SandboxLaunchProfile

The launch configuration of one Pix sandbox: what the next launch or relaunch of the sandbox installs and how Belai runs on it. A field left out inherits the product default. The sandbox is bought in the console and never created here; one sandbox has one launch configuration, so a document for a sandbox adopts it. Applying a change marks the sandbox for relaunch. The egress mode is SandboxEgressPolicy’s; model providers, provisioning and models keep their own console pages. Only an owner or admin can change it. Deleting the document resets every field it manages to inherit.

apiVersion	vulnetix.com/v1
kind	SandboxLaunchProfile
Group	Pix
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists SandboxLaunchProfile in its kinds. See Management tokens.
Terraform resource	vulnetix_sandbox_launch_profile, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/SandboxLaunchProfile.schema.json
Newest schema	latest/SandboxLaunchProfile.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema SandboxLaunchProfile

Minimal

Only the fields the kind requires. From examples/SandboxLaunchProfile/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxLaunchProfile.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxLaunchProfile
metadata:
  name: dev-sandbox
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b

HCL (resource vulnetix_sandbox_launch_profile)

# Only the arguments the kind requires. From config-schemas examples/SandboxLaunchProfile/minimal.yaml.

resource "vulnetix_sandbox_launch_profile" "dev_sandbox" {
  name    = "dev-sandbox"
  sandbox = "3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxLaunchProfile.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxLaunchProfile
metadata:
  name: dev-sandbox
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/SandboxLaunchProfile/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxLaunchProfile.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxLaunchProfile
metadata:
  name: dev-sandbox
  labels:
    team: platform
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b
  packs: [python, node]
  extensions:
    - name: ripgrep
      registry: nixpkgs
      version: "14.1.0"
      checksum: sha256-AbCdEf0123456789AbCdEf0123456789AbCdEf01234=
  image: ghcr.io/vulnetix/pix-sandbox@sha256:2f4c6a8e0b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a
  notes: Pinned to the October image until the Python 3.13 packs land.
  webControls: true
  webGuardrailsOff: false
  webProjectSettings: true
  classifier: jev
  versionPolicy:
    strategy: pinned
    pins:
      ruff: "0.8.4"

HCL (resource vulnetix_sandbox_launch_profile)

# Every argument the kind supports. From config-schemas examples/SandboxLaunchProfile/advanced.yaml.

resource "vulnetix_sandbox_launch_profile" "dev_sandbox" {
  name       = "dev-sandbox"
  classifier = "jev"
  extensions = [
    {
      checksum = "sha256-AbCdEf0123456789AbCdEf0123456789AbCdEf01234="
      name     = "ripgrep"
      registry = "nixpkgs"
      version  = "14.1.0"
    },
  ]
  image   = "ghcr.io/vulnetix/pix-sandbox@sha256:2f4c6a8e0b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a"
  notes   = "Pinned to the October image until the Python 3.13 packs land."
  packs   = ["python", "node"]
  sandbox = "3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b"
  version_policy = {
    pins = {
      ruff = "0.8.4"
    }
    strategy = "pinned"
  }
  web_controls         = true
  web_guardrails_off   = false
  web_project_settings = true
  labels = {
    team = "platform"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxLaunchProfile.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxLaunchProfile
metadata:
  name: dev-sandbox
  labels:
    team: platform
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b
  packs: [python, node]
  extensions:
    - name: ripgrep
      registry: nixpkgs
      version: "14.1.0"
      checksum: sha256-AbCdEf0123456789AbCdEf0123456789AbCdEf01234=
  image: ghcr.io/vulnetix/pix-sandbox@sha256:2f4c6a8e0b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a
  notes: Pinned to the October image until the Python 3.13 packs land.
  webControls: true
  webGuardrailsOff: false
  webProjectSettings: true
  classifier: jev
  versionPolicy:
    strategy: pinned
    pins:
      ruff: "0.8.4"
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly SandboxLaunchProfile	Always SandboxLaunchProfile.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.sandbox	string	yes		pattern ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$	The sandbox, by its id (a lower-case UUID), as the console’s sandbox page shows it.
spec.packs	array of string	no		0 to 32 items; each item: pattern ^[a-z0-9][a-z0-9-]{0,31}$	The tool packs installed, at most 32. An empty list installs none; left out, the product default packs.
spec.extensions	array of object	no		0 to 64 items	Extra packages installed, at most 64.
spec.extensions[].name	string	yes		length 1 to 128	The package name in its registry.
spec.extensions[].registry	string	no		nixpkgs, nixhub, flakehub	Where the package comes from. Left out, nixpkgs.
spec.extensions[].version	string	no		length 0 to 64	The version wanted. Left out, the registry’s current one.
spec.extensions[].checksum	string	no		length 0 to 128	The expected content hash, as the registry states it (sha256-…).
spec.image	string	no		pattern ^[a-z0-9.-]+(/[A-Za-z0-9._-]+)+@sha256:[0-9a-f]{64}$	The machine image, pinned by digest (registry/name@sha256:<64 hex>), never a tag. Left out, the product default image.
spec.notes	string	no		length 0 to 2000	Free notes for the sandbox’s owners, one line of at most 2000 characters.
spec.webControls	boolean	no			Let a browser session control Belai (belai rc –web-controls).
spec.webGuardrailsOff	boolean	no			Let a browser session turn the guardrails off. Needs webControls on.
spec.webProjectSettings	boolean	no			Let a browser session change project settings.
spec.classifier	string	no		clef, jev, tev1	The decision model Belai uses: clef, jev, or tev1 (used only while the sandbox’s provider keys include Together AI).
spec.versionPolicy	object	no		no other keys	Which versions of installed packages a launch aims at. Left out, none is set.
spec.versionPolicy.strategy	string	yes		safest, stable, latest, rolling, pinned
spec.versionPolicy.pins	object	no		0 to 100 keys; map of string to string (pattern ^[0-9A-Za-z][0-9A-Za-z._+-]{0,63}$); keys match ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$	Versions pinned by nixpkgs attribute, at most 100. The pinned strategy needs at least one.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• One per sandbox. The sandbox itself is bought in the console.
• The draft is checked by the launch page’s own preparation and validation, and saving it marks the sandbox for relaunch. The egress mode, providers, provisioning and models are left as stored.
• Owner or admin only. Delete resets the managed fields to inherit.

Terraform and OpenTofu

The resource is vulnetix_sandbox_launch_profile in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_sandbox_launch_profile.

Import an object that already exists by its name:

# Import an existing SandboxLaunchProfile by its name (metadata.name).
terraform import vulnetix_sandbox_launch_profile.dev_sandbox dev-sandbox

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.