Sandbox Deployments

Deployment guides for AWS, GCP, and Azure.

Sandbox Deployments

StateSet Sandbox can be deployed on major cloud providers. Use the provider-specific guides for step-by-step instructions and infrastructure requirements.

Choosing a provider

All three run the same controller and runtime on managed Kubernetes. Pick on where the rest of your infrastructure lives, not on capability.

Provider	Cluster	Guide
AWS	EKS	AWS deployment
GCP	GKE	GCP deployment
Azure	AKS	Azure deployment

What every deployment needs

Regardless of provider:

• A managed Kubernetes cluster with room for the controller and runtime pods
• A container registry the cluster can pull from
• An ingress controller and TLS termination
• Network policy allowing the controller to reach the runtime, and nothing else to

Sandboxes execute untrusted code. Network policy is not optional hardening here — it is what stops a sandboxed process reaching the rest of your cluster. Read the security guide before the first production deploy, not after.

Before you go to production

The provider guides get a cluster running. These decide whether it survives contact with real workloads:

Concern	Where
Capacity, scaling, resource profiles	Production guide
Health probes, metrics, incident response	Operations
Isolation model and hardening	Security guide
Runtime selection	Runtime selection

Guides

• AWS Deployment
• GCP Deployment
• Azure Deployment

Related Documentation

• Operations Guide
• Production Guide