Monitoring agent sandboxes

Which webhooks does Sandboxer send?

A webhook endpoint gets a signed HTTPS request for lifecycle events on every sandbox in your account. Per Sandboxer's webhooks docs, these include:

• sandbox.ready, when a create, resume, fork or recover finished;
• sandbox.error, when a sandbox failed to start or crashed;
• sandbox.archived, when a stop completed;
• sandbox.degraded and sandbox.recovered, when the machine is up but can't be fully reached, and when it can again.

Each request is signed with an HMAC-SHA256 secret, so your endpoint can check it came from Sandboxer.

sbx webhook create https://example.com/hooks/sandboxer --event ready --event error --event archived

What does the OpenTelemetry export include?

Sandboxer pushes your account's telemetry to one OTLP/HTTP endpoint you choose, such as Datadog, Grafana, Honeycomb or New Relic, with nothing to install in your sandboxes. The OpenTelemetry docs list three signals:

Each sandbox is its own resource, so it shows up as its own series.

Can you see which commands an agent ran?

Yes. Every command run through the API is recorded with its output for 90 days, and you can read it even while the sandbox is stopped. Output of other processes in the sandbox is kept for 72 hours. See the command history docs.

sbx history <sandbox-id>   # newest first
sbx ps <sandbox-id>        # live process list, busiest first

Create a sandbox with --no-monitoring to keep none of this.

How do you check a webhook really came from Sandboxer?

Each webhook request carries a timestamp and an HMAC-SHA256 signature made with your endpoint's secret, which you get once when you create the endpoint. Your code computes the same HMAC over the timestamp and the raw request body and compares the two. The webhooks docs include working Node.js and Python examples. Check the signature before you act on an event, and reject requests whose timestamp is too old.