How to create a safe Odoo sandbox

A safe Odoo sandbox can be used to test:

1. Backup restore
2. Odoo upgrades
3. Custom modules
4. Automation changes
5. API integrations
6. Migration scripts
7. AI/database tools
8. User training
9. Risky configuration changes

The sandbox should be separate from production.

Choose one sandbox option:

Option A — Separate VPS
- safest isolation
- recommended for production clients
- easier to destroy/rebuild without touching production

Option B — Same VPS, separate Docker Compose project
- practical for demos and light testing
- cheaper and faster
- must use separate ports, database volume, filestore volume, and project folder

Option C — Local developer machine
- useful for technical testing
- not ideal for business users unless they can access it

echo "=== Production project folder ==="
cd /opt/odoo-secure
pwd

echo
echo "=== Production containers ==="
sudo docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Ports}}"

echo
echo "=== Production database list ==="
sudo docker exec odoo-secure-db psql -U odoo -d postgres -c "
SELECT datname AS database_name
FROM pg_database
WHERE datistemplate = false
ORDER BY datname;
"

echo
echo "=== Latest backup folder ==="
sudo find /opt/odoo-backups -mindepth 1 -maxdepth 1 -type d -printf "%T@ %p\n" 2>/dev/null | sort -nr | head -5

sudo mkdir -p /opt/odoo-sandbox
sudo chown "$USER:$USER" /opt/odoo-sandbox
chmod 750 /opt/odoo-sandbox

echo "=== Sandbox folder ==="
ls -ld /opt/odoo-sandbox

# Run on: sandbox host.
# Same VPS example:
# Run this on the server where both production and sandbox folders exist.

cd /opt/odoo-sandbox

echo "=== Copy deployment structure from production ==="
cp -a /opt/odoo-secure/docker-compose.yml .
cp -a /opt/odoo-secure/config .
cp -a /opt/odoo-secure/addons .

# Copy .env only if you need it, then rotate/remove sensitive values.
cp -a /opt/odoo-secure/.env .env

echo
echo "=== Sandbox project files ==="
ls -la

echo
echo "=== Sandbox config files ==="
ls -la config

echo
echo "=== REQUIRED before starting the sandbox ==="
echo "1. Change ODOO_DB_PASSWORD in .env to a NEW sandbox-only value if possible."
echo "2. Change admin_passwd in config/odoo.conf to a NEW sandbox-only value."
echo "3. Remove or rotate any production API keys, SMTP credentials, webhook tokens, or external integration secrets in .env."
echo "4. Do not reuse production secrets in a sandbox that may be exposed later."

echo
echo "=== Edit .env and odoo.conf before starting sandbox ==="
echo "Open and review these files manually:"
echo "- /opt/odoo-sandbox/.env"
echo "- /opt/odoo-sandbox/config/odoo.conf"

cd /opt/odoo-sandbox

echo "=== Back up copied docker-compose.yml before editing ==="
cp -a docker-compose.yml docker-compose.yml.before-sandbox-edit

echo
echo "=== Replace docker-compose.yml with isolated sandbox config ==="
cat > docker-compose.yml <<'YAML'
services:
  odoo-sandbox-db:
    image: ${POSTGRES_IMAGE}
    container_name: odoo-sandbox-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: ${ODOO_DB_USER}
      POSTGRES_PASSWORD: ${ODOO_DB_PASSWORD}
    volumes:
      - odoo-sandbox-db-data:/var/lib/postgresql/data
    networks:
      - odoo-sandbox-internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${ODOO_DB_USER} -d postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  odoo-sandbox:
    image: ${ODOO_IMAGE}
    container_name: odoo-sandbox-app
    restart: unless-stopped
    depends_on:
      odoo-sandbox-db:
        condition: service_healthy
    environment:
      HOST: odoo-sandbox-db
      USER: ${ODOO_DB_USER}
      PASSWORD: ${ODOO_DB_PASSWORD}
    ports:
      - "127.0.0.1:18069:8069"
      - "127.0.0.1:18072:8072"
    volumes:
      - odoo-sandbox-web-data:/var/lib/odoo
      - ./config:/etc/odoo
      - ./addons:/mnt/extra-addons
    networks:
      - odoo-sandbox-internal

networks:
  odoo-sandbox-internal:
    driver: bridge

volumes:
  odoo-sandbox-db-data:
  odoo-sandbox-web-data:
YAML

echo
echo "=== Verify sandbox docker-compose.yml ==="
cat docker-compose.yml

cd /opt/odoo-sandbox

echo "=== Back up copied odoo.conf before sandbox edit ==="
cp -a config/odoo.conf config/odoo.conf.before-sandbox-edit

echo
echo "=== Apply sandbox-safe config changes ==="
sed -i 's/^db_host = .*/db_host = odoo-sandbox-db/' config/odoo.conf
sed -i 's/^dbfilter = .*/dbfilter = ^odoo_sandbox$/' config/odoo.conf
sed -i 's/^list_db = .*/list_db = False/' config/odoo.conf
sed -i 's/^proxy_mode = .*/proxy_mode = True/' config/odoo.conf

echo
echo "=== Review sandbox config without secrets ==="
grep -E "^(admin_passwd|db_host|db_port|db_user|db_password|proxy_mode|list_db|dbfilter|addons_path|data_dir|without_demo)" config/odoo.conf \
  | sed -E 's/(admin_passwd|db_password) = .+/\1 = ***hidden***/'

# Run this on the sandbox server or sandbox VPS.
# This example assumes the sandbox is managed with Docker Compose.

cd /opt/odoo-sandbox

echo "=== Start sandbox containers ==="
sudo docker compose up -d

echo
echo "=== Running Docker containers ==="
sudo docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Ports}}"

echo
echo "=== Sandbox compose status ==="
sudo docker compose ps

echo
echo "=== Wait for sandbox PostgreSQL to be healthy ==="
for i in {1..30}; do
  DB_STATUS="$(sudo docker inspect -f '{{.State.Health.Status}}' odoo-sandbox-db 2>/dev/null || echo unknown)"

  if [ "$DB_STATUS" = "healthy" ]; then
    echo "Sandbox PostgreSQL is healthy"
    break
  fi

  echo "Waiting for sandbox PostgreSQL... status=$DB_STATUS"
  sleep 2
done

echo
echo "=== Stop sandbox Odoo before restoring production data ==="
sudo docker compose stop odoo-sandbox

echo
echo "=== Final sandbox status before restore ==="
sudo docker compose ps

# Run on: sandbox host.
# These commands assume the PostgreSQL role is odoo.
# If your