> ## Documentation Index
> Fetch the complete documentation index at: https://rapidreview.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure sandbox providers

> Give a self-hosted brain the credentials to provision sandboxes, choose one provider or a fleet, and verify readiness.

Provider credentials live in a **separate env file outside the checkout**, so Compose can't erase them with empty defaults. Compose defaults leave every provider empty; provisioning is unavailable until you configure one.

<Steps>
  <Step title="Write the provider env file">
    Restricted to the deployment account, e.g. `/run/secrets/merv-provider.env`:

    ```bash theme={"theme":{"light":"github-light","dark":"dark-plus"}}
    MERV_EXECUTION_BACKEND=lambda_labs             # or MERV_EXECUTION_BACKENDS=lambda_labs,aws,modal
    MERV_LAMBDA_API_KEY=…
    HF_TOKEN=…                                     # pushed to sandboxes post-boot over management SSH
    ```

    Variables per provider: [Sandbox providers](/docs/merv/reference/sandbox-providers). Don't also declare these names with empty values under the control service's `environment:` map — Compose gives that map precedence over `env_file`.
  </Step>

  <Step title="Start with the file">
    ```bash theme={"theme":{"light":"github-light","dark":"dark-plus"}}
    MERV_PROVIDER_ENV_FILE=/run/secrets/merv-provider.env \
      docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.postgres.yml up --build -d
    ```

    Add `MERV_REQUIRE_SANDBOX_BACKEND=1` to refuse startup if the selected provider is unhealthy.
  </Step>

  <Step title="Verify">
    ```bash theme={"theme":{"light":"github-light","dark":"dark-plus"}}
    RP_DOCTOR_BEARER_TOKEN=mk_… python3 deploy/doctor.py --control-url http://127.0.0.1:8787
    ```

    Creates or reuses a smoke project, checks the provider, and exercises heavy object storage (`--skip-storage` to skip). With local MinIO from the host: `RP_DOCTOR_URL_REWRITE=http://minio:9000=http://127.0.0.1:9000`.
  </Step>
</Steps>

## Fleet notes

* A fleet (`MERV_EXECUTION_BACKENDS`) puts every named provider behind one multiplexer; agents choose per request with `sandbox.request(provider=…)`, and ids are stored as `<provider>:<native_id>`.
* Terminate a provider's sandboxes before removing it from the list — its ids become unroutable on purpose.
* Provider credentials and the management key stay in the brain's secret store; they are never sent to agent clients. Heavy-storage presigned URLs are used by agent clients (and the doctor), so storage must be reachable from those machines.
* Per-project provider settings (enable, daily USD limit, verify) are still managed in the UI under **Settings → Compute**.