Deploy the reviewed Node controller with charts/stateset-sandbox/values-eks.yaml from the
Sandbox repository. This page replaces legacy one-shot infrastructure scripts with the
maintained chart/profile path. It is not a record of a new deployment.
Qualify the dedicated node group and installed gVisor RuntimeClass. The profile alone does
not install or attest every host runtime dependency. Provide RDS PostgreSQL connectivity,
ElastiCache/shared Redis policy, S3 permissions where selected, registry pull access, and
actual workload/controller identities. An AWS service account annotation does not grant
object access until its IAM trust and permissions are configured.
Render before applying
From the Sandbox repository, inspect profile comments, replace placeholders, and review
immutable images, ingress/TLS, database secrets, runtime allowlists, RBAC, service accounts,
network policy, storage, and migration hooks. Follow docs/SELF_HOST.md for the actual
installation using your approved cluster and credentials.
Qualify the workload
Confirm the actual controller revision/digest and schema ledger, admitted RuntimeClass and
node, authenticated create/execute, original-receipt recovery, logs/results, cleanup, and
store/backup restoration. Add persistent workspace, snapshot, egress-negative, gateway,
artifact-expiry, and tunnel checks only for enabled features.
A ready pod or accepted NetworkPolicy does not attest containment. Source image publication
is separate from runtime deployment; a resource or region label cannot supply missing
infrastructure. Provider quotas, operational cost, capacity, and HA remain environment-specific.
Continue with common self-host setup,
security boundaries, and
recorded operations evidence.
Source basis: the maintained chart profile and docs/SELF_HOST.md, checked October 20, 2026. Last modified on October 20, 2026
