> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# coreweave_sandbox_managed_runner (Resource)

Manages a CoreWeave Sandbox runner and its required policy through the v1 RunnerManagementService (`/v1/sandbox/managedRunners`). Requires a server implementing full v1 managed-runner CRUD; the policy-only v1 server cannot provision or fully refresh this resource. Creation and updates record the accepted desired configuration; installation and rollout continue asynchronously and are exposed in computed status attributes. Deletion waits up to 30 minutes for the runner to disappear.

## Example usage

```terraform theme={"system"}
# Requires a Sandbox API deployment implementing full v1 managed-runner CRUD.
# Configure COREWEAVE_API_TOKEN with sandbox_admin access. COREWEAVE_API_ENDPOINT
# can select a different API deployment when needed.
provider "coreweave" {}

variable "cluster_id" {
  type        = string
  description = "CKS cluster UUID for the managed runner."
}

variable "zone" {
  type        = string
  description = "Cluster geographic zone, for example us-east-04a."
}

resource "coreweave_sandbox_managed_runner" "development" {
  runner_id       = "development"
  runner_group_id = "engineering"
  display_name    = "Engineering development"
  cluster_id      = var.cluster_id
  # The Sandbox API returns lowercase zones; normalize values supplied by CKS.
  zone = lower(var.zone)

  spec = {
    release_channel = "RELEASE_CHANNEL_STABLE"
    maintenance_policy = {
      windows = [{ cron = "0 2 * * SAT", duration_seconds = 3600 }]
    }
    overrides = {
      resources = {
        cpu_request    = "1"
        memory_request = "2Gi"
        cpu_limit      = "4"
        memory_limit   = "8Gi"
      }
      scaling = { replicas = 2 }
    }
    image_pull = { policy = "SANDBOX_IMAGE_PULL_POLICY_ALWAYS" }
    volumes = {
      enabled              = true
      csi_driver_allowlist = ["csi.vastdata.com"]
    }
    data_plane = { disabled = true }
  }

  policy = {
    display_name = "Development constraints"
    constraints = {
      resources = {
        default_cpu    = "1"
        default_memory = "2Gi"
        max_cpu        = "8"
        max_memory     = "32Gi"
        max_gpu_count  = 0 # Explicitly forbid GPUs; omitting this removes the cap.
      }
      lifecycle = { default_lifetime_seconds = 3600 }
      volumes   = { max_size = "100Gi" }
    }
    # To restrict public API sources, supply your organization's actual CIDRs:
    # control_plane_access = {
    #   source_ip_allowlist = { cidrs = ["203.0.113.0/24"] }
    # }
    # source_ip_allowlist = {} denies every public source. Omitting the
    # source_ip_allowlist object leaves source IP access unrestricted.
  }
}
```

## Schema

### Required

* `cluster_id` (String) CKS cluster UUID. Changing it replaces the runner.
* `policy` (Attributes) Policy governing every sandbox on this runner. Required even for the explicit empty posture `policy = {}`. Policy is updated with an etag to detect concurrent changes. (see [below for nested schema](#nestedatt--policy))
* `runner_id` (String) Operator-assigned runner identifier, unique within the authenticated organization. Changing it replaces the runner.
* `zone` (String) Lowercase geographic zone of the runner, for example `us-east-04a`. Use `lower(coreweave_cks_cluster.example.zone)` when referencing a CKS cluster zone. Changing it replaces the runner.

### Optional

* `display_name` (String) Human-readable runner name.
* `runner_group_id` (String) Runner group for scheduling affinity. Defaults to `default`; omitting or setting this attribute to null resets a custom group to `default`.
* `spec` (Attributes) Desired runner configuration. When omitted, the server's defaults are adopted. Removing an optional setting inside this object resets that setting through an explicit update mask. (see [below for nested schema](#nestedatt--spec))

