Python Sandbox SDK volumes

Create, mount, list, and delete sandbox volumes with the Python Sandbox SDK

Volumes provide persistent storage that can be mounted into Porter Sandboxes. Create a volume before launching the sandbox, then pass the volume ID in volume_mounts.

Sandboxes are in a private beta. Please reach out to us at [e-mail] or over Slack if you are interested in joining.

Create and mount a volume

from porter_sandbox import Porter

with Porter() as porter:
    volume = porter.volumes.create(name="agent-workspace")

    sandbox = porter.sandboxes.create(
        image="python:3.12-slim",
        volume_mounts={"/workspace": volume.id},
    )

    try:
        sandbox.exec(["python", "-c", "open('/workspace/result.txt', 'w').write('done')"])
        result = sandbox.exec(["cat", "/workspace/result.txt"])
        print(result.stdout)
    finally:
        sandbox.terminate()

volume_mounts is a dictionary keyed by the absolute mount path inside the sandbox. Each value is a volume ID.

List volumes

with Porter() as porter:
    response = porter.volumes.list()

    for volume in response.volumes:
        print(volume.id, volume.name, volume.phase, volume.attached_to, volume.path)

Get a volume by name

Volume names are unique within the cluster. Use get(name) when you know a volume name:

with Porter() as porter:
    volume = porter.volumes.get("agent-workspace")
    print(volume.id)

Volume names may contain lowercase letters, numbers, and hyphens, and must start and end with a letter or number. A volume name must be unique within the cluster for the lifetime of the volume. After the volume is deleted, the name can be used again.

Inspect a volume

with Porter() as porter:
    volume = porter.volumes.get("agent-workspace")
    print(volume.name, volume.phase, volume.attached_to)

Access volume data from apps

Volumes live on a shared disk that apps on the same cluster can attach. Attach the disk named sandbox-volumes to a service in your app; it mounts at /data/<app-name>/sandbox-volumes and contains one subdirectory per volume.

Each volume response includes a path field with the volume’s subdirectory on that disk, so an app reads a volume’s data at /data/<app-name>/sandbox-volumes/<path>:

with Porter() as porter:
    volume = porter.volumes.get("agent-workspace")
    print(volume.path)  # sandbox-vol-2f1c8b7e-...

The disk is a live view: writes a sandbox makes to its mounted volume are visible to apps right away, and new volumes show up as new subdirectories without redeploying the app.

Volume contents are written by sandboxed workloads, which are often running untrusted code. Treat anything your app reads from this disk as untrusted input: hostile file contents, names, or sizes can exploit vulnerabilities in the code that processes them. Porter isolates the sandboxes themselves but does not inspect or sanitize what they write, so validating this data before acting on it is your application’s responsibility.

Delete a volume

Delete volumes by name:

with Porter() as porter:
    porter.volumes.delete("agent-workspace")

Deleting a volume fails while it is attached to a sandbox. Terminate any attached sandboxes before deleting the volume.

Async usage

from porter_sandbox import AsyncPorter

async with AsyncPorter() as porter:
    volume = await porter.volumes.create(name="async-workspace")

    sandbox = await porter.sandboxes.create(
        image="python:3.12-slim",
        volume_mounts={"/workspace": volume.id},
    )

    try:
        result = await sandbox.exec(["sh", "-lc", "echo hello > /workspace/out.txt && cat /workspace/out.txt"])
        print(result.stdout)
    finally:
        await sandbox.terminate()

Next steps

• Python Sandbox SDK quickstart
• Python Sandbox SDK reference
• Python Sandbox SDK errors