# NEGATIVE demo: this claim carries spec.env, which the template's
# envVarsInjectionPolicy: Disallowed rejects. The claim never binds a
# sandbox — inspect it to see the rejection (step 6 of the README).
#
# Why a platform wants rejection over acceptance: env injection forces a
# cold start that bypasses the warm pool, silently turning a ~2s signup into
# a cold provision. Disallowed turns that mistake into a loud error.
apiVersion: extensions.agents.x-k8s.io/v1beta1
kind: SandboxClaim
metadata:
  name: dsh-mallory
  namespace: dsh-demo
spec:
  warmPoolRef:
    name: dsh-pool
  env:
    - name: SNEAKY_OVERRIDE
      value: "should-not-work"