Control

Counts the daemon's non-terminal processes that hold the sandbox idle clock (PLAN-DAEMON-PROCESS-ACTIVITY): every non-PTY process a caller started — a standalone kind=exec process, a session member, or a kind=code cell, including a cell still queued in starting. PTYs, session shells, language kernels and system processes (the entrypoint, dockerd) never count, and neither do records reconciled lost at boot. The runner polls this route and keeps the sandbox from auto-stopping while busy is true. Read-only and immediate; it never waits.

Releases the runner-held entrypoint gate. Once released, the Linux daemon runs its one-per-boot startup coordinator: Docker Engine startup (reported on GET /docker/status), then the image entrypoint. fnReady=1 marks the release of a function-ready template build, which skips Docker startup (status deferred) but still starts the entrypoint. Idempotent — repeat calls answer 200 without spawning a second entrypoint. A platform without an image entrypoint (Windows) answers 200 as a no-op.

Issues FIFREEZE on the guest's scratch ext4 filesystem — the mount whose mountinfo root is /runtime/containerd (or /runtime/docker), bind-mounted by guest init — which checkpoints the journal and blocks new writers, so the runner's host-side trim can trust the captured copy's block bitmaps. The runner freezes right before pausing the VM and thaws after resume. An auto-thaw fires timeoutMs (default 10000, clamped to 1000..=30000) after the request arrives, so a lost thaw cannot wedge the guest. Idempotent: a repeat call while frozen re-arms the auto-thaw and answers 200. While frozen, other requests that write to that filesystem block until the thaw.

Issues FITHAW on the filesystem POST /rlp/fs-freeze froze and cancels its auto-thaw. Idempotent: nothing frozen, or a filesystem already thawed, answers 200. Windows sandboxes answer 200 as a no-op.

Returns the daemon's redacted bucket mount state. Credentials never appear in this response.

Applies the desired bucket mount set. Gateway credentials are write-only and never echoed back.

Unmounts one bucket mount by absolute path. The legacy name alias is still accepted for runner compatibility.

Pushes placeholder environment variables plus an optional PEM CA bundle fragment before the runner releases the entrypoint gate. Reserved keys are refused with 400 naming the key, and nothing from that request is stored: keys starting with RLP_, any DAYTONA_* key other than DAYTONA_SANDBOX_TOKEN, DAYTONA_API_URL, DAYTONA_OTEL_ENDPOINT, DAYTONA_DOCKER_START, DAYTONA_FN_PORT and DAYTONA_FN_HANDLER (the last two are platform-injected by the API's functions service for the tenant's handler process), and keys that are not valid variable names (empty, or containing =, NUL, CR or LF). The sandbox's create env travels on this route too, so PATH, LD_* and the CA-bundle variables (SSL_CERT_FILE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, NODE_EXTRA_CA_CERTS, GIT_SSL_CAINFO, DENO_CERT) are admitted; once an egress CA is installed, the daemon's own bundle paths replace any pushed value under the CA names. No size limit applies here: the API bounds the create env, and the tenant POST /env caps do not apply.

Arms one process-bound lifecycle action (delete, stop, or pause) for this sandbox.

The runner's first control call on every boot path (PLAN-DAEMON-LISTENER-HARDENING). Accepted without a bearer only while the daemon holds no token (bootstrap); once a token is set, the request must carry it as Authorization: Bearer … and the body's token replaces it (rotation — a clone resumed from a template rotates the template's token to a per-clone one). Re-pushing the token the daemon already holds is a 200 no-op, so a retry after a lost 200 is idempotent. The token lives in daemon memory only and is never echoed, logged or exported. Like every control route this one sits behind the gateway-peer guard (403); unlike the others it bypasses the bearer layer and checks the bearer itself (401). A daemon that predates control tokens answers the plain-text 404 page not found fallback.

Sets the OS user every later exec, session, SSH login and git operation runs as, creating the account inside the guest if the image lacks it (issue #167). Pushed by the runner before the entrypoint gate releases. One-shot per boot: re-pushing the same name is an idempotent no-op; a different name is refused.

Protocol 1 runner-only correlation state, not a credential or proof of ownership. The first session is sealed for the daemon's lifetime: a different session is refused with 409; repeating the session requires identical bindings.

Returns the oldest outstanding delivery without removing it. Waits at most 30000 ms. A missing request is null, not proof of execution failure.

Requires the submitted session, request, volume, generation, operation and delivery id. Identical completions replay; contradictory results refuse. Pending, unavailable and rate_limited finish this delivery but allow internal resubmission with the same effect identity and a new delivery id. Rate admission is enforced by the runner across reconnects.