Deploy the reviewed Node controller with charts/stateset-sandbox/values-aks.yaml from the
Sandbox repository. This page replaces legacy one-shot infrastructure scripts with the
maintained chart/profile path. It is not a record of a new deployment.
Use an AKS node/region combination that actually supports the configured Kata Pod
Sandboxing runtime. Review the rendered RuntimeClass and compatible node placement rather
than assuming every AKS pool can run it. Provide Azure Database for PostgreSQL, Redis,
registry pull identity, and Blob permissions where selected. Direct URLs for expiring
Azure artifacts do not supply the candidate artifact-deadline guarantee; managed downloads
have their own contract.
Render before applying
From the Sandbox repository, inspect profile comments, replace placeholders, and review
immutable images, ingress/TLS, database secrets, runtime allowlists, RBAC, service accounts,
network policy, storage, and migration hooks. Follow docs/SELF_HOST.md for the actual
installation using your approved cluster and credentials.
Qualify the workload
Confirm the actual controller revision/digest and schema ledger, admitted RuntimeClass and
node, authenticated create/execute, original-receipt recovery, logs/results, cleanup, and
store/backup restoration. Add persistent workspace, snapshot, egress-negative, gateway,
artifact-expiry, and tunnel checks only for enabled features.
A ready pod or accepted NetworkPolicy does not attest containment. Source image publication
is separate from runtime deployment; a resource or region label cannot supply missing
infrastructure. Provider quotas, operational cost, capacity, and HA remain environment-specific.
Continue with common self-host setup,
security boundaries, and
recorded operations evidence.
Source basis: the maintained chart profile and docs/SELF_HOST.md, checked October 20, 2026. Last modified on October 20, 2026
