What sbx move carries to the cloud Top row, left to right: the local sandbox m101-demo is stopped and captured as one template image, the image is uploaded, and a new cloud sandbox named moved-m101-demo plus a suffix starts from it. Below, the left column lists what travels inside the image: the sandbox filesystem, the kit network rules, the published TCP ports republished under cloud URLs, and the environment variables of the local sandbox. The right column lists what stays on the host: the bind mount, the secrets in the sbx secret store, local policy rules, and running processes, with active HTTP method rules prompting before the move. At the bottom, the destination starts a TTL clock with a one hour default and a 24 hour ceiling. SBX MOVE M101-DEMO --TO CLOUD m101-demo local sandbox under sandboxd stopped while it is captured template image the sandbox filesystem one OCI image, pushed moved-m101-demo plus a unique suffix new id, small shape capture upload TRAVELS INSIDE THE IMAGE STAYS ON THE HOST the sandbox container filesystem files, packages, agent state kit network rules example.org from env-mixin (12-kit-add.txt) published TCP ports republished under cloud HTTPS URLs environment variables part of the local image host bind mount $CAPTURE/fixtures/repo, not in the image secrets in the sbx secret store M101_RECV_KEY, the cloud store is separate local policy rules local:<uuid> rules, cloud policy applies running processes and memory the destination boots from the image copied into the image active HTTP method rules they prompt first, --force keeps the warning TTL on the destination default 1h from the server, hard ceiling 24h from creation --on-timeout stop keeps it, delete removes it, sbx --cloud ttl +2h extends it clock starts