Kubernetes CRDs (v1alpha1)

Auto-generated at build time from deploy/helm/cubepod/crds/ and api/v1alpha1/types.go.

PodBox (cubepod.io/v1alpha1)

• Resource: podboxes.cubepod.io | Scope: Namespaced | Short Names: pb, pbox

PodBox .spec

Field	Type	Required	Constraints	Description
spec.templateRef	string	No	—	Name of the PodTemplate defining runtime class, base OCI image, storage, and egress defaults.
spec.warmPoolRef	string	No	—	Optional PodWarmPool name to claim a pre-attached standby MicroVM in < 50ms.
spec.desiredState	string	Yes	enum: Running, Paused	Target sandbox compute state (Running or Paused). Setting Paused deletes the Pod (0 CPU/RAM) while retaining PVCs.
spec.rootfsGeneration	integer	No	—	Incremented monotonically to wipe and re-image the persistent RootFS upperdir PVC without touching /workspace.
spec.forkFrom	object	No	—	Copy-on-Write parent source to clone both RootFS and Workspace block volumes from.
spec.forkFrom.podBoxName	string	No	—	Name of the source PodBox whose dual volumes are cloned via CSI VolumeSnapshot.
spec.lifecycle	object	No	—	Idle auto-pause, paused TTL expiration, and lease lock controls.
spec.lifecycle.idleTimeoutSeconds	integer	No	—	Seconds of inactivity before cubepod-controller transitions the sandbox to Paused.
spec.lifecycle.pausedTTLSeconds	integer	No	—	Retention window (seconds) for PVCs while Paused before garbage collection.
spec.lifecycle.leaseExpiresAt	string (date-time)	No	—	RFC3339 timestamp until which an active agent lease prevents idle auto-pause.
spec.networkPolicy	object	No	—	Zero-Trust outbound firewall rules and cpodref_ credential bindings.
spec.networkPolicy.defaultAction	string	No	enum: Allow, Deny	Default egress posture when a destination host matches neither allowHosts nor denyHosts (Allow or Deny).
spec.networkPolicy.allowHosts	[]string	No	—	List of permitted destination hostnames or wildcard patterns (e.g., *.github.com).
spec.networkPolicy.denyHosts	[]string	No	—	List of blocked destination hostnames or wildcard patterns.
spec.networkPolicy.upstreamProxy	string	No	—	Optional upstream HTTP/HTTPS proxy URL chained behind cubepod-egress.
spec.networkPolicy.secretBindings	[]object	No	—	Array of cpodref_ placeholder bindings swapped by cubepod-egress over per-pod mTLS.
spec.networkPolicy.secretBindings[].envName	string	Yes	—	Environment variable name injected inside the MicroVM (holding only the opaque placeholder).
spec.networkPolicy.secretBindings[].placeholder	string	Yes	—	Opaque cpodref_... token exposed to guest processes instead of the real credential.
spec.networkPolicy.secretBindings[].allowedHosts	[]string	Yes	—	Destination hostnames permitted to receive the substituted real credential.
spec.networkPolicy.secretBindings[].allowedHeaders	[]string	No	—	Optional HTTP headers allowed for substitution (e.g., Authorization, x-api-key).

PodBox .status

Field	Type	Constraints	Description
status.phase	string	—	Observed PodBox phase (Pending, Provisioning, Running, Pausing, Paused, Resuming, ResettingRootFS, Failed, Terminated).
status.podName	string	—	Name of the currently bound Kubernetes Kata Pod (empty when Paused).
status.podIP	string	—	Cluster IP of the active sandbox Pod used by cubepod-gateway to proxy podd (:49983) and panel ports.
status.nodeName	string	—	Kubernetes node currently hosting the sandbox Pod.
status.rootfsPVCName	string	—	Bound PersistentVolumeClaim name for the OverlayFS upperdir block/filesystem volume.
status.workspacePVCName	string	—	Bound PersistentVolumeClaim name for /workspace (1000:1000).
status.observedRootfsGeneration	integer	—	Latest rootfsGeneration reconciled by the controller.
status.lastActivityAt	string (date-time)	—	Timestamp of last command, file operation, or panel traffic observed by gateway/controller.
status.pausedAt	string (date-time)	—	Timestamp when the sandbox entered Paused phase.
status.reason	string	—	Machine-readable reason code for phase transitions or failures.
status.message	string	—	Human-readable status message.

kubectl get podboxes Columns

Column	Type	JSONPath
Phase	string	.status.phase
Desired	string	.spec.desiredState
Pod	string	.status.podName
Age	date	.metadata.creationTimestamp

PodTemplate (cubepod.io/v1alpha1)

• Resource: podtemplates.cubepod.io | Scope: Namespaced | Short Names: pt, ptemplate

