Make a sandbox workload portable through explicit artifacts

Port the workload contract, not the live machine

A portable execution task has explicit inputs, a reviewed program, declared dependencies and a verifiable output. That package can be recreated in another approved environment without moving an active process's memory. Lupin's hosted container surface uses the configured Boat provider and is separate from the consumer agent's optional Cloudflare backend. Treat those as different execution contracts. Inventory the filesystem assumptions, runtimes, external credentials, network operations and public-port needs before planning a move. A stopped sandbox or provider snapshot is not a universal interchange format that every other runtime can import.

Capture observed environment requirements

Inspect the actual language runtime and tools with bounded commands, then record the versions that affect the task. Use lockfiles or pinned manifests for dependencies and avoid relying on a provider's default package list as the only specification. The current Lupin image field is carried into provider environment metadata by its adapter; it does not establish arbitrary container-image provisioning or export. Likewise, the public API does not expose general CPU and memory sizing controls. Document these gaps so a destination environment can satisfy the workload's real requirements without inheriting unsupported assumptions about the original machine.

Create a small portable artifact bundle

Retain exact input files or durable references with content digests, the script, dependency manifests and an output schema. Use explicit task-owned paths and keep configuration separate from secret material. Lupin's built-in file transport is base64 with a roughly two-megabyte limit, so larger bundles need another approved storage route. Do not copy an entire home directory or provider credential store as a shortcut. The adapter's noEnv setting avoids automatic inheritance of operator secrets; preserve that separation when introducing credentials into the destination. A portable bundle should describe needed authority without embedding broad account access.

{"command":"python --version && pwd","timeout_seconds":30}

Verify behavior at both ends

Choose a deterministic local fixture that checks the task's meaningful property, such as preserving required records or rejecting malformed input. Run it in the original and destination environment when authorized, inspect exit status and verify the generated artifact. Report only the checks actually performed. A source-reviewed porting plan is not a successful migration test, and a fixture does not establish live provider availability or production performance. Keep external side effects out of the compatibility test when they are not required. If the workload contacts another service, test that authority and idempotency separately from its local transformation logic.

Cut over without losing lifecycle control

Save the user-facing artifact independently of either sandbox, then move future task stages to the verified destination. Recheck process readiness, file paths, network assumptions and application authentication before exposing a preview. Public-port URLs and desktop-shell links belong to their original resource and should not be treated as portable credentials. Stop unneeded original runtime and verify closure, retaining any unresolved cleanup issue separately from the workload result. The current Lupin API offers stop and resume rather than general deletion or point-in-time restore. A successful portability effort leaves a reproducible task bundle and checked behavior, not an unsupported claim that the old live machine moved intact.

Sources & verification

Reviewed against the current Lupin route, provider adapter and shared input contracts, plus the linked official references. Examples were not run against live services.

• docs.boat.dev · environments ↗Checked 2026-11-05
• docs.python.org · 3 · library · hashlib.html ↗Checked 2026-11-05

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.