### Read-Only

* `active_config_version` (String) Configuration version currently running.
* `active_revision` (Number) Revision currently running.
* `cluster_name` (String) Cluster display name resolved by the server.
* `connection_status` (String) Observed live connection status.
* `create_time` (String) Creation timestamp (RFC 3339).
* `data_plane_status` (String) Observed direct endpoint state, URI, protocols, and certificate expiry as JSON, or null.
* `deployment_spec` (String, Sensitive) Resolved deployment configuration as JSON. Read-only; use spec.overrides to change supported settings.
* `etag` (String) Opaque policy revision used for optimistic concurrency. A concurrent policy edit fails the apply; refresh the plan before retrying.
* `id` (String) Terraform resource ID, equal to runner\_id within the authenticated organization.
* `install_error` (String) Structured installation failure details as JSON, or null.
* `install_status` (String) Observed installation status.
* `last_heartbeat_time` (String) Last runner heartbeat timestamp (RFC 3339).
* `rollout_in_progress` (Boolean) Whether a newer desired revision is still rolling out.
* `target_revision` (Number) Desired deployment revision.
* `update_available` (Boolean) Whether a newer version is available on the release channel.
* `update_time` (String) Last configuration update timestamp (RFC 3339).

<h3 id="nestedatt--policy">
  Nested Schema for `policy`
</h3>

Optional:

* `base` (String, Sensitive) Runtime defaults and attachments as a JSON object, for example `jsonencode({ ... })`. Typed constraints belong in constraints. Values are stored in Terraform state.
* `constraints` (Attributes) Typed constraints applied to the resolved sandbox specification. Omitted groups impose no constraint of that kind; individual security allowlists remain fail-closed. (see [below for nested schema](#nestedatt--policy--constraints))
* `control_plane_access` (Attributes) Request-time controls in addition to authentication and tenant authorization. (see [below for nested schema](#nestedatt--policy--control_plane_access))
* `display_name` (String) Human-readable policy name.

<h3 id="nestedatt--policy--constraints">
  Nested Schema for `policy.constraints`
</h3>

Optional:

* `image` (Attributes) Image restrictions. (see [below for nested schema](#nestedatt--policy--constraints--image))
* `instance` (Attributes) Node instance-type restrictions. (see [below for nested schema](#nestedatt--policy--constraints--instance))
* `lifecycle` (Attributes) Lifetime defaults. (see [below for nested schema](#nestedatt--policy--constraints--lifecycle))
* `metadata` (Attributes) Annotation restrictions. (see [below for nested schema](#nestedatt--policy--constraints--metadata))
* `network` (Attributes) Network envelopes and defaults. Empty allowed envelopes impose no restriction. (see [below for nested schema](#nestedatt--policy--constraints--network))
* `resources` (Attributes) Per-container bounds, defaults, and whole-sandbox ceilings. (see [below for nested schema](#nestedatt--policy--constraints--resources))
* `security` (Attributes) Container privilege and runtime-class constraints. (see [below for nested schema](#nestedatt--policy--constraints--security))
* `volumes` (Attributes) Sandbox volume restrictions. (see [below for nested schema](#nestedatt--policy--constraints--volumes))

<h3 id="nestedatt--policy--constraints--image">
  Nested Schema for `policy.constraints.image`
</h3>

Optional:

* `allowed_images` (Set of String) Allowed image references. Empty permits any image within the registry restrictions.
* `allowed_registries` (Set of String) Allowed registry prefixes. Empty permits any registry.

<h3 id="nestedatt--policy--constraints--instance">
  Nested Schema for `policy.constraints.instance`
</h3>

Optional:

* `allowed_instance_types` (Set of String) Allowed instance types. Empty permits any offered by the runner.

<h3 id="nestedatt--policy--constraints--lifecycle">
  Nested Schema for `policy.constraints.lifecycle`
</h3>

Optional:

* `default_lifetime_seconds` (Number) Default sandbox lifetime in seconds; zero leaves the platform default. Maximum 30 days.

<h3 id="nestedatt--policy--constraints--metadata">
  Nested Schema for `policy.constraints.metadata`
</h3>

Optional:

* `denied_annotation_prefixes` (Set of String) Rejected annotation key prefixes.
* `max_annotation_count` (Number) Maximum annotations; zero means no limit.

