OpenSandbox: contracts, control, execution, and security Diagram

Contracts and control

Public specifications define stable client boundaries; diagrams show representative paths, not every API binding.
Lifecycle control validates setup, dispatches to a backend, stores state, and handles renewal and snapshot services.

Backend choice and data plane

Docker and Kubernetes are alternative provisioning backends, not consecutive stages.
The data plane contains the user workload and injected command/file control processes; Jupyter and volumes support execution.

Network and isolation

Ingress authentication, proxying, signed access, egress policy, and stronger runtimes have distinct responsibilities.
The security arrows show access or enforcement relationships; an optional secure runtime is selected by backend policy.