Bring your own storage (BYOS3)

Mount your own S3-compatible bucket into a sandbox as a filesystem path. You retain control of the bucket, its region, and its objects. Your workload reads and writes those objects through the mount.

Bucket location is one part of data residency. Choose the sandbox's compute region too: data read from the bucket can enter sandbox memory or be copied to its root filesystem. Pause snapshots preserve memory and root-disk state in separate platform storage. Discuss snapshot location and retention with our team if your workload has residency requirements.

Works with any S3-compatible store

A disk is registered with an endpoint, bucket, region, and credentials, so anything that speaks the S3 API works:

Credentials are encrypted at rest (AES-256-GCM), are write-only, and are never returned in any API response.

Storage ownership and location

• Your bucket, your region. Choose the bucket location for objects written through the mount. This does not determine the location of compute, copies, or snapshots.
• Your provider, your controls. Bucket policies, versioning, encryption keys, and audit logging stay under your account, not ours.
• Detach preserves objects. Detaching removes the mount without deleting the bucket or its objects.

How to mount a bucket

1. Register the bucket as a disk

curl -X POST https://api.sb.createos.sh/v1/disks \
  -H "X-Api-Key: $CREATEOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "eu-data",
    "kind": "s3",
    "config": {
      "bucket": "my-eu-bucket",
      "endpoint": "https://s3.eu-central-1.amazonaws.com",
      "region": "eu-central-1"
    },
    "credentials": {
      "access_key": "AKIA…",
      "secret_key": "wJalrX…"
    }
  }'

The API probes the bucket at registration time to catch typos early. For MinIO and most self-hosted S3 stores, add "use_path_style": true to config.

2. Attach it to a sandbox

Attach at create time, or live to a running sandbox:

curl -X POST https://api.sb.createos.sh/v1/sandboxes/$SANDBOX_ID/disks \
  -H "X-Api-Key: $CREATEOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"disk_id": "eu-data", "mount_path": "/mnt/data"}'

The in-VM agent mounts it within ~1 second. Files written under /mnt/data land in your bucket. Use sub_path to mount only a prefix (e.g. "sub_path": "team-a/").

3. Detach when done

curl -X DELETE \
  "https://api.sb.createos.sh/v1/sandboxes/$SANDBOX_ID/disks/$DISK_ID?mount_path=/mnt/data" \
  -H "X-Api-Key: $CREATEOS_API_KEY"

Only the mount is dropped; the bucket and its contents remain.

Full reference

See the Disks API for every endpoint, field, and error, and Disks, networks & templates for the SDK equivalents.