PodTemplate .spec

Field	Type	Required	Constraints	Description
spec.runtimeClassName	string	No	—	Kubernetes RuntimeClass for hardware isolation (e.g., kata-qemu or kata-clh).
spec.image	string	Yes	—	User/workload OCI container image (kept clean; podd-init and podd are injected via initContainer).
spec.poddImage	string	No	—	Override injector image containing /opt/cubepod/bin/{podd-init,podd}.
spec.resources	object	No	—	CPU and memory requests/limits for the sandbox MicroVM.
spec.resources.cpuRequest	string	No	—	Kubernetes CPU request (e.g., 500m).
spec.resources.cpuLimit	string	No	—	Kubernetes CPU limit (e.g., 2).
spec.resources.memoryRequest	string	No	—	Kubernetes memory request (e.g., 1Gi).
spec.resources.memoryLimit	string	No	—	Kubernetes memory limit (e.g., 4Gi).
spec.storage	object	No	—	CSI storage defaults for the dual rootfs and workspace PVCs.
spec.storage.storageClassName	string	No	—	CSI StorageClass name supporting volumeMode: Block (or Filesystem).
spec.storage.rootfsSize	string	No	—	Size of the RootFS upperdir PVC (e.g., 10Gi).
spec.storage.workspaceSize	string	No	—	Size of the /workspace PVC (e.g., 20Gi).
spec.egress	object	No	—	Per-template zero-trust egress sidecar configuration.
spec.egress.enabled	boolean	No	—	Whether cubepod-egress sidecar and nftables interception are injected.
spec.egress.image	string	No	—	Container image for cubepod-egress.
spec.egress.exchangeUrl	string	No	—	Control-plane vault URL queried over per-pod mTLS to exchange cpodref_ tokens.
spec.names	[]string	No	—	E2B-compatible template aliases and version tags (e.g., ubuntu:24.04, python-data:v1).
spec.cpuCount	integer	No	—	E2B integer vCPU count view synced with resources.
spec.memoryMB	integer	No	—	E2B memory size in MiB synced with resources.
spec.diskSizeMB	integer	No	—	E2B disk size in MiB synced with storage.rootfsSize.
spec.public	boolean	No	—	Whether the template is visible publicly in the E2B template catalog.
spec.startCmd	string	No	—	Optional command launched by podd after pivot_root completes.
spec.readyCmd	string	No	—	Readiness probe command run during template build verification and sandbox startup.
spec.runAsUser	integer (int64)	No	—	Numeric UID from OCI USER instruction (nil defaults to 1000, 0 preserves root).
spec.runAsGroup	integer (int64)	No	—	Numeric GID when OCI USER specifies <uid>:<gid>.
spec.runAsUsername	string	No	—	Named user resolved inside the container image when USER is non-numeric.

PodTemplate .status

Field	Type	Constraints	Description
status.templateID	string	—	Canonical template identifier returned in E2B Template API responses.
status.readyBuildID	string	—	Build ID of the latest successful BuildKit template build.
status.readyImage	string	—	Built OCI image reference currently served by this template.
status.latestBuildID	string	—	Most recent BuildKit build ID initiated for this template.
status.buildStatus	string	—	Latest build status (waiting, building, uploaded, ready, error).
status.reason	string	—	Machine-readable reason code for phase transitions or failures.
status.failedStep	string	—	Dockerfile/build step that failed if buildStatus == error.
status.public	boolean	—	—
status.buildCount	integer (int64)	—	Total build attempts tracked on this template.
status.spawnCount	integer (int64)	—	Total sandboxes spawned from this template.
status.createdAt	string	—	RFC3339 creation timestamp.
status.updatedAt	string	—	RFC3339 last update timestamp.
status.lastSpawnedAt	string	—	RFC3339 timestamp of the last sandbox creation.
status.builds	[]object	—	—
status.builds[].buildID	string	—	—
status.builds[].status	string	—	—
status.builds[].reason	string	—	—
status.builds[].failedStep	string	—	—
status.builds[].createdAt	string	—	—
status.builds[].updatedAt	string	—	—
status.builds[].cpuCount	integer (int32)	—	—
status.builds[].memoryMB	integer (int32)	—	—

kubectl get podtemplates Columns

Column	Type	JSONPath
Image	string	.status.readyImage
Build	string	.status.buildStatus
Age	date	.metadata.creationTimestamp

PodWarmPool (cubepod.io/v1alpha1)

• Resource: podwarmpools.cubepod.io | Scope: Namespaced | Short Names: pwp, warmpool

PodWarmPool .spec

Field	Type	Required	Constraints	Description
spec.templateRef	string	Yes	—	Name of the PodTemplate defining runtime class, base OCI image, storage, and egress defaults.
spec.replicas	integer	Yes	min: 0	Target count of pre-formatted, pre-pivoted standby MicroVM Pods kept ready to claim.

PodWarmPool .status

Field	Type	Constraints	Description
status.readyReplicas	integer	—	Number of standby Pods that passed podd readiness checks.
status.availableReplicas	integer	—	Number of standby Pods immediately available for < 50ms sandbox claiming.

kubectl get podwarmpools Columns

Column	Type	JSONPath
Desired	integer	.spec.replicas
Ready	integer	.status.readyReplicas
Available	integer	.status.availableReplicas
Age	date	.metadata.creationTimestamp

Inspecting CRDs on a Cluster

kubectl get crds | grep cubepod.io
kubectl get podboxes,podtemplates,podwarmpools -n cubepod-workloads