Secrets and Connections

Sandbox sessions should use the same credential model as the rest of your Polyaxon workloads. Store credentials in Polyaxon connections or Kubernetes-backed secrets, then mount only the connections required by the run.

This page reuses sandbox.yaml and the quick-start project from the Sandbox Quick Start.

Use Connections

Connections are managed by administrators and can represent storage, registries, Git credentials, databases, service accounts, and other external systems. See connections setup for available connection types.

Pass Connections to a Run

Attach connections under run.connections, or use a preset that patches this field:

run:
  kind: service
  connections:
    - github-ssh
    - model-storage
  container:
    image: python:3.11
    command: ["sleep", "infinity"]

Initialization handlers under run.init can consume an attached connection when they clone code or download data. Prefer presets for team-wide defaults:

polyaxon run -p quick-start -f sandbox.yaml --presets dev-connections

This command starts a new service. To connect to it with later sandbox commands, replace the current value of RUN_UUID with the new run UUID.

Git over SSH

For private repositories, use an SSH connection instead of copying keys into the image or notebook.

Security Guidance

• Mount only the credentials required by the sandbox.
• Prefer short-lived or scoped credentials.
• Avoid printing secrets in logs or notebooks.
• Stop sandbox runs when access is no longer needed.
• Use RBAC and project permissions to control who can start and access sandboxes.