Operations

Deploy topology, secrets, env vars, warm pool, and verify gates for desktop pods and VMs.

Desktop traffic spans GKE pods (Linux) and an AWS desktop VPC (Windows VM via Guacamole + EC2 Mac). Trainers only talk to the gateway; sandboxes pods reach private streamers over VPN / PrivateLink.

Profile	Where it runs	Notes
`desktop-ubuntu`	GKE `sandbox-jobs` pods	Warm pool; recycle after image push
`desktop-windows`	EC2 VM + Guacamole	`SANDBOX_VM_DESKTOP_VIEWER_HOST` from sandboxes
`desktop-macos`	External Mac (`aws-ec2-mac`)	Stream only reachable from sandboxes pods

Public internet exposure of RDP / VNC / Mac streams without the sandboxes token proxy is not supported.

Paired web applications (Draw.io)

Trainer desktops open a gateway URL that proxies to a private companion container. The application proxy is implemented; preprod/dev still need a reachable desktop→gateway :443 path before Chrome can load Draw.io.

Step-by-step design, auth facts, and the current connectivity blocker: Paired web applications.

Image deploy (Linux)

Build sandbox-desktop-ubuntu with TigerVNC -BlacklistThreshold 0 in supervisord.
Push to the env registry; CD updates the deployment.
Recycle warm pool: delete stale warm pods in sandbox-jobs.
Run scripts/verify-viewer-dev.sh.

Secrets

Secret	Profiles
Viewer signing key	all desktop
`sandbox-desktop-aws`	`desktop-macos` (`secret_ref`)
EC2 / Guacamole DB credentials	`desktop-windows`

GSM → ESO wiring: in-repo docs/sandbox/SECRETS.md.

Env parity

New env vars must appear in payload*.json.example, Helm values, and Terraform.

Variable	Purpose
`SANDBOX_VM_DESKTOP_VIEWER_HOST`	Guacamole host for Windows VM backend
`SANDBOX_VM_DESKTOP_VIEWER_ENDPOINT`	Alternate host:port form
`SANDBOX_VM_DESKTOP_VIEWER_PORT`	Guacamole port (default 4822)
`SANDBOX_AWS_EC2_MAC_VIEWER_HOST`	Override Mac stream host (dev/smoke)

Verify gate (dev)

make check-sandbox
scripts/verify-viewer-dev.sh
scripts/verify-viewer-windows-dev.sh
scripts/verify-viewer-macos-dev.sh

Set catalog enabled: true for each profile only after its verify script passes. desktop-windows and desktop-macos ship enabled: false until then.

Warm pool

desktop-ubuntu uses SessionWarmPool. After image updates, drain old pods so trainers do not get stale TigerVNC configs.

ide-ubuntu has no claimable warm pool. On dev, ideWarm keeps warm nodes for it instead: balloon pods (sandbox-ide-warm in sandbox-jobs) run the pinned IDE image, and the sandboxes service deletes one when a new session cannot schedule. A sandbox-ide-prepull DaemonSet caches each new image tag on every eligible node. Both roll automatically with each deploy, so no manual drain is needed. Runbook: docs/sandbox/runbooks/ide-warm-nodes.md.

Cross-cloud networking

Sandboxes pods must reach:

Guacamole (Windows) — typically :8080 / configured viewer port
EC2 Mac private stream port (macOS)

Document CIDRs and VPN/PrivateLink endpoints in the infra runbooks (turing-agios-infra).

Operations

On this page