The sandbox command-line tool lets you run, configure, and manage isolated sandbox environments within your containers running on Cloud Run. You can only use this CLI from within Cloud Run after you enable sandboxes. For more information on enabling sandboxes, see Configure sandboxes for services.
sandbox
This sandbox CLI provides compartmentalized execution for commands.
Options
-h, --help help for sandbox
The <sandbox-id> in this document refers to the active sandbox session instance. It's either a unique ID generated by the system or a user-given name that is validated to be unique across all sandbox instances.
sandbox do
The do command runs a command inside a new sandbox container. The sandbox is automatically created before execution and destroyed after exit.
Syntax
sandbox do [flags] [command-to-execute]
Options
--allow-egress Allow outbound network access for this sandbox
-e, --env string Environment variables to set in the sandbox
--export-tar string The tarball to export rootfs-upper to on exit
-h, --help help for do
--import-tar string The tarball to import rootfs-upper from
--mount string Mounts for the sandbox (for example, type=bind,source=SRC,destination=DST)
--rootfs string Run the command using the root of the executing container as the root directory of the sandbox. By default, this mount is read-only (default "/")
--sandbox-name string The ID to use for the sandbox; if not specified, a random ID will be generated
--sync-tar string The tarball to use for keeping the file system in sync (import if exists, export on exit)
-w, --workdir string The working directory to execute the command in
--write Allow file systems that have been mounted to be writable by this sandbox
sandbox run
The run command creates and starts a sandbox.
Syntax
sandbox run <sandbox-id> [command-to-execute] [flags]
Options
--allow-egress Allow outbound network access for this sandbox
--detach Detach the sandbox from the console (runs in the background)
-e, --env string Environment variables to set in the sandbox
-h, --help help for run
--import-tar string The tarball to import rootfs-upper from
--mount string Mounts for the sandbox (for example, type=bind,source=SRC,destination=DST)
--rootfs string Run the command using the root of the executing container as the root directory of the sandbox (default "/")
-w, --workdir string The working directory to execute the command in
--write Allow file systems that have been mounted to be writable by this sandbox
sandbox exec
The exec command executes a command inside an existing running sandbox.
Syntax
sandbox exec <sandbox-id> <command-to-execute> [flags]
Options
-e, --env string Environment variables to set in the sandbox
-h, --help help for exec
-w, --workdir string The working directory to execute the command in
sandbox fork
The fork command creates a new sandbox using the state and command line of a running source sandbox.
Syntax
sandbox fork <source-sandbox-id> <target-sandbox-id> [flags]
Options
--detach Detach the new sandbox from the console
-h, --help help for fork
--tar string The tarball from the source sandbox state with which the target sandbox was started
sandbox tar
The tar command exports a tar archive containing the writable overlay file system of a running sandbox.
Syntax
sandbox tar <sandbox-id> [flags]
Options
--file string The file path to write the tarball to
-h, --help help for tar
sandbox delete
The delete command removes a sandbox and cleans up its resources.
Syntax
sandbox delete <sandbox-id> [flags]
Options
--force Force delete the sandbox, even if it is running
-h, --help help for delete