A controller is only useful when its failure modes are legible. Operate Sandbox with a clear controller/worker split, durable state, explicit capacity, and enough telemetry to distinguish policy rejection from runtime failure.

Controllers should not execute tenant code. Run stateless controllers with PostgreSQL as the durable store and workers on dedicated hosts. Use NATS only when lifecycle event delivery needs it; the database remains the source of truth.

Workers advertise allocatable—not raw—CPU, memory, disk, PID, runtime, region, and label capacity. Leave headroom for the host and runtime before reporting capacity to the scheduler.

SANDBOX__... values override the reviewed configuration file. Examples include the controller bind address, distinct operator and worker tokens, database DSN, event bus, maximum TTL, microVM risk threshold, output cap, and worker runtime selection.

The default microVM threshold is a security policy value, not a performance tuning knob. Review changes to it like a firewall rule and keep token/database values out of Git.

no_capacity means no healthy worker meets all constraints. Check the required isolation tier, free resources, labels, locality, heartbeat freshness, drain state, pressure, image availability, and registry access before relaxing anything.

A caller timeout is ambiguous. It does not cancel the server operation or prove failure. Inspect the original operation before repeating create, exec, tunnel, or delete. Repeating a command with external side effects without that inspection can make one failure into two.

Keep public tunnels opt-in and short-lived. Verify the returned URL, remove the route when the job ends, and expect a brief bounded proxy convergence window after deletion. Monitor controller and edge logs when a route does not settle.

Back up PostgreSQL as durable desired state. Test restoration and reconcile workers after recovery; events are best-effort and cannot replace the database. If a worker may be compromised, drain or remove it, rotate the worker token, inspect its host boundary, and treat tenant runtime state as untrusted.

For the client-side recovery rules, use the CLI guide. For current edge visibility, use Status.