Not sure which key? ssh-add -L prints the keys your SSH agent holds, or try cat ~/.ssh/id_ed25519.pub. Paste one whole line starting with ssh-, never a private key.
storage charged to your pool and current machine usage
Disk
–
–
Memory
–
–
CPU
–
–
No machines yet. Create one with ssh new@….
Snapshots
templates captured from a customized machine — fork one, or bind a tag to it
Snapshot
From
Tags
Size
Created
No snapshots yet. Capture one with the Snapshot action above.
Secrets
Delivered as environment variables to every machine that carries one
of their tags. Values are write-only — saved once, never shown again.
New secret
the tags decide which machines receive it
Values are write-only: once saved they can be updated or deleted, never
read back here. A secret reaches every machine that shares one of its tags —
new shells see changes now; running processes keep their old environment until
the machine reboots. Anything running inside a tagged machine can read these values.
Secrets are disabled on this host: the encryption key does not match the stored
data. An operator must resolve the key mismatch before secrets can be used.
Name
Tags
Version
Updated
No secrets yet. A secret is a value your machines get as an environment variable, and
the tags you give it decide which ones.
Network rules
Egress allowlists selected by any or all tags. Matching rule-sets combine
with the platform’s baseline domains.
New rule-set
use build or run selectors to target a sandbox purpose
A matching rule-set restricts a machine to its allowed domains, combined with
other matching rules and the platform’s baseline. Choose whether any or all tags
must match. Machines with no matching rules remain unrestricted. Rules take effect within seconds; existing connections may linger briefly.
Network rules are not enabled on this host.
Name
Allowed domains
Tags
Updated
No rule-sets yet. One lists the domains a machine may reach; tag a machine with its name
to hold it to that list.
Environments
The repos, secrets, egress and variables a machine gets, and a disk
with its setup already run. A machine joins one by carrying its name as a tag.
You are looking at a team's environments. Every
member can edit and build these. To apply an environment, add its name as a tag
under this team in the machine’s Configuration section. For example, add
web under this team; adding it
under Personal selects your personal environment instead.
To move an environment of yours in here, switch back to your personal context
and pick Give to a team… from its ··· menu — that carries the whole
recipe across and retags your machines. Adding the tag by hand moves nothing.
New environment
the name is the tag machines carry to get all of this
Everything you attach here reaches every machine tagged with this name — the Secrets,
Network and Repos tabs are the same attachments seen one kind at a time.
Build then runs the setup script once in a throwaway machine called
<name>-build and keeps its disk, so the next machine you
make starts with the work already done.
setup.sh
The script a build runs, in the checkout, as you. It is read at
build time and never by a running machine, so saving one changes what
the next build does and nothing about the machines running now.
Environments are not enabled on this host.
No environments yet. One holds the repos, secrets and variables a project needs, and a
disk with its setup already run.
Teams
A team is a name and a roster. Environments, secrets, repos and
integrations owned by a team reach members' machines with matching tags selected
under that team in Configuration.
Operators only, for now. There is no self-service story yet — no owner
role, no invitations, no leaving — so an operator shapes every roster by hand. Removing
somebody stops future credential and configuration reads; it cannot take back values
already copied into a machine they are running.
New team
the workspace shown beside its tags
No teams yet. A team is how one environment, secret or integration reaches more than one
person's machines.
Repos
GitHub checkouts cloned into every machine that carries one of their
tags, while it boots.
Attach a repository
the tags decide which machines clone it
An attachment is configuration, not a copy: a machine created with one of
these tags clones the repository while it boots, into ~/<name>
— or ~/src/<owner>/<name> once more than one is attached.
Tagging a machine that already exists never clones: the entry appears as
not cloned, and sparkbox repos sync inside the machine does the
work when you ask for it. Detaching leaves existing checkouts where they are.
Repos are not enabled on this host.
Repository
Tags
Access
GitHub
Attached
No repositories yet. Attach one and every machine carrying its tags clones it while it
boots.
Integrations
Credentials your machines use but never hold. A machine carrying one of
an integration's tags dials https://<name>.proxy.…/ and the
gateway forwards the request upstream with the credential swapped in.
New integration
the tags decide which machines can dial it
The credential is write-only: saved once, never shown again, and never
inside a machine — anything running there can use it and cannot read it.
Upstreams are https:// only, the machine's own
Authorization header is replaced rather than merged, and the
proxy follows no redirects.
Integrations are not enabled on this host.
Name
Upstream
Injects
Tags
Reaches
Updated
No integrations yet. One is an upstream plus a credential your machines can use without ever
holding it; the tags you give it decide which machines.
