Azure Blob

Mount an Azure Blob Storage container, or a prefix within one, into a sandbox with the azure backend, so files persist beyond the sandbox's lifetime. Configure it as an entry in SandboxConfig.fs; access under the mount is governed by ACLs.

Mount a container

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("azure", {
  fs: [{
    backend: "azure",
    mount: "/storage",
    azure_account: "mystorageaccount",
    azure_container: "my-container",
    azure_prefix: "workspace/session-1", // optional prefix within the container
    azure_account_key: process.env.AZURE_STORAGE_KEY!,
    acls: [{ path: "/storage/**", access: "rw" }],
  }],
});

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("azure", {
  fs: [{
    backend: "azure",
    mount: "/storage",
    azure_account: "mystorageaccount",
    azure_container: "my-container",
    azure_prefix: "workspace/session-1", // optional prefix within the container
    azure_account_key: process.env.AZURE_STORAGE_KEY!,
    acls: [{ path: "/storage/**", access: "rw" }],
  }],
});

Fields

Field	Description
`azure_container`	Blob container name (the Azure equivalent of a bucket). Required.
`azure_account`	Storage account name. Required unless `azure_connection_string` or `azure_endpoint` is set.
`azure_prefix`	Optional key prefix. Only blobs under it are visible, mapped to paths under `mount`.
`azure_account_key`	Storage account access key (shared-key auth).
`azure_connection_string`	Full connection string (account, key, endpoint). Takes precedence over the other credential fields.
`azure_sas_token`	Shared access signature token authorizing the container. A leading `?` is optional.
`azure_endpoint`	Optional custom blob service endpoint (e.g. the Azurite emulator). Defaults to `https://{azure_account}.blob.core.windows.net`.

Provide exactly one credential: azure_connection_string, azure_sas_token, or azure_account_key (with azure_account).

How keys map to paths

Blob names under the prefix appear as files under mount. With azure_prefix: "workspace/session-1", the blob workspace/session-1/notes.txt shows up as /storage/notes.txt inside the sandbox. Writes go back to the container under the same mapping.

Connection string or SAS token

A connection string is self-contained — it carries the account, key, and endpoint — so azure_account is not needed:

index.ts

fs: [{
  backend: "azure",
  mount: "/storage",
  azure_container: "my-container",
  azure_connection_string: process.env.AZURE_STORAGE_CONNECTION_STRING!,
  acls: [{ path: "/storage/**", access: "rw" }],
}]

fs: [{
  backend: "azure",
  mount: "/storage",
  azure_container: "my-container",
  azure_connection_string: process.env.AZURE_STORAGE_CONNECTION_STRING!,
  acls: [{ path: "/storage/**", access: "rw" }],
}]

A SAS token authorizes the container URL directly — use it to grant scoped, time-limited access without sharing the account key.

Read-only datasets

Mount a shared dataset read-only by scoping its ACL to ro, and combine it with a writable scratch mount:

index.ts

fs: [
  { backend: "local", mount: "/workspace", acls: [{ path: "/workspace/**", access: "rw" }] },
  {
    backend: "azure",
    mount: "/data",
    azure_account: "mystorageaccount",
    azure_container: "my-data",
    azure_account_key: process.env.AZURE_STORAGE_KEY!,
    acls: [{ path: "/data/**", access: "ro" }], // read-only dataset
  },
]

fs: [
  { backend: "local", mount: "/workspace", acls: [{ path: "/workspace/**", access: "rw" }] },
  {
    backend: "azure",
    mount: "/data",
    azure_account: "mystorageaccount",
    azure_container: "my-data",
    azure_account_key: process.env.AZURE_STORAGE_KEY!,
    acls: [{ path: "/data/**", access: "ro" }], // read-only dataset
  },
]

Mount paths must be unique and non-overlapping. See Local Files, GCS, S3, and Google Drive for the other backends.

Next: Google Drive