| Mount a host directory into the sandbox | BoxOptions(volumes=[(host, guest, read_only)]) | examples/python/02_features/mount_host_dir.py | volumes |
| Copy files between sandbox and host | box.copy_in / box.copy_out | examples/python/02_features/copy_files.py · examples/node/cp.js | lifecycle |
| Forward a port to the host | BoxOptions(ports=[...]) | examples/python/02_features/forward_ports.py | network-access |
| Restrict outbound network (allowlist) | BoxOptions(network=NetworkSpec(...)) | examples/python/02_features/network_allowlist.py | network-access |
| Override entrypoint/cmd/user | BoxOptions(cmd=, user=) | examples/python/02_features/set_cmd_and_user.py | configuration |
| Use a private/custom image registry | Options(image_registries=[...]) | examples/python/02_features/use_custom_registry.py · examples/node/custom_registry.js | configuration |
| Start from a local OCI image layout | rootfs_path= | examples/python/02_features/use_local_oci_bundle.py · examples/node/local_oci_bundle.js | configuration |
| Inject secrets (effective only for specified hosts) | BoxOptions(secrets=[Secret(...)]) | — (see concept page) | secrets-and-security |
| Tighten security isolation | advanced=AdvancedBoxOptions(security=SecurityOptions.maximum()) | — (see concept page) | secrets-and-security |