Sandbox container does not sleep with SANDBOX_SLEEP_AFTER=10m due to recurring Sandbox DO alarms

[Shefcoding]

Summary

My moltworker container doesnt sleep after long idle periods even
with SANDBOX_SLEEP_AFTER=10m.
No persistent UI/WebSocket clients are intentionally open, and cron has been
reduced to every 6 hours.

Environment

• Project: cloudflare/moltworker (official codebase)
• Worker name: moltbot-sandbox
• Date observed: 2026-02-12
• SANDBOX_SLEEP_AFTER secret set to: 10m
• Cron trigger set to: 0 */6 * * *

Expected behavior

After ~10 minutes with no user traffic, container should sleep.
Next request should trigger a cold start.

Actual behavior

Container appears to stay warm; no cold start observed after idle periods.
wrangler tail shows recurring Alarm events from Sandbox Durable Object
roughly every ~3 minutes.

Evidence (tail excerpts)

• Alarm @ 12-2-2026, 11:16:44 - Ok
• Alarm @ 12-2-2026, 11:19:44 - Ok
• Alarm @ 12-2-2026, 11:22:44 - Ok
• Alarm @ 12-2-2026, 11:25:44 - Ok

Related logs around same window:

• Sandbox.listProcesses - Canceled @ 12-2-2026, 11:16:46
• Sandbox.startProcess - Canceled @ 12-2-2026, 11:16:46
• details":"mount | grep \"s3fs on /data/moltbot\" ...
• Sandbox.containerFetch - Canceled @ 12-2-2026, 11:16:49

Notes

• External request example appears later:
  • GET https://xxx.workers.dev/ - Ok @ 12-2-2026, 11:26:34
• The recurring alarms occur even when traffic is expected to be idle.
• This suggests internal Sandbox DO alarms may be preventing inactivity-based
  sleep.

Request

Please confirm:

1. Whether recurring Sandbox DO alarms reset/extend inactivity timers for
   sleepAfter.
2. Whether this is expected behavior or a bug.
3. Recommended mitigation to allow reliable sleeping with
   SANDBOX_SLEEP_AFTER.

[andreasjansson]

The root cause was the rclone background sync loop, which ran inside the container and triggered recurring Sandbox DO alarms via listProcesses()/startProcess()/containerFetch() calls every ~30 seconds, preventing the container from going idle.

PR #329 (merged Mar 25) removed rclone entirely and replaced it with Sandbox SDK snapshots taken from the Worker side. PR #337 (merged Mar 28) additionally moved restoreIfNeeded out of global middleware so it only runs when the gateway needs to start, not on every request. There should be no more recurring internal activity keeping the container awake.