Docker Compose runs one sandbox container per active Sandbox user. Use this path for a small, single-host Quor deployment that you trust and control.
If more than a few people will use Sandbox, especially concurrently, deploy Sandbox on Kubernetes instead.
Sandbox gives the API server and background container read-write access to the Docker socket. This read-write access is effectively root access to the host. The sandbox proxy receives read-only socket access.

​
Requirements

  • A full Docker Compose deployment of Quor 4.0.6 or later
  • Docker Engine with Compose
  • A host with capacity for the Quor stack and active sandbox containers
  • An Quor URL reachable through the sandbox proxy
Sandbox does not run with the Quor Lite Compose overlay.

​
New deployment

Run the Quor CLI installer with the Sandbox overlay:
The installer downloads docker-compose.craft.yml, enables Sandbox, selects the Docker sandbox backend, creates the sandbox bridge network and proxy CA volume, and starts the deployment.
The examples below use the CLI’s default deployment directory. For a deployment created by an older version of the install.sh script, replace ~/.config/onyx with your onyx_data directory (e.g. onyx_data/deployment/.env).
Open ~/.config/onyx/deployment/.env and set the Quor URL:
Then recreate the affected services with both Compose files:

​
Existing deployment

Set ONYX_SERVER_URL in the existing deployment’s .env, then rerun the installer:
The installer adds the Sandbox overlay and updates the existing .env with:
Setting ENABLE_CRAFT=true without the overlay is not sufficient. The overlay mounts the Docker socket, starts the sandbox proxy, and attaches the API server and background worker to the sandbox network.

​
Set the Quor URL

For production, use the public HTTPS URL users use to reach Quor:
For local Docker Desktop on macOS or Windows, use the host port selected by the installer:
On Linux, use a hostname or host address reachable from Docker containers. Compose service names such as api_server and nginx do not resolve from the isolated sandbox bridge.

​
Plan host capacity

Docker sandboxes default to one CPU and 2 GB of memory each:
Budget for the base Quor services plus the number of users who may run Sandbox concurrently. An idle sandbox is snapshotted and stopped after 3,600 seconds by default; change this with SANDBOX_IDLE_TIMEOUT_SECONDS when faster cleanup or longer-lived sandboxes are required. The sandbox image follows IMAGE_TAG. Keep the Quor backend and sandbox on the same release. Normal deployments should not set SANDBOX_CONTAINER_IMAGE separately.

​
Build Sandbox from source

docker compose up --build builds the Quor services declared in the Compose files. It does not build the Sandbox sandbox image because sandboxes are created dynamically by the API server rather than running as a Compose service. From the root of an Quor source checkout, build the sandbox image separately with a local, non-mutable tag:
Set the image in the .env used by your source checkout:
Then build and recreate the Quor services with the Sandbox overlay:
Do not use latest, edge, or beta for a locally built sandbox image. The API server treats these tags as mutable and attempts to refresh them from the registry before provisioning. Use a tag such as local-source.
Setting IMAGE_TAG does not build the corresponding onyxdotapp/sandbox:${IMAGE_TAG} image. Either build that sandbox tag separately or set SANDBOX_CONTAINER_IMAGE explicitly. Recreate api_server and background after changing the setting. Existing sandbox-* containers continue using the image with which they were created and must be terminated and provisioned again to use the new image. If you instead launch from a staged directory such as onyx_data/deployment, copy the setting into that directory’s .env. Staged deployment directories do not contain the source checkout expected by the Compose build contexts, so use already-built or published images with --no-build.

​
Verify the deployment

Confirm the core services and proxy are running:
After configuring a model and user access, send a prompt in Sandbox. A sandbox container should appear:
The background service includes the worker used for Scheduled Task runs; no separate Compose service is required.

​
Network and host security

Sandbox containers join only the external onyx_craft_sandbox bridge. They cannot resolve PostgreSQL, Redis, object storage, or the API server by Compose service name. Their outbound HTTP and HTTPS traffic passes through sandbox-proxy, which enforces App policies and injects credentials after a request is approved.
On cloud VMs, block sandbox access to the instance metadata service at the host or platform level. On EC2, require IMDSv2 with HttpTokens=required and apply a host firewall rule that blocks Docker bridge traffic to 169.254.169.254.
See Sandbox Architecture for the complete trust and network model.

​
Troubleshooting

Confirm ENABLE_CRAFT=true and SANDBOX_BACKEND=docker, then recreate the API server and web application. Include both docker-compose.yml and docker-compose.craft.yml in the Compose command.
Set the value in the deployment directory’s .env and recreate the API server, background worker, and sandbox proxy with the Sandbox overlay.
Replace api_server, nginx, or another Compose-only hostname with the public Quor URL or a host address reachable from Docker containers.
Run docker compose -f docker-compose.yml -f docker-compose.craft.yml logs sandbox-proxy. Check ONYX_SERVER_URL, PostgreSQL and Redis availability, the sandbox_proxy_ca volume, and access to the Docker socket.
Rerun onyx-cli deploy install --include-craft. If automatic creation fails, create the resources and restart the deployment:
Inspect the sandbox container logs and host memory pressure. Increase SANDBOX_DOCKER_MEMORY_LIMIT or SANDBOX_DOCKER_CPU_LIMIT only when the host has enough capacity for every concurrent sandbox.

Sandbox deployment overview

Compare the Docker Compose and Kubernetes paths.

Managing Sandbox

Configure models and user access after deployment.