Skip to main content

Enable sandboxes

In this tutorial you make one compute node (CN) a sandbox node. You check that the sandbox pieces are in the channel, turn sandboxes on for the CN, install the runtime bundle, keep the CN for sandboxes with a trait, fill the warm pool, and create a first sandbox as a tenant.

Allow about 20 minutes.

Before you start​

You need:

  • A running Triton Cloud with at least two approved CNs. One becomes the sandbox node. The other stays without traits, for VMs and platform zones such as NAT gateways.
  • tritonadm configured on the head node, with fleet-operator rights.
  • tritonctl signed in as a tenant user, with a project that has one subnet.

Every tritonadm command below runs on the head node, in the global zone, as root. tritonadm cn exec and tritonadm update agents reach the CN over ssh on its admin address, so they need that host.

Step 1: Check the sandbox pieces​

The release channel carries the sandbox runtime bundle and the built-in images, and tritonadm update installs them.

tritonadm versions

Find the sandbox image rows. Each pin shows current. If the rows are missing, run tritonadm update first.

Step 2: Turn sandboxes on for the CN​

tritonadm cn sandbox set <CN> --enabled true

The output ends with an effective: line that shows enabled=true, max=50, and reservoir_percent=0.25. The agent reads this when it starts, so restart it:

tritonadm cn exec <CN> -- svcadm restart tritonagent

<CN> is the CN's hostname, UUID, or UUID prefix.

Step 3: Install the runtime bundle​

tritonadm update agents refreshes the agents and runs sandbox-runtime-refresh on each CN that has sandboxes enabled. It reads that from the agent's status, so run it after the restarted agent has reported in:

tritonadm update agents

The run prints a == sandbox runtime section with a line for the CN.

Step 4: Check that the CN is ready​

tritonadm versions

The sandbox runtime row for the CN shows current. In tritonadm cn list -j, the CN's last_status.sandbox_runtime.state is ok.

Step 5: Keep the CN for sandboxes​

The seeded sandbox packages carry the trait sandbox=true, and a CN takes a package only when its traits match exactly. Give the CN the same trait:

tritonadm cn traits set <CN> sandbox=true

Confirm it:

tritonadm cn traits show <CN>

You see traits: sandbox=true. Sandboxes now go to this CN, and VMs go to CNs with no traits.

Step 6: Fill the warm pool​

tritonadm config set sandbox.pool_depth 2

The CN now keeps two booted sandboxes of the default package, sandbox-2g, ready to hand out. Each one holds 2 GiB of guest memory.

Step 7: Create a sandbox as a tenant​

On your workstation, signed in to tritonctl as the tenant user:

tritonctl sandbox create --name hc --package sandbox-2g --ttl 5m
tritonctl sandbox exec hc -- true
tritonctl sandbox delete -y hc

The create waits until the sandbox runs. A create from the pool answers in under a second. The exec exits 0, and the delete removes the sandbox.

Check that no sandbox operation is stuck:

tritonadm op list

Your CN is a sandbox node, and tenants can create sandboxes on it.

Next steps​