tailscale

Join a paid sandbox to your Tailscale network with your auth key.

The auth key is read from your job secret and given to the sandbox's tailscaled in memory; it is never answered, logged or written to the sandbox's disk. The machine is ephemeral: logging out takes it off the tailnet at once, and after a stop or a delete Tailscale removes it once it has been offline a while. The first join in a sandbox downloads Tailscale, which takes a few seconds more. While it is on a tailnet a sandbox is not forked or snapshotted from memory.

post/v1/sandboxes/{id}/tailscale

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/sandboxes/{id}/tailscale
  • Auth: HTTP bearer

Path parameters

idstring required

Resource identifier (UUID).

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

authKeySecretstring required

The name of a job secret holding a Tailscale auth key (runtime secrets set NAME --jobs). Use an ephemeral, tagged key; a reusable one lets the sandbox log in again by itself after a long pause.

hostnamestring

The machine's name on the tailnet, a DNS label. Default: the sandbox's name, or runtime- and its id's first eight characters.

tagsstring[]

Tailscale tags to advertise; the key must be allowed them.

Example request

{
  "authKeySecret": "TS_AUTHKEY",
  "tags": [
    "tag:ci"
  ]
}

Response

Success

runningboolean required
statestring nullable
modestring nullable
hostnamestring nullable
dnsNamestring nullable
addressesstring[] required
proxystring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.