<h3 id="nestedatt--policy--constraints--network">
  Nested Schema for `policy.constraints.network`
</h3>

Optional:

* `allowed_egress` (Attributes List) Allowed egress envelope. HTTPS hostname wildcard `*` is permitted here. Select exactly one peer kind per rule. (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_egress))
* `allowed_ingress` (Attributes List) Allowed ingress sources for custom-visibility ports. Select exactly one peer kind per rule. (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_ingress))
* `default_egress` (Attributes List) Egress applied when the sandbox specifies none. HTTPS hostname destinations are not permitted here. Select exactly one peer kind per rule. (see [below for nested schema](#nestedatt--policy--constraints--network--default_egress))
* `default_ingress` (Attributes List) Ingress applied when the sandbox specifies none. Select exactly one peer kind per rule. (see [below for nested schema](#nestedatt--policy--constraints--network--default_ingress))
* `deny_dns` (Boolean, Deprecated) Deprecated alias for deny\_https\_hostname\_rules. Does not disable DNS resolution.
* `deny_https_hostname_rules` (Boolean) Forbid hostname-based HTTPS egress grants. Does not disable DNS resolution.
* `dns_egress` (String) Outbound DNS traffic ceiling on UDP/TCP port 53. Unspecified permits DNS; DENY requires sandboxes to block it. Independent of hostname-based HTTPS grants. Values: `DNS_EGRESS_MODE_ALLOW`, `DNS_EGRESS_MODE_DENY`.

<h3 id="nestedatt--policy--constraints--network--allowed_egress">
  Nested Schema for `policy.constraints.network.allowed_egress`
</h3>

Optional:

* `any` (Boolean) Set to true to select any address-shaped peer.
* `cidr` (Attributes) CIDR range with optional carve-outs. (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_egress--cidr))
* `dns_name` (String, Deprecated) Deprecated alias for https\_hostname.
* `dns_name_except` (Set of String, Deprecated) Deprecated alias for https\_hostname\_except.
* `https_hostname` (String) Exact HTTPS hostname or a single leftmost wildcard label; `*` is allowed only in allowed\_egress.
* `https_hostname_except` (Set of String) Hostnames excluded from an allowed\_egress HTTPS envelope.
* `ports` (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_egress--ports))
* `selector` (Attributes) Explicit entitlement to reach cluster workloads by label. (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_egress--selector))
* `tenant` (String) Relational tenant selection. Values: `TENANT_SCOPE_SAME_USER`, `TENANT_SCOPE_SAME_ORG`, `TENANT_SCOPE_SANDBOX_NETWORK`.

<h3 id="nestedatt--policy--constraints--network--allowed_egress--cidr">
  Nested Schema for `policy.constraints.network.allowed_egress.cidr`
</h3>

Required:

* `cidr` (String) IPv4 or IPv6 CIDR.

Optional:

* `except` (Set of String) Excluded subranges.

<h3 id="nestedatt--policy--constraints--network--allowed_egress--ports">
  Nested Schema for `policy.constraints.network.allowed_egress.ports`
</h3>

Required:

* `port` (Number) Starting port.

Optional:

* `end_port` (Number) Inclusive end port; zero or omitted means a single port.
* `protocol` (String) TCP (default), UDP, or SCTP.

<h3 id="nestedatt--policy--constraints--network--allowed_egress--selector">
  Nested Schema for `policy.constraints.network.allowed_egress.selector`
</h3>

Required:

* `pod_labels` (Map of String) Pod labels to match (at least one required).

Optional:

* `namespace_labels` (Map of String) Namespace labels to match. Omitted means the sandbox's own namespace.

<h3 id="nestedatt--policy--constraints--network--allowed_ingress">
  Nested Schema for `policy.constraints.network.allowed_ingress`
</h3>

Optional:

* `any` (Boolean) Set to true to select any address-shaped peer.
* `cidr` (Attributes) CIDR range with optional carve-outs. (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_ingress--cidr))
* `ports` (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see [below for nested schema](#nestedatt--policy--constraints--network--allowed_ingress--ports))
* `tenant` (String) Relational tenant selection. Values: `TENANT_SCOPE_SAME_USER`, `TENANT_SCOPE_SAME_ORG`, `TENANT_SCOPE_SANDBOX_NETWORK`.

<h3 id="nestedatt--policy--constraints--network--allowed_ingress--cidr">
  Nested Schema for `policy.constraints.network.allowed_ingress.cidr`
</h3>

Required:

* `cidr` (String) IPv4 or IPv6 CIDR.

