},{"title":"Get storage usage","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/billing/usage/storage","href":"/api-reference/personal/billing/get-storage-usage"}]},{"group":"Audit events","pages":[{"title":"List audit events","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/events","href":"/api-reference/personal/audit-events/list-audit-events"},{"title":"Get an audit event","deprecated":null,"version":null,"openapi":"/api-reference/openapi.personal.json get /v1/orgs/{slug}/events/{event_id}","href":"/api-reference/personal/audit-events/get-an-audit-event"}]}]}]},{"tab":"How-to guides","pages":[{"title":"How-to guides","href":"/how-to/overview"}]},{"tab":"Enterprise","pages":[{"title":"Enterprise","href":"/enterprise"}]},{"tab":"Security","pages":[{"title":"Security","href":"/security/overview"}]},{"tab":"Changelog","pages":[{"title":"Changelog","href":"/migrations/v0.7"}]}]},"basePath":"","title":"Create a sandbox - microsandbox","buildId":"dpl_G9nrg4qeJSZtah1Ziwbc2n6WkLch","deploymentId":"dpl_G9nrg4qeJSZtah1Ziwbc2n6WkLch","dynamics":["c2aa737661","b0f84f53ff","a9bb46feb3","2b790eda92"],"chunks":["OpenApiReferenceProvider-B7XKH4J3.js","utils-lOYzL7z-.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-DF6jUUIM.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-Dpsj5f7C.js","snippetPresets-CYeiDe8v.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","Page-DSVu9Ucl.js","ApiExamples-CUFz1YZ_.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-D8H_iLS4.js","shallow-DdluZBHX.js","getApiPlaygroundDisplay-B9922vev.js","CodeSnippet-CMoRNGYs.js","CodeSnippets-DwyrPHuw.js","getPastedJson-G-zIvlHh.js","icon-B03fnEy0.js","MethodPill-CW7teklc.js","DuplicateIcon-CtO8eekd.js","createIcon-DZTKdM_A.js","DynamicMarkdown-D5M2At0B.js","SectionHeading-C_2NaA2U.js","axios-vUo_bRtp.js","Markdown-D7QRHV3m.js","clsx-D1Z-ELXV.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-lvhuD9Du.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-CKfC4ywL.js"]}