Operator reference

Docker Compose

Deploy Craft sandboxes on a trusted Docker host

Before you begin

This reference describes the underlying platform. Use a Nexus school release with its school membership, class policy, and cost controls. Installing a base engine alone does not add those controls.

Docker Compose runs one sandbox container per active Craft user. Use this path for a small, single-host Nexus deployment that you trust and control.

If more than a few people will use Craft, especially concurrently, deploy Craft on Kubernetes instead.

Craft gives the API server and background container read-write access to the Docker socket. This read-write access is effectively root access to the host. The sandbox proxy receives read-only socket access.

Requirements#

A full Docker Compose deployment of Nexus 4.0.6 or later
Docker Engine with Compose
A host with capacity for the Nexus stack and active sandbox containers
A Nexus URL reachable through the sandbox proxy

Craft does not run with the Nexus Lite Compose overlay.

New deployment#

Run the Nexus CLI installer with the Craft overlay:

onyx-cli deploy install --include-craft

The installer downloads docker-compose.craft.yml, enables Craft, selects the Docker sandbox backend, creates the sandbox bridge network and proxy CA volume, and starts the deployment.

The examples below use the CLI's default deployment directory. For a deployment created by an older version of the install.sh script, replace ~/.config/onyx with your onyx_data directory (e.g. onyx_data/deployment/.env).

Open ~/.config/onyx/deployment/.env and set the Nexus URL:

ONYX_SERVER_URL=https://onyx.example.com

Then recreate the affected services with both Compose files:

cd ~/.config/onyx/deployment
docker compose \
-f docker-compose.yml \
-f docker-compose.craft.yml \
up -d --force-recreate

Existing deployment#

Set ONYX_SERVER_URL in the existing deployment's .env, then rerun the installer:

onyx-cli deploy install --include-craft

The installer adds the Craft overlay and updates the existing .env with:

ENABLE_CRAFT=true
SANDBOX_BACKEND=docker

Setting ENABLE_CRAFT=true without the overlay is not sufficient. The overlay mounts the Docker socket, starts the sandbox proxy, and attaches the API server and background worker to the sandbox network.

Set the Nexus URL#

For production, use the public HTTPS URL users use to reach Nexus:

ONYX_SERVER_URL=https://onyx.example.com

For local Docker Desktop on macOS or Windows, use the host port selected by the installer:

ONYX_SERVER_URL=http://host.docker.internal:3000

On Linux, use a hostname or host address reachable from Docker containers. Compose service names such as api_server and nginx do not resolve from the isolated sandbox bridge.

Plan host capacity#

Docker sandboxes default to one CPU and 2 GB of memory each:

SANDBOX_DOCKER_CPU_LIMIT=1.0
SANDBOX_DOCKER_MEMORY_LIMIT=2g

Budget for the base Nexus services plus the number of users who may run Craft concurrently. An idle sandbox is snapshotted and stopped after 3,600 seconds by default; change this with SANDBOX_IDLE_TIMEOUT_SECONDS when faster cleanup or longer-lived sandboxes are required.

The sandbox image follows IMAGE_TAG. Keep the Nexus backend and sandbox on the same release. Normal deployments should not set SANDBOX_CONTAINER_IMAGE separately.

Build Craft from source#

docker compose up --build builds the Nexus services declared in the Compose files. It does not build the Craft sandbox image because sandboxes are created dynamically by the API server rather than running as a Compose service.

From the root of a Nexus source checkout, build the sandbox image separately with a local, non-mutable tag:

docker build \
-t onyxdotapp/sandbox:local-source \
-f backend/onyx/server/features/build/sandbox/image/Dockerfile \
backend/onyx/server/features/build/sandbox/image

Set the image in the .env used by your source checkout:

SANDBOX_CONTAINER_IMAGE=onyxdotapp/sandbox:local-source

Then build and recreate the Nexus services with the Craft overlay:

cd deployment/docker_compose
docker compose \
-f docker-compose.yml \
-f docker-compose.craft.yml \
up -d --build --force-recreate

Do not use latest, edge, or beta for a locally built sandbox image. The API server treats these tags as mutable and attempts to refresh them from the registry before provisioning. Use a tag such as local-source.

Setting IMAGE_TAG does not build the corresponding onyxdotapp/sandbox:${IMAGE_TAG} image. Either build that sandbox tag separately or set SANDBOX_CONTAINER_IMAGE explicitly. Recreate api_server and background after changing the setting. Existing sandbox-* containers continue using the image with which they were created and must be terminated and provisioned again to use the new image.

If you instead launch from a staged directory such as onyx_data/deployment, copy the setting into that directory's .env. Staged deployment directories do not contain the source checkout expected by the Compose build contexts, so use already-built or published images with --no-build.

Verify the deployment#

Confirm the core services and proxy are running:

cd ~/.config/onyx/deployment
docker compose \
-f docker-compose.yml \
-f docker-compose.craft.yml \
ps api_server background sandbox-proxy

After configuring a model and user access, send a prompt in Craft. A sandbox container should appear:

docker ps --filter label=onyx.app/component=craft-sandbox

The background service includes the worker used for Scheduled Task runs; no separate Compose service is required.

Network and host security#

Sandbox containers join only the external onyx_craft_sandbox bridge. They cannot resolve PostgreSQL, Redis, object storage, or the API server by Compose service name. Their outbound HTTP and HTTPS traffic passes through sandbox-proxy, which enforces App policies and injects credentials after a request is approved.

On cloud VMs, block sandbox access to the instance metadata service at the host or platform level. On EC2, require IMDSv2 with HttpTokens=required and apply a host firewall rule that blocks Docker bridge traffic to 169.254.169.254.

See Craft Architecture for the complete trust and network model.

Troubleshooting#

Craft does not appear after changing the environment#

Confirm ENABLE_CRAFT=true and SANDBOX_BACKEND=docker, then recreate the API server and web application. Include both docker-compose.yml and docker-compose.craft.yml in the Compose command.

Sandbox provisioning reports that ONYX_SERVER_URL is missing#

Set the value in the deployment directory's .env and recreate the API server, background worker, and sandbox proxy with the Craft overlay.

The configured Nexus URL uses a Compose hostname#

Replace api_server, nginx, or another Compose-only hostname with the public Nexus URL or a host address reachable from Docker containers.

The sandbox proxy is unhealthy#

Run docker compose -f docker-compose.yml -f docker-compose.craft.yml logs sandbox-proxy. Check ONYX_SERVER_URL, PostgreSQL and Redis availability, the sandbox_proxy_ca volume, and access to the Docker socket.

The sandbox network or CA volume is missing#

Rerun onyx-cli deploy install --include-craft. If automatic creation fails, create the resources and restart the deployment:

  docker network create onyx_craft_sandbox
  docker volume create sandbox_proxy_ca

A sandbox exits or is killed during larger jobs#

Inspect the sandbox container logs and host memory pressure. Increase SANDBOX_DOCKER_MEMORY_LIMIT or SANDBOX_DOCKER_CPU_LIMIT only when the host has enough capacity for every concurrent sandbox.