Optional:

* `except` (Set of String) Excluded subranges.

<h3 id="nestedatt--policy--constraints--network--allowed_ingress--ports">
  Nested Schema for `policy.constraints.network.allowed_ingress.ports`
</h3>

Required:

* `port` (Number) Starting port.

Optional:

* `end_port` (Number) Inclusive end port; zero or omitted means a single port.
* `protocol` (String) TCP (default), UDP, or SCTP.

<h3 id="nestedatt--policy--constraints--network--default_egress">
  Nested Schema for `policy.constraints.network.default_egress`
</h3>

Optional:

* `any` (Boolean) Set to true to select any address-shaped peer.
* `cidr` (Attributes) CIDR range with optional carve-outs. (see [below for nested schema](#nestedatt--policy--constraints--network--default_egress--cidr))
* `dns_name` (String, Deprecated) Deprecated alias for https\_hostname.
* `dns_name_except` (Set of String, Deprecated) Deprecated alias for https\_hostname\_except.
* `https_hostname` (String) Exact HTTPS hostname or a single leftmost wildcard label; `*` is allowed only in allowed\_egress.
* `https_hostname_except` (Set of String) Hostnames excluded from an allowed\_egress HTTPS envelope.
* `ports` (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see [below for nested schema](#nestedatt--policy--constraints--network--default_egress--ports))
* `selector` (Attributes) Explicit entitlement to reach cluster workloads by label. (see [below for nested schema](#nestedatt--policy--constraints--network--default_egress--selector))
* `tenant` (String) Relational tenant selection. Values: `TENANT_SCOPE_SAME_USER`, `TENANT_SCOPE_SAME_ORG`, `TENANT_SCOPE_SANDBOX_NETWORK`.

<h3 id="nestedatt--policy--constraints--network--default_egress--cidr">
  Nested Schema for `policy.constraints.network.default_egress.cidr`
</h3>

Required:

* `cidr` (String) IPv4 or IPv6 CIDR.

Optional:

* `except` (Set of String) Excluded subranges.

<h3 id="nestedatt--policy--constraints--network--default_egress--ports">
  Nested Schema for `policy.constraints.network.default_egress.ports`
</h3>

Required:

* `port` (Number) Starting port.

Optional:

* `end_port` (Number) Inclusive end port; zero or omitted means a single port.
* `protocol` (String) TCP (default), UDP, or SCTP.

<h3 id="nestedatt--policy--constraints--network--default_egress--selector">
  Nested Schema for `policy.constraints.network.default_egress.selector`
</h3>

Required:

* `pod_labels` (Map of String) Pod labels to match (at least one required).

Optional:

* `namespace_labels` (Map of String) Namespace labels to match. Omitted means the sandbox's own namespace.

<h3 id="nestedatt--policy--constraints--network--default_ingress">
  Nested Schema for `policy.constraints.network.default_ingress`
</h3>

Optional:

* `any` (Boolean) Set to true to select any address-shaped peer.
* `cidr` (Attributes) CIDR range with optional carve-outs. (see [below for nested schema](#nestedatt--policy--constraints--network--default_ingress--cidr))
* `ports` (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see [below for nested schema](#nestedatt--policy--constraints--network--default_ingress--ports))
* `tenant` (String) Relational tenant selection. Values: `TENANT_SCOPE_SAME_USER`, `TENANT_SCOPE_SAME_ORG`, `TENANT_SCOPE_SANDBOX_NETWORK`.

<h3 id="nestedatt--policy--constraints--network--default_ingress--cidr">
  Nested Schema for `policy.constraints.network.default_ingress.cidr`
</h3>

Required:

* `cidr` (String) IPv4 or IPv6 CIDR.

Optional:

* `except` (Set of String) Excluded subranges.

<h3 id="nestedatt--policy--constraints--network--default_ingress--ports">
  Nested Schema for `policy.constraints.network.default_ingress.ports`
</h3>

Required:

* `port` (Number) Starting port.

Optional:

* `end_port` (Number) Inclusive end port; zero or omitted means a single port.
* `protocol` (String) TCP (default), UDP, or SCTP.

