Changelog

New features

Image-level default TTL

Sandbox images now support a ttl_seconds field. When set, every sandbox provisioned from that image automatically inherits the TTL — no need to pass it at provision time every time.

The TTL set at provision time always takes precedence over the image default.

$
PUT /sandbox-images/{image_id}
$
$
{
>
  "ttl_seconds": 3600
>
}

Image readiness probe

Images can now define a readiness_port. When set, Modbox polls GET :{port}/ until the container returns a 2xx response before marking the sandbox as running. This removes the need for fixed sleep delays in provisioning code.

1
{
2
  "readiness_port": 8080
3
}

If readiness_port is not set, the sandbox is considered ready as soon as its main process is running.

Workspace RBAC

Workspaces now enforce role-based access control. Every member has one of four roles:

Manage members via POST /workspaces/{id}/members, PUT /workspaces/{id}/members/{user_id}, and DELETE /workspaces/{id}/members/{user_id}.

Private registry credentials

You can now store encrypted Docker registry credentials in Modbox and link them to sandbox images. When provisioning a sandbox, Modbox automatically uses the stored credentials to pull private images.

Supported registries: Docker Hub, GitHub Container Registry, Google Artifact Registry, AWS ECR, Azure Container Registry, and any Docker-compatible self-hosted registry.

$
POST /registries
$
$
{
>
  "name": "GitHub Container Registry",
>
  "server": "ghcr.io",
>
  "username": "your-username",
>
  "password": "your-token"
>
}

Passwords are encrypted at rest and never returned by the API.

Enhancements

Image memory limits

The memory_mb field on sandbox images now correctly enforces both the request and the hard limit for containers provisioned from that image. Valid range: 256 MB to 8192 MB.

TTL reaper grace window

The background TTL reaper now processes expired sandboxes in batches with a configurable grace window (default 60 seconds). This prevents thundering-herd spikes when many sandboxes expire simultaneously and ensures in-flight requests complete cleanly.

Bug fixes

• Fixed sandbox list endpoint not filtering correctly when both status and X-Workspace-Id were provided simultaneously
• Fixed registry credentials not being applied when a sandbox was reprovisioned with the same task_id