Skip to main content
POST
Create sandbox from file
For output from a failed service build, see Read failed Compose build logs.

Authorizations

Authorization
string
header
default:Bearer {API_ACCESS_TOKEN}
required

CoreWeave API access token sent as a bearer token.

Body

application/json

CreateSandboxFromFileRequest is the AIP-136 body for CreateSandboxFromFile. This list is closed: volumes, instance_type, runtime_class, runtime_class_selection, and published services are not fields here; those callers use CreateSandbox. There is no PartialSandboxSpec overlay. CONTROL_CONTAINER_ENGINE needs no runtime class field: the Runner's engine class is used (see Control).

type
enum<string>
required

Document type. Unspecified is INVALID_ARGUMENT. Compose is accepted for pull-only documents. Other declared types are UNIMPLEMENTED.

Available options:
SANDBOX_FILE_TYPE_UNSPECIFIED,
SANDBOX_FILE_TYPE_COMPOSE
contents
string<bytes>
required

UTF-8 file bytes. Compose: max 256 KiB. The platform keeps the file, or the spec derived from it, for the life of the sandbox record, so put secrets in a secret store rather than inline.

primaryService
string

Compose service that is the sandbox primary. Required when type is Compose and control is CONTROL_PLATFORM; must name a service in contents. Set with CONTROL_CONTAINER_ENGINE, it is INVALID_ARGUMENT (CWSANDBOX_INVALID_REQUEST).

imageOverrides
object

Per-service image refs. Keys must be services. Use this to supply a pullable image for a service that would otherwise need a build. Valid only when type is Compose.

buildContexts
object

Per-service gzip build-context tarballs for services that still need a build. Keys must be services. Total 32 MiB. A service that still needs a build must not have an entry here when its build.context is a remote URL. Entries for services with an image are ignored. Valid only when type is Compose.

defaultResources
object

CPU/memory copied onto each service that omitted deploy.resources. Per container, not a project budget. GPU in this message is INVALID_ARGUMENT. Valid only when type is Compose.

mode
enum<string>

Placement mode. Omit this field to use serverless placement. SANDBOX_MODE_UNSPECIFIED also selects SANDBOX_MODE_SERVERLESS. Set SANDBOX_MODE_CKS to use your own-cluster runners.

Available options:
SANDBOX_MODE_UNSPECIFIED,
SANDBOX_MODE_SERVERLESS,
SANDBOX_MODE_CKS
maxLifetimeSeconds
integer<int32>
tags
string[]
network
object

NetworkOptions declares the sandbox's network intent beyond port exposure.

networkIds
string[]

Network membership is not supported. v1 sandbox creation and stored template validation reject a non-empty networkIds list. Use network to configure network rules; this field does not join sandbox networks.

objectStorageAccess
object

ObjectStorageAccess grants the sandbox temporary access to object-storage buckets. The minted credential is injected into every user container.

annotations
object
runnerIds
string[]
requestId
string

Optional idempotency token; repeated identical requests with the same token return the original result.

displayName
string

Optional name for the created sandbox. Uses Sandbox.display_name rules.

buildContextObjects
object

Per-service build context stored in CoreWeave AI Object Storage, for contexts larger than build_contexts allows. Keys must be services that still need a build. A service with an entry here must not also have a build_contexts entry or a remote build.context. At most 64 entries. Valid only when type is Compose.

builderSizes
object

Per-service builder size name, at most 64 bytes. Omitted services use the default size. A size the build service does not offer is INVALID_ARGUMENT on builder_sizes.. Keys must be services that still need a build. At most 64 entries. Valid only when type is Compose.

control
enum<string>

Who controls the sandbox's containers (see Control). Unspecified means CONTROL_PLATFORM. CONTROL_CONTAINER_ENGINE is valid only when type is Compose. A server that doesn't support it returns UNIMPLEMENTED (CWSANDBOX_NOT_IMPLEMENTED). When no runner can run a container engine, the create is FAILED_PRECONDITION (CWSANDBOX_NO_SUITABLE_RUNNER) with metadata unsupported_feature=container_engine. A value the server doesn't recognize is UNIMPLEMENTED (CWSANDBOX_NOT_IMPLEMENTED).

Available options:
CONTROL_UNSPECIFIED,
CONTROL_PLATFORM,
CONTROL_CONTAINER_ENGINE
imagePullCredentials
object[]

Registry credentials for pulling images, at most one per registry and at most 16 entries. A repeated registry or a 17th entry is INVALID_ARGUMENT (CWSANDBOX_INVALID_REQUEST). Credentials are resolved at create, as for Container.image_pull_credentials. With CONTROL_PLATFORM, each container uses the credential whose registry matches its image. With CONTROL_CONTAINER_ENGINE, the engine's Docker client holds every credential, and a credential here replaces the platform's own for the same registry. Valid only when type is Compose. A deployment without support returns UNIMPLEMENTED (CWSANDBOX_NOT_IMPLEMENTED).

Response

OK

Sandbox is a single running (or terminal) compute environment.

spec
object
required

Desired workload. Required on create and immutable thereafter. It is absent when v1 projects a sandbox created through v1beta2, which has no v1 SandboxSpec. It is also absent in STATE_PREPARING, and after an image fill fails before the spec is stored. When create used a template, this is the resolved spec from that create — never re-read from the live template.

sandboxId
string
read-only

Server-assigned unique identifier.

status
object

Observed state.

sourceTemplateId
string
read-only

Template selected at create time, if any. Historical provenance; retained even if the template is later deleted.

sourceTemplateRevision
string
read-only

Revision of the template applied at create time.

displayName
string

Optional, immutable lookup name, unique among active sandboxes in the tenant organization. Case-sensitive, at most 128 UTF-8 bytes; leading or trailing whitespace, slashes, colons, control characters, and UUIDs are invalid. The name becomes reusable once the sandbox reaches a terminal state.

endpointShareToken
string
read-only

CreateSandbox, CreateSandboxFromTemplate, and an identical request_id replay of that call, after HTTPS URLs confirm. Omitted from Get, List, status, and from a successful create while those URLs are unconfirmed. Send as X-Sandbox-Share-Token or ?share_token=; both are stripped before forwarding.

control
enum<string>
read-only

Who controls the sandbox's containers: CONTROL_CONTAINER_ENGINE for a sandbox created with it, and CONTROL_PLATFORM for every other sandbox. CONTROL_UNSPECIFIED means no controller is specified; successful creates resolve the default to CONTROL_PLATFORM.

Available options:
CONTROL_UNSPECIFIED,
CONTROL_PLATFORM,
CONTROL_CONTAINER_ENGINE