<h3 id="nestedatt--policy--constraints--resources">
  Nested Schema for `policy.constraints.resources`
</h3>

Optional:

* `cpu_ceiling` (String) Sum-of-requests CPU ceiling across the sandbox.
* `default_cpu` (String) Default CPU per container. When a container declares neither requests nor limits, a positive default also sets its CPU limit.
* `default_memory` (String) Default memory per container. When a container declares neither requests nor limits, a positive default also sets its memory limit.
* `max_cpu` (String) Maximum CPU per container, as a Kubernetes quantity.
* `max_gpu_count` (Number) Maximum GPUs per container. Omitted means no cap; explicit zero forbids GPUs.
* `max_memory` (String) Maximum memory per container.
* `memory_ceiling` (String) Sum-of-requests memory ceiling across the sandbox.
* `min_cpu` (String) Minimum CPU per container.
* `min_memory` (String) Minimum memory per container.
* `require_limits` (Boolean) Require every container to have requests and limits after defaults are applied.

<h3 id="nestedatt--policy--constraints--security">
  Nested Schema for `policy.constraints.security`
</h3>

Optional:

* `allow_privileged` (Boolean) Permit privileged containers.
* `allowed_capabilities` (Set of String) Linux capabilities containers may add. Empty permits none beyond defaults.
* `allowed_runtime_classes` (Set of String) Runtime classes callers may explicitly select. Empty forbids caller-selected runtime classes. Cannot be combined with runtime\_class\_mappings.
* `allowed_seccomp_profiles` (Set of String) Permitted seccomp profiles, such as RuntimeDefault or Unconfined.
* `default_cpu_runtime_class` (String) Default CPU runtime class. Must fit a nonempty runtime-class allowlist. Cannot be combined with runtime\_class\_mappings.
* `default_gpu_runtime_class` (String) Default GPU runtime class. Must fit a nonempty runtime-class allowlist. Cannot be combined with runtime\_class\_mappings.
* `runtime_class_mappings` (Attributes Set) Bindings from portable runtime classes to concrete runtimes. A non-empty set switches the runner to mappings: a mapped class is available both for caller selection and as the automatic CPU or GPU default, an unmapped class is unavailable, and callers cannot pin a concrete runtime class. Omitting a default class disables automatic selection for that resource family. Each class appears at most once. Cannot be combined with allowed\_runtime\_classes, default\_cpu\_runtime\_class, or default\_gpu\_runtime\_class. (see [below for nested schema](#nestedatt--policy--constraints--security--runtime_class_mappings))

<h3 id="nestedatt--policy--constraints--security--runtime_class_mappings">
  Nested Schema for `policy.constraints.security.runtime_class_mappings`
</h3>

Required:

* `runtime_class` (String) Portable runtime class provided by the target. Values: `RUNTIME_CLASS_CPU_DEFAULT`, `RUNTIME_CLASS_CPU_NESTED_VIRT`, `RUNTIME_CLASS_CPU_SNAPSHOT_RESTORE`, `RUNTIME_CLASS_GPU_DEFAULT`.

Optional:

* `kubernetes_runtime_class_name` (String) Kubernetes RuntimeClass name. Set exactly one of kubernetes\_runtime\_class\_name or node\_default.
* `node_default` (Boolean) Set to true to use the node's default container runtime. Permitted only for `RUNTIME_CLASS_CPU_DEFAULT` and `RUNTIME_CLASS_GPU_DEFAULT`, and only serves CKS-mode placement outside the shared serverless pool.

<h3 id="nestedatt--policy--constraints--volumes">
  Nested Schema for `policy.constraints.volumes`
</h3>

Optional:

* `allowed_media` (Set of String) Allowed storage media. Empty permits any.
* `max_size` (String) Maximum size per volume, for example 100Gi.

<h3 id="nestedatt--policy--control_plane_access">
  Nested Schema for `policy.control_plane_access`
</h3>

Optional:

* `source_ip_allowlist` (Attributes) Public source IP restriction. A present empty object denies every public source; an absent object imposes no source IP restriction. (see [below for nested schema](#nestedatt--policy--control_plane_access--source_ip_allowlist))

<h3 id="nestedatt--policy--control_plane_access--source_ip_allowlist">
  Nested Schema for `policy.control_plane_access.source_ip_allowlist`
</h3>

Optional:

* `cidrs` (Set of String) Canonical, nonredundant IPv4/IPv6 prefixes (at most 256). Do not include a prefix already covered by another entry. An empty set denies every public source. Omitting the enclosing source\_ip\_allowlist leaves access unrestricted.

