Skip to main content
The maintained Helm chart is charts/stateset-sandbox in the Sandbox repository. It installs the Node controller, runtime RBAC/network policy, migration job, and configured supporting services. Workload pods are created by the controller, not as a fixed application deployment.

​
Common prerequisites

The source guide targets Kubernetes 1.29+, PostgreSQL 14+ (16 recommended), Redis 7, Helm 3.14+, metrics support, and an enforcing NetworkPolicy CNI. Admission policy needs its compatible Kubernetes version. Cloud/node/runtime support must be qualified separately. Configure registry access, immutable images, TLS ingress/CORS, secret/database identity, namespace, supported runtime nodes, persistent workspace/snapshot capabilities, and protected metrics. Never use a generic runc profile as evidence of gVisor or hardware isolation.

​
Repository profiles

Review profile comments and replace every placeholder. The chart can bundle development stores or use managed services; their backup, HA, workload identity, and network access differ.
This renders manifests without applying them. Review the rendered security/runtime/storage configuration and follow docs/SELF_HOST.md for installation with your actual secrets and cluster. Do not apply placeholder manifests as a working production deployment.

​
Provider guidance

  • GCP: GKE profiles, SQL identity, and recorded hosted limits.
  • AWS: EKS runtime, data stores, and object storage.
  • Azure: AKS Kata support, identity, and PostgreSQL.
After installation, record runtime/security acceptance, migration/store state, and production workload results. Source basis: the chart and docs/SELF_HOST.md, checked October 20, 2026.
Last modified on October 20, 2026