sandbox-workspace Helm chart

Per-node daemon serving lazily hydrated, blob-backed sandbox workspaces. Source chart version 0.1.0. Published OCI artifacts use the immutable version from the deployment release record:

helm install sandbox-workspace oci://<your-registry>/charts/sandbox-workspace \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"

Values

Keys marked * are required. Defaults are the chart’s values.yaml; the deployment sets the rest.

Key	Type	Default	Description
`affinity`	`object`	`{}`
`cache.dir` *	`string`	`"/var/lib/hiloop/sandbox-workspace/cache"`	Host directory backing the node-local chunk cache. The path is the media decision: point it at local NVMe, a dedicated volume, or a directory on the node’s root disk; the daemon bounds and evicts within whatever filesystem backs it. Must live outside csi.kubeletRootDir, which is mounted Bidirectional; the render fails if it does not.
`controlSocket.path` *	`string`	`"/run/hiloop/sandbox-workspace-control/control.sock"`	Host path of the daemon’s node control Unix socket, dialled by privileged node agents to drive workspace snapshots. Must live outside csi.kubeletRootDir: the kubelet dials the sockets under that tree on behalf of customer pods, and these verbs must not be reachable from a customer workload.
`csi`	`object`	—	The Container Storage Interface surface a sandbox pod receives its workspace through. The kubelet mediates, so the customer pod carries an ordinary persistentVolumeClaim volume and needs no host access.
`csi.driverName` *	`string`	`"workspace.sandbox.hiloop.ai"`	CSI driver name: the CSIDriver object, the StorageClass provisioner, and the kubelet’s plugin directory are all this one string. Changing it strands every volume already provisioned under the old name. (non-empty)
`csi.kubeletRootDir` *	`string`	`"/var/lib/kubelet"`	Kubelet state directory. Its plugins tree holds this driver’s socket and its pods tree holds the per-pod publish targets, so a distribution that moves it sets this and nothing else. Must not contain cache.dir or controlSocket.path; the render fails if it does.
`csi.sandboxNamespace` *	`string`	`"hiloop-sandboxes"`	The only namespace whose workspace claims this driver provisions. A StorageClass is cluster-scoped and a workspace’s identity is derived from its claim’s name, so an unscoped driver would let a claim created anywhere in the cluster and named after an existing sandbox resolve to that sandbox’s filesystem. (non-empty)
`csi.storageClass` *	`object`	—	The StorageClass sandbox workspaces are claimed from. It ships with the driver because a class whose provisioner nothing serves leaves every claim Pending with no diagnosis at the claim.
`csi.storageClass.baseBuild`	`string`	`""`	Workspace-store build id of the golden filesystem a fresh workspace hydrates from (published with the binary’s publish-base command). A class property, not a per-sandbox one, and also the switch: a class with no base cannot serve a claim, so an empty value renders no class at all. Environment-specific, so it has no default.
`csi.storageClass.name` *	`string`	`"durable-blob"`	Class name. Point the api chart’s sandboxWorkspace.durable.storageClass at it. (non-empty)
`disruptionClass`		`"node-infra"`
`disruptionOverrides.justification`	`string`	`""`
`enabled`	`boolean`	—	Umbrella condition flag (the hiloop chart’s Chart.yaml condition sandbox-workspace.enabled). Has no effect in a standalone install.
`fullnameOverride`	`string`	`""`
`global.imagePullSecrets`	`array`	`[]`
`global.imageRegistry`	`string`	`""`
`global.sizing`	`small` \| `medium` \| `large` \| `xlarge`	—
`image.digest` *	`string`	`""`
`image.pullPolicy` *	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`
`image.repository` *	`string`	`"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/sandbox-workspace"`	(non-empty)
`nameOverride`	`string`	`""`
`nodeSelector`	`object`	`{"hiloop.ai/sandbox-node": "true"}`
`observability.enabled` *	`boolean`	`true`
`observability.otlpEndpoint`	`string`	`"http://otel-collector-agent.monitoring.svc.cluster.local:4317"`
`observability.resourceAttributes`	`string`	`"service.namespace=hiloop"`
`podAnnotations`	`object`	`{}`
`podLabels`	`object`	`{}`
`priorityClassName`	`string`	`"system-node-critical"`
`resources`	`object`	`{"requests": {"cpu": "100m", "memory": "256Mi"}}`	Requests only by default: the per-node daemon shares its node with the sandboxes it serves and sits in their read path.
`securityContext`	`object`	—	Container security context. The daemon plumbs node block devices and mounts workspace filesystems onto host paths, so privileged must remain true; the render fails when it is turned off.
`securityContext.privileged`	`boolean`	`true`
`securityContext.readOnlyRootFilesystem`	`boolean`	`true`
`serviceAccount.annotations`	`object`	`{}`
`serviceAccount.create`	`boolean`	`true`
`serviceAccount.name`	`string`	`""`	Name of the ServiceAccount. With create=true it overrides the generated name; with create=false it is REQUIRED and names the existing ServiceAccount to reuse, because the chart’s RoleBindings are rendered against it.
`sidecars`	`object`	—	The kubernetes-csi sidecars. Upstream components on their own release cadence, so they are pinned here rather than tracking this chart’s appVersion.
`sidecars.nodeDriverRegistrar` *	`object`	—	Registers the node plugin with the kubelet. The registration handshake is a kubelet-internal protocol; this is the component that owns it.
`sidecars.nodeDriverRegistrar.digest`	`string`	`""`
`sidecars.nodeDriverRegistrar.repository` *	`string`	`"602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/csi-node-driver-registrar"`	(non-empty)
`sidecars.nodeDriverRegistrar.tag`	`string`	`"v2.17.0-eksbuild.3"`
`sidecars.provisioner` *	`object`	—	Watches PersistentVolumeClaims and drives CreateVolume/DeleteVolume, with leader election and retry/backoff.
`sidecars.provisioner.digest`	`string`	`""`
`sidecars.provisioner.repository` *	`string`	`"602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/csi-provisioner"`	(non-empty)
`sidecars.provisioner.tag`	`string`	`"v6.3.0-eksbuild.2"`
`terminationGracePeriodSeconds`	`integer`	`30`	(min 0)
`tolerations`	`array`	`[{"key": "hiloop.ai/sandbox", "operator": "Equal", "value": "true", "effect": "NoSchedule"}, {"key": "hiloop.ai/runsc-not-ready", "operator": "Equal", "value": "true", "effect": "NoSchedule"}]`
`workspaceStore.url` *	`string`	`""`	Object-store base URL workspace manifests and chunks publish to and hydrate from. The URL scheme selects the backend; credentials come from the runtime’s ambient credential chain.

​Values

Values