<h3 id="nestedatt--spec">
  Nested Schema for `spec`
</h3>

Optional:

* `data_plane` (Attributes) Direct sandbox data endpoint. Select exactly one of disabled, cluster\_ip, load\_balancer, or custom. Certificates are managed by the platform. (see [below for nested schema](#nestedatt--spec--data_plane))
* `enforce_resource_limits` (Boolean) Require sandboxes to declare both memory and CPU limits.
* `image_pull` (Attributes) Workload container image pull behavior. (see [below for nested schema](#nestedatt--spec--image_pull))
* `maintenance_policy` (Attributes) Update scheduling in UTC. Exclusions take precedence over windows. (see [below for nested schema](#nestedatt--spec--maintenance_policy))
* `overrides` (Attributes) Customer-settable runner deployment overrides. (see [below for nested schema](#nestedatt--spec--overrides))
* `release_channel` (String) Automatic update channel. Defaults to stable. Values: `RELEASE_CHANNEL_STABLE`, `RELEASE_CHANNEL_RAPID`.
* `tenant_metrics` (Attributes) Per-sandbox tenant usage collection. Overrides corresponding deployment environment entries. (see [below for nested schema](#nestedatt--spec--tenant_metrics))
* `volumes` (Attributes) Registered volume support. These settings take precedence over corresponding deployment environment entries. (see [below for nested schema](#nestedatt--spec--volumes))

<h3 id="nestedatt--spec--data_plane">
  Nested Schema for `spec.data_plane`
</h3>

Optional:

* `cluster_ip` (Attributes) Expose through a ClusterIP service. (see [below for nested schema](#nestedatt--spec--data_plane--cluster_ip))
* `custom` (Attributes) Advertise a customer-managed network path. (see [below for nested schema](#nestedatt--spec--data_plane--custom))
* `disabled` (Boolean) Set to true to explicitly disable the direct endpoint.
* `load_balancer` (Attributes) Expose through an L4 load balancer forwarding mutual TLS to the runner. (see [below for nested schema](#nestedatt--spec--data_plane--load_balancer))

<h3 id="nestedatt--spec--data_plane--cluster_ip">
  Nested Schema for `spec.data_plane.cluster_ip`
</h3>

Optional:

* `annotations` (Map of String) Service annotations.

<h3 id="nestedatt--spec--data_plane--custom">
  Nested Schema for `spec.data_plane.custom`
</h3>

Required:

* `advertised_uri` (String) Stable absolute URI returned to direct clients.

Optional:

* `service_annotations` (Map of String) Annotations on the backing ClusterIP service.

<h3 id="nestedatt--spec--data_plane--load_balancer">
  Nested Schema for `spec.data_plane.load_balancer`
</h3>

Optional:

* `annotations` (Map of String) Service annotations.
* `external_traffic_policy` (String) External traffic policy. Values: `RUNNER_DATA_PLANE_EXTERNAL_TRAFFIC_POLICY_CLUSTER`, `RUNNER_DATA_PLANE_EXTERNAL_TRAFFIC_POLICY_LOCAL`.
* `hostname` (String) Endpoint DNS name included in the server certificate. The platform may assign one when empty.
* `load_balancer_class` (String) Kubernetes load balancer class.
* `scope` (String) Load balancer scope. Values: `RUNNER_DATA_PLANE_SERVICE_SCOPE_PUBLIC`, `RUNNER_DATA_PLANE_SERVICE_SCOPE_PRIVATE`.
* `source_ranges` (Set of String) Allowed client source CIDRs.

<h3 id="nestedatt--spec--image_pull">
  Nested Schema for `spec.image_pull`
</h3>

Optional:

* `policy` (String) Image pull policy. The platform default is IF\_NOT\_PRESENT. ALWAYS reauthorizes pull credentials on every start. Values: `SANDBOX_IMAGE_PULL_POLICY_IF_NOT_PRESENT`, `SANDBOX_IMAGE_PULL_POLICY_ALWAYS`.

