Turbo Sandbox Manager

The Turbo Sandbox Manager is a core component of the Turbo Client that runs as a background service, managing various aspects of the virtualization environment.

Overview

The Sandbox Manager provides several critical functions:

• Automatic subscription management
• Client auto-updates (for non-all-users installations)
• Secure sandbox management
• TDrive mount management
• Background garbage collection

Installation Modes

The Sandbox Manager operates in two modes:

Single User Mode

• Installed in user's profile directory
• Manages auto-updates for the client
• Handles desktop integration and shortcuts
• Manages workspace subscriptions
• Runs with user privileges
• Does not include the Sandbox Service, so secure sandboxes are unavailable

All Users Mode

• Installed in Program Files directory
• Requires administrative privileges for installation/uninstallation
• No auto-update functionality
• Manages system-wide settings
• Runs with system privileges
• Hosts the Sandbox Service, which provides secure sandboxes

Key Features

Subscription Management

The Sandbox Manager automatically manages workspace subscriptions:

• Periodically checks for updates (configurable interval)
• Downloads new versions of subscribed applications
• Updates desktop integration and shortcuts
• Performs garbage collection of old versions
• Handles offline mode and retry logic

Configuration options:

# Enable/disable subscription management
turbo config --enable=Subscriptions

# Set update interval (in minutes)
turbo config --subscription-interval=60

Policy Sync

On managed Windows clients the Sandbox Manager keeps the machine-wide Launcher policy up to date. It downloads the policy from the server on a timer, so an administrator who publishes a policy change does not need to touch the endpoint.

• Runs only when the Launcher feature is enabled and only in all-users mode.
• Fetches /api/policy using the all-users credential store, sending the previously stored ETag. An unchanged policy returns 304 Not Modified and the file on disk is left untouched.
• Validates the document before it is applied, and writes it atomically to %PROGRAMDATA%\Turbo\Launcher\policy.json. A rejected document leaves the previous policy in place.
• The first check runs immediately when the service starts, then repeats on the interval.

Enable it with:

turbo config --enable=Launcher

The interval is carried by the policy document itself, in configuration.policyUpdateIntervalMinutes, rather than by a setting on the endpoint. Clients accept 1 to 60 minutes and use 5 minutes when the field is absent. See the policy schema reference.

There is no command to force a fetch. To apply a policy immediately, restart the Sandbox Manager service, or deploy the file directly with SCCM, Group Policy, or Intune as described in policy deployment. The Launcher watches the policy directory and picks up a file that lands there within seconds.

Auto-Registration

When enabled, automatically registers applications from subscriptions:

# Enable auto-registration (single user mode only)
turbo config --enable=AutoRegister

Features:

• Creates desktop shortcuts
• Updates file associations
• Manages Start Menu entries
• Cleans up old shortcuts

Secure Sandboxes

Secure sandboxes are provided by the Sandbox Service — the privileged component that owns secure sandbox storage and performs sandbox launches. It is distinct from the Sandbox Manager itself: the Sandbox Manager is the housekeeping agent (subscriptions, updates, shortcuts, garbage collection), while the Sandbox Service is the security authority. On Windows the Sandbox Service runs with system privileges, hosted by the Sandbox Manager in all-users mode; a single-user Sandbox Manager runs with user privileges only and does not include it, which is why secure sandboxes require the all-users installation. The name is the same on every platform: on macOS the Sandbox Service runs as the sandboxmanager daemon (see the xvm documentation).

Sessions started with turbo run --remote-sandbox (see Remote Sandboxes) are owned by the Sandbox Service, not by the user:

• Sandbox contents are stored under the configured remote sandbox path, secured so that ordinary user processes cannot read or tamper with them; all access goes through the Sandbox Service.
• The application runs in Sandboxed isolation rather than the default Virtualized isolation: the Sandbox Service launches it inside a Windows AppContainer with a kill-on-close job, so the isolation boundary is enforced by the operating system kernel rather than by code running inside the sandboxed process, and no process in the session can outlive it. This requires a client and VM build that implement the hardened launch; on earlier builds a secure sandbox provides the service-owned protected storage without the operating-system boundary.
• Application content is copied into service-owned storage, sealed read-only, and verified before launch, so the code that runs is exactly the code that was approved.
• The Sandbox Service accepts requests only from regular interactive users — connections from elevated processes and from inside containers are refused — and the service, never the caller, chooses every path, identity, and handle involved in a launch.

Configuration:

# Enable remote sandbox feature
turbo config --enable=RemoteSandbox

# Set sandbox storage location (must be a dedicated, initially empty directory)
turbo config --remote-sandbox-path=C:\ProgramData\Turbo\RemoteSandbox

TDrive Management

Manages the Turbo Drive (T: drive) functionality:

• Mounts virtual drives
• Handles file system isolation
• Manages access permissions
• Provides consistent access to virtualized files

Best Practices

1. Installation Mode Selection:

   • Use all-users mode for enterprise deployments
   • Use single-user mode for individual workstations

2. Subscription Management:

   • Enable auto-registration for seamless updates
   • Configure appropriate update intervals
   • Consider offline mode requirements

3. Security:

   • Configure secure sandbox locations
   • Use appropriate isolation settings
   • Follow principle of least privilege

4. Maintenance:

   • Monitor log files for issues
   • Regularly clean up unused resources
   • Keep client updated

Note

The Sandbox Manager automatically handles many maintenance tasks, but administrators should monitor its operation and adjust settings as needed for their environment.

Related Topics

• Security Settings
• Configuration Options
• Workspace Management