Sharing Sandboxes

Every sandbox is owned by one user and private by default: only the owner and project or org admins can see it. There is no create-time sharing flag. You create a sandbox, then share it when you want others to use it.

Who can do what

A sandbox owner can share, transfer, and operate their sandbox. Other project members gain access only after the owner shares it:

Ownership actions (share, unshare, transfer) are restricted to the owner or a project/org admin. A member with manage access can delete a shared sandbox but cannot reshare or transfer it.

List

tektona sandbox ls                              # your sandboxes in the current project (scope=mine)
tektona sandbox ls --scope shared               # sandboxes others shared with you
tektona sandbox ls --scope all                  # every sandbox you can access
tektona sandbox ls --all-projects               # your sandboxes across every project in the org
tektona sandbox ls --all-projects --scope all   # everything you can access, org-wide

--scope controls whose sandboxes you see (mine (default), shared, or all), and --all-projects controls which projects are searched (the current one, or every project in the org). They are independent: by itself --all-projects still uses --scope mine, so it shows your own sandboxes everywhere, not everyone's.

Listing never reveals another member's private sandbox. all means everything you can access, not everything that exists. To see other members' sandboxes (including private ones), use tektona admin sandbox ls.

The table always shows a SHARE TYPE column (use, manage, or — for private). For --scope shared/all it also adds an OWNER column (the owner's display name, falling back to their email), omitted for --scope mine, since those are all yours. --all-projects adds a PROJECT column (org/project). The ownership columns come after the core ones, and sandbox IDs are ULIDs:

ID                          STATE    IMAGE     AGE   PROJECT          OWNER         SHARE TYPE
01JR3K8YHX9ZQM4N7P2VWB6C5D  running  node:22   2h    my-corp/backend  Ada Lovelace  use
01JR3KA2F0WT8YE5RND6VQ7H3M  running  python:3  1d    my-corp/backend  Grace Hopper  manage

Share

tektona sandbox share <sandbox-id>                 # share for use (default)
tektona sandbox share <sandbox-id> --type use      # members can operate
tektona sandbox share <sandbox-id> --type manage   # members can also delete

--type is use (default) or manage.

Unshare

Make a shared sandbox private again. It returns to owner-and-admins-only visibility.

tektona sandbox unshare <sandbox-id>

Transfer ownership

Hand a sandbox to another project member. The new owner must already be a writer or higher in the sandbox's project. Accept an email or a user ID:

tektona sandbox transfer <sandbox-id> dev@acme.com
tektona sandbox chown <sandbox-id> <user-id>      # alias

Ownership carries the sandbox's credentials and egress allowlist, so a transfer revokes outstanding SSH, VNC, and preview tokens for the sandbox. The previous owner's open sessions stop working and must be re-established by the new owner.

Administer sandboxes

tektona admin sandbox is the privileged oversight surface. It lists, pauses, and deletes every sandbox in scope, including other users' private ones. It requires project-admin (project-scoped) or org-owner (--all-projects). The server returns 403 otherwise.

tektona admin sandbox ls                          # all sandboxes in the project
tektona admin sandbox ls --all-projects           # org-wide (org-owner)
tektona admin sandbox ls --owner dev@acme.com     # filter by owner
tektona admin sandbox ls --orphaned               # sandboxes with no owner
tektona admin sandbox ls --older-than 24h         # older than a duration
tektona admin sandbox ls --state running          # filter by state
tektona admin sandbox get <sandbox-id>            # details for any sandbox, incl. another user's private one

The list shows ID, STATE, IMAGE, AGE, OWNER, and SHARE TYPE. With no --state filter every state is shown, so terminated sandboxes appear too. --all-projects adds the PROJECT column (org/project).

--orphaned surfaces sandboxes whose owner is gone, so an admin can clean them up.

Pause or delete any sandbox by ID:

tektona admin sandbox pause <sandbox-id>                  # hibernate (default)
tektona admin sandbox pause <sandbox-id> --mode suspend
tektona admin sandbox rm <sandbox-id>                     # prompts to confirm
tektona admin sandbox rm <sandbox-id> --yes               # skip the prompt