Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Third-party applications in Sandbox container using Sandbox Manager

Updated: June 12, 2026

Want to summarize with AI?

Explains how Sandbox Manager enables hosting, configuration, deployment, and management of third-party client applications in a CentOS 8-based sandbox container on Cisco IOS XR.

A third-party application in a sandbox container is a client application that

is hosted and managed in a CentOS 8-based container environment on Cisco IOS XR
can be configured, deployed, and controlled using Sandbox Manager and respective third-party servers over a network, and
applications placed in the sandbox container during router bootup using Zero Touch Provisioning (ZTP) are activated automatically when Sandbox Manager is enabled, and
automatically restarts and activates after router reloads or RP switchovers when Sandbox Manager is enabled.

Sandbox Manager activates the sandbox container using the APPMGR client library APIs. The Sandbox container operates on CentOS 8, which enables you to control the applications inside the container using standard Docker commands.

Feature history

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
Hosting Third Party Applications in Sandbox Container Using Sandbox Manager	7.5.3	This release introduces Sandbox Manager for hosting and functioning third-party client application in the CentOS 8 based Sandbox Container. The Sandbox container supports configuration, deployment, and management of third-party client applications from the third-party server. The Sandbox Manager uses IOS XR commands for managing the Sandbox container.

Supported commands on Sandbox Manager

This section describes the operations and the IOS XR commands that are supported on Sandbox Manager.

Enable and disable Sandbox Manager: Use this command to enable or disable Sandbox Manager.

Enable Sandbox Manager:

RP/0/RP0/CPU0:ios#conf
RP/0/RP0/CPU0:ios(config)#sandbox enable
RP/0/RP0/CPU0:ios(config)#commit

Disable Sandbox Manager:

RP/0/RP0/CPU0:ios#conf
RP/0/RP0/CPU0:ios(config)# no sandbox enable
RP/0/RP0/CPU0:ios(config)#commit

TPA traffic flow prioritization: Use these commands to configure traffic priority for third-party applications within a sandbox container.
- High priority traffic: The following command configures TPA traffic in port 2018 to high Local Packet Transport Services (LPTS) flow priority:
```
Router(config)# sandbox flow TPA-APPMGR-HIGH ports 2018
```
- Medium priority traffic: The following command configures TPA traffic in port 6666 to medium LPTS flow priority:
```
Router(config)# sandbox flow TPA-APPMGR-MEDIUM ports 6666
```
- Low priority traffic: The following command configures TPA traffic in port 60100 to low LPTS flow priority:
```
Router(config)# sandbox flow TPA-APPMGR-LOW ports 60100
```

Show commands:

Info: The following command shows Sandbox Manager and application info:

RP/0/RP0/CPU0:ios#show sandbox info
Thu Jun 30 06:56:45.593 UTC

Sandbox Config State: Enabled

APP INFO:
  Image: /pkg/opt/cisco/XR/appmgr/images/sandbox-centos.tar.gz
  Config state: Activated
  Container state: Running

Detail: The following command shows Sandbox Manager and application details:

RP/0/RP0/CPU0:ios#show sandbox detail
Thu Jun 30 06:57:46.724 UTC

Sandbox Config State: Enabled

APP INFO:
  Image: /pkg/opt/cisco/XR/appmgr/images/sandbox-centos.tar.gz
  Run Options:
    --restart always
    --cap-add SYS_ADMIN --cap-add NET_ADMIN
    --log-opt max-size=10m --log-opt max-file=3
    --net host
    --mount type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly
    --mount type=bind,source=/var/run/netns,target=/netns,bind-propagation=shared
    --mount type=bind,source=/opt/sandbox,target=/opt/sandbox,bind-propagation=shared
    --mount type=bind,source=/misc/disk1/sandbox,target=/host,bind-propagation=shared
  Config state: Activated
  Container state: Running

STATS INFO:
  Cpu Percentage: 0.01%
  Memory Usage: 13.57MiB / 19.42GiB
  Net IO: 0B / 0B
  Block IO: 0B / 1.2MB
  Memory Percentage: 0.07%
  pids: 2

Services: The following command shows Sandbox Manager and application services:

RP/0/RP0/CPU0:ios#show sandbox services
Wed Jul  6 05:59:16.446 UTC
UNIT                        LOAD   ACTIVE SUB       DESCRIPTION
-.mount                     loaded active mounted   /
dev-mqueue.mount            loaded active mounted   POSIX Message Queue File Sys
etc-hostname.mount          loaded active mounted   /etc/hostname
etc-hosts.mount             loaded active mounted   /etc/hosts
etc-resolv.conf.mount       loaded active mounted   /etc/resolv.conf
host.mount                  loaded active mounted   /host
netns-default.mount         loaded active mounted   /netns/default
netns-global\x2dvrf.mount   loaded active mounted   /netns/global-vrf
netns-vrf\x2dblue.mount     loaded active mounted   /netns/vrf-blue
netns-vrf\x2ddefault.mount  loaded active mounted   /netns/vrf-default
netns-vrf\x2dmanagement.mount loaded active mounted   /netns/vrf-management
netns-vrf\x2dred.mount      loaded active mounted   /netns/vrf-red
netns-xrnns.mount           loaded active mounted   /netns/xrnns
netns.mount                 loaded active mounted   /netns
systemd-journald.service    loaded active running   Journal Service
systemd-tmpfiles-setup.service loaded active exited    Create Volatile Files and Directories
-.slice                     loaded active active    Root Slice
system.slice                loaded active active    System Slice
dbus.socket                 loaded active listening D-Bus System Message Bus Socket
systemd-journald.socket     loaded active running   Journal Socket
basic.target                loaded active active    Basic System
local-fs.target             loaded active active    Local File Systems
multi-user.target           loaded active active    Multi-User System

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.

43 loaded units listed. Pass --all to see loaded but inactive units.
To show all installed unit files use 'systemctl list-unit-files'.

Access sandbox: The following command is used to access the sandbox container:
```
RP/0/RP0/CPU0:ios#bash sandbox
root@ios:/data# exit
exit
RP/0/RP0/CPU0:ios#
```
Linux commands: The following command is used to run Linux commands inside the sandbox container:
```
RP/0/RP0/CPU0:ios#bash sandbox -c linux-command
RP/0/RP0/CPU0:ios#
```

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.