Sandbox Sharing Mode

The Sharing Mode of a sandbox controls who is allowed to access the workloads inside it. In this context, access means direct access into workloads — SSH, Web Terminal, Web IDE, remote IDEs, Remote Desktop, and remote execution. Sharing mode does not affect the ability to update the sandbox definition, change environment variables, or perform management operations.

There are three sharing modes:

Shared Mode

This allows all members in the same org to access any workload inside the sandbox. Due to the unlimited access, the sandbox owner's private secrets are not mounted in the workspace filesystem in this mode.

Collaborated Mode

The owner can switch to Collaborated Mode by specifying which org members are allowed to access the workloads. When doing so, the owner can also explicitly list which private secrets should be mounted for the collaborators.

Private Mode

Only the sandbox owner can access workloads. All private secrets belonging to the owner are mounted. Even org admins cannot access the workloads in this mode.

Default for New Sandboxes

New sandboxes are created in Shared Mode by default, unless:

Viewing and Changing the Sharing Mode

The current sharing mode is shown in the Web UI. To change it:

cs sandbox access show           # Show the current sharing mode
cs sandbox access shared         # Switch to Shared Mode
cs sandbox access private        # Switch to Private Mode
cs sandbox access invite         # Switch to Collaborated Mode and invite members

See Also