<h3 id="nestedatt--spec--maintenance_policy">
  Nested Schema for `spec.maintenance_policy`
</h3>

Optional:

* `exclusions` (Attributes List) One-time periods during which updates cannot start. (see [below for nested schema](#nestedatt--spec--maintenance_policy--exclusions))
* `windows` (Attributes List) Recurring update windows. An empty list permits updates at any time outside exclusions. (see [below for nested schema](#nestedatt--spec--maintenance_policy--windows))

<h3 id="nestedatt--spec--maintenance_policy--exclusions">
  Nested Schema for `spec.maintenance_policy.exclusions`
</h3>

Required:

* `end_time` (String) Exclusive RFC 3339 end timestamp, after start\_time.
* `start_time` (String) Inclusive RFC 3339 start timestamp.

Optional:

* `reason` (String) Reason for the exclusion.

<h3 id="nestedatt--spec--maintenance_policy--windows">
  Nested Schema for `spec.maintenance_policy.windows`
</h3>

Required:

* `cron` (String) Five-field cron expression in UTC, for example `0 2 * * SAT`.
* `duration_seconds` (Number) Window duration in seconds (60-604800).

<h3 id="nestedatt--spec--overrides">
  Nested Schema for `spec.overrides`
</h3>

Optional:

* `annotations` (Map of String) Annotations on runner pods.
* `args` (List of String) Ordered runner command-line arguments.
* `cpu_runtime_class` (String) Runtime class for CPU sandboxes.
* `env` (Map of String, Sensitive) Runner environment overrides. Values are stored in Terraform state; use a protected state backend.
* `gpu_runtime_class` (String) Runtime class for GPU sandboxes.
* `labels` (Map of String) Labels on runner pods.
* `node_selector` (Map of String) Node label selectors for the runner deployment.
* `resources` (Attributes) CPU and memory requests and limits for runner pods, as Kubernetes quantities. (see [below for nested schema](#nestedatt--spec--overrides--resources))
* `scaling` (Attributes) Runner replica and autoscaling configuration. (see [below for nested schema](#nestedatt--spec--overrides--scaling))
* `tolerations` (Attributes List) Kubernetes tolerations for runner pods. (see [below for nested schema](#nestedatt--spec--overrides--tolerations))

<h3 id="nestedatt--spec--overrides--resources">
  Nested Schema for `spec.overrides.resources`
</h3>

Optional:

* `cpu_limit` (String) CPU limit.
* `cpu_request` (String) CPU request.
* `memory_limit` (String) Memory limit.
* `memory_request` (String) Memory request.

<h3 id="nestedatt--spec--overrides--scaling">
  Nested Schema for `spec.overrides.scaling`
</h3>

Optional:

* `autoscaling_enabled` (Boolean) Enable runner autoscaling.
* `max_replicas` (Number) Maximum replicas.
* `min_replicas` (Number) Minimum replicas.
* `replicas` (Number) Desired replicas when autoscaling is disabled.

<h3 id="nestedatt--spec--overrides--tolerations">
  Nested Schema for `spec.overrides.tolerations`
</h3>

Optional:

* `effect` (String) Taint effect. Empty matches all effects.
* `key` (String) Taint key.
* `operator` (String) Toleration operator (`Equal` or `Exists`).
* `value` (String) Taint value.

<h3 id="nestedatt--spec--tenant_metrics">
  Nested Schema for `spec.tenant_metrics`
</h3>

Optional:

* `enabled` (Boolean) Enable the tenant metrics collector.
* `image` (String) Release-pinned collector image. Empty retains the deployment environment's image.

<h3 id="nestedatt--spec--volumes">
  Nested Schema for `spec.volumes`
</h3>

Optional:

* `csi_driver_allowlist` (Set of String) Allowed CSI drivers. Empty uses the platform default (`csi.vastdata.com`).
* `enabled` (Boolean) Enable registered volume mounts; the runner's PVC/PV permission preflight must also pass.

## Import

Import is supported using the following syntax:

```bash theme={"system"}
# Import a runner by runner_id within the authenticated organization.
terraform import coreweave_sandbox_managed_runner.development development
```