Turn sandbox features on with feature gates
This guide turns a gated sandbox feature on for chosen tenants, or for every tenant,
and back off. Each gate is two settings. sandbox.feature.<NAME> is off,
allowlist, or on. sandbox.feature.<NAME>.tenants is the allowlist, with at most
1024 tenants. A tenant that is not let through gets 403 FeatureDisabled.
Run every command on an operator workstation with a configured tritonadm.
Step 1: See the gates
tritonadm config features
The table lists each gate's mode, its default, and its tenants. The gates that start
as an empty allowlist, so off for every tenant, are memory, desktop,
templates_from_dockerfile, egress_domains, and preview_public. For the full
list, see tritonadm config.
Step 2: Find the tenant IDs
tritonadm tenant list
Step 3: Let the tenants through
This example turns on memory (pause, memory snapshots, memory forks, and
on_deadline set to pause). Resume is not gated:
tritonadm config set sandbox.feature.memory allowlist
tritonadm config set sandbox.feature.memory.tenants <TENANT_UUID>,<TENANT_UUID>
.tenants replaces the whole list. Give every tenant each time. A tenant you leave
out loses the feature.
To turn a feature on for every tenant:
tritonadm config set sandbox.feature.memory on
tritond reads the gates again within a few seconds. No restart is needed.
Step 4: Check
tritonadm config features
The gate shows the new mode and list. The tenant can also run
tritonctl sandbox capability, which lists the feature as available.
Turn a feature off
Empty the allowlist:
tritonadm config set sandbox.feature.memory.tenants none
Or turn the gate off for everyone:
tritonadm config set sandbox.feature.memory off
Live sandboxes keep running. A tenant can always resume a paused sandbox, because
resume is never gated. Turning preview_public off also makes existing public
ports private.
Features that need more than a gate
| Gate | Also needs |
|---|---|
egress_domains | A NAT gateway and a default route in the tenant's VPC. |
desktop | The sandbox.desktop_image pin set, which the release channel does. |
templates_from_dockerfile | The sandbox.builder_image pin set, which the release channel does. |
preview, preview_public | A preview domain in preview.domains, and something that serves the preview names. With the tritond front door off, nothing serves them until triton-adc routes them. That routing is not built yet, so previews stay off. |