Secrets and Connections

Sandbox sessions should use the same credential model as the rest of your Polyaxon workloads. Store credentials in Polyaxon connections or Kubernetes-backed secrets, then mount only the connections required by the run.

This page reuses sandbox/sandbox.yaml and the quick-start project from the Sandbox Quick Start. The examples below show the Python client first, followed by the equivalent CLI command.

Use Connections

Connections are managed by administrators and can represent storage, registries, Git credentials, databases, service accounts, and other external systems. See connections setup for available connection types.

Pass Connections to a Run

Attach connections under run.connections, or use a preset that patches this field:

run:
  kind: service
  connections:
    - github-ssh
    - model-storage
  container:
    image: python:3.11
    command: ["sleep", "infinity"]

Initialization handlers under run.init can consume an attached connection when they clone code or download data. Prefer presets for team-wide defaults:

from polyaxon.client import RunClient

connection_client = RunClient(project="quick-start")
connection_run = connection_client.create_from_polyaxonfile(
    polyaxonfile="sandbox/sandbox.yaml",
    presets=["dev-connections"],
    approved=True,
)
print(connection_run.uuid)

polyaxon run -p quick-start -f sandbox/sandbox.yaml --presets dev-connections

Both examples start a new service. Python returns its UUID as connection_run.uuid; for later CLI commands, replace the current value of RUN_UUID with the new run UUID.

Git over SSH

For private repositories, use an SSH connection instead of copying keys into the image or notebook.

Security Guidance

• Mount only the credentials required by the sandbox.
• Prefer short-lived or scoped credentials.
• Avoid printing secrets in logs or notebooks.
• Stop sandbox runs when access is no longer needed.
• Use RBAC and project permissions to control who can start and access sandboxes.

See the Python run client reference or the run CLI reference for the full interfaces.