RSchneider157099 (Community Member) asked a question.
When you reach the 25 Sanbox limit, will it auto delete previous sandboxes, or will it no longer create sandboxes and fail your pipeline builds?
I'm setting up a pipeline to create a new sandbox each time a new PR happens, multiple devs could have PR's opened at the same time (which would cause multiple scans). Solution is to create a new sandbox with its own unique name for each PR, since each Pipeline run will have no idea what premade sandboxes are in use. Once you hit the 25 limit of Sandboxes, does it auto delete previous sandboxes or do you need to manually go in and delete them out?
.png){kind=logo}
Hi Scheider,
Thank you for the question that you brought up.
The limited to 25 by default to prevent unlimited use of the number of sandboxes. What is documented is that 15 sandbox scans are kept and a new scan overwrites the oldest scan in that sandbox. It is up to the customer organization to manage their own sandboxes however. Here is the related Veracode Documentation on Development sandboxes, https://docs.veracode.com/r/c_about_sandbox and https://docs.veracode.com/r/About_Sandbox_Data_Retention
docs.veracode.com
Using the Development Sandbox | Veracode Docs
Development sandboxes allow individual contributors and teams to scan applications and measure the results against the policy rules. These scans do not affect the policy compliance of the entire application.
docs.veracode.com
About Sandbox Data Retention | Veracode Docs
Veracode retires data in sandboxes based on the data retention setting that you apply at the account level.
If the organization has their sandboxes configured in "Time-to-Live Mode" then expiration of sandboxes does apply however. You asked about the 25 sandbox limit though and this infers that the organization like most and the default is for, "Rolling-Histories Mode", https://docs.veracode.com/r/About_Sandbox_Data_Retention
Please feel free to reach out for further questions.
Regards,
Pranita
Veracode Inc.