On this page

ACA Sandbox

Workflow reference | JIT tools | Local JIT tools

Kind: AcaSandbox
Configuration object: acaSandbox

Use ACA Sandbox to create a run-owned Azure Container Apps sandbox instance in an existing, approved sandbox group. Code-tool steps can reference it to share one instance and filesystem for the run.

Inputs

The sandbox is selected through static resource and runtime configuration. Workflow task data does not select a subscription, resource group, image, or credential. An operator-authored kickstart script initializes the instance once.

Referencing JIT or Local JIT steps use the node's sandboxNodeId. The runtime adds an inferred dependency; a data connection from the Sandbox step is optional and only needed when its result is useful as data.

Configuration

Property	Default	Usage
`useResourceId`	`true`	Select a full sandbox-group ARM resource ID.
`resourceId`	`""`	Existing `Microsoft.App/sandboxGroups` resource ID. Required when using that selection mode.
`subscriptionId`	`""`	Subscription GUID for separate-field mode.
`resourceGroup`	`""`	Resource group for separate-field mode.
`sandboxGroup`	`""`	Sandbox group name for separate-field mode.
`location`	`"eastus2"`	The sandbox group's Azure region.
`diskImage`	`"python-3.13"`	Approved image name, up to 256 characters. The image must supply the selected tool runtimes.
`publicImage`	`true`	Select public-image behavior for the configured image.
`size`	`"M"`	`XS`, `S`, `M`, `L`, or `XL`.
`workingDirectory`	`"/tmp"`	Absolute Linux path, up to 512 characters.
`idleTimeoutSeconds`	`600`	Idle suspend interval, 60-3,600 seconds.
`autoDeleteAfterSeconds`	`86400`	Service auto-delete interval, 3,600-604,800 seconds.
`kickstartScript`	Readiness echo	Reviewed initialization script, at most 128 KiB UTF-8.
`kickstartTimeoutSeconds`	`60`	1-600 seconds.
`credentialName`	`"ACA_SANDBOX"`	Protected runtime identity binding, at most 110 characters.
`applicationId`	Unset	Optional nonempty service-principal application GUID saved with the selection.
`packagedAuthentication`	`ManagedIdentity`	`ManagedIdentity` or `ServicePrincipal` in a packaged host.
`managedIdentityClientId`	`""`	Optional user-assigned identity GUID; empty selects system-assigned identity.
`showActivityVisualizer`	`false`	Enable the optional activity presentation.
`executionConsent`	`false`	Explicit approval for billable sandbox execution.

Sizes

Size	CPU	Memory	Disk
`XS`	0.25	0.5 GiB	20 GiB
`S`	0.5	1 GiB	20 GiB
`M`	1	2 GiB	20 GiB
`L`	2	4 GiB	40 GiB
`XL`	4	8 GiB	80 GiB

The identity needs approved access to the sandbox group. The contract identifies the Container Apps SandboxGroup Data Owner role for data-plane ownership operations. Configure permissions independently; adding this step does not grant them.

Outputs

Returns an object with kind: "benchius-aca-sandbox", the run-owned sandboxId, the configured group resourceId, and the kickstart result. Referencing tool steps obtain their own model-callable descriptors after this instance is ready.

All tools referencing the same node share the sandbox instance and filesystem. Calls to that instance are serialized. Tool definitions still follow their effective language, schema, example, invocation, and repair limits.

Example

{
  "id": "shared-sandbox",
  "name": "Prepare a shared Python sandbox",
  "kind": "AcaSandbox",
  "acaSandbox": {
    "useResourceId": true,
    "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-workflow/providers/Microsoft.App/sandboxGroups/workflow-sandbox",
    "location": "eastus2",
    "diskImage": "python-3.13",
    "size": "M",
    "workingDirectory": "/tmp",
    "credentialName": "ACA_SANDBOX",
    "packagedAuthentication": "ManagedIdentity",
    "executionConsent": false
  }
}

Replace the synthetic resource ID with an approved existing group and configure its identity. After operator approval, enable executionConsent. A tool node in the same graph can set sandboxNodeId to "shared-sandbox" and connect its own capability output to a model.

Operational notes

The host must provide sandbox authentication and the supported API connection. A host that requires approved JIT execution profiles rejects workflow-owned ACA targets.

Instance creation and kickstart are billable execution operations. The parent run requests deletion of its owned instance on completion, failure, timeout, or cancellation. It preserves the sandbox group. Failed or uncertain cleanup is surfaced; auto-delete settings are an additional service-side safeguard.

Review the image, script, network access, task data, and runtime isolation before execution. A shared filesystem is explicit run-local state, so design tools for sequential access and clear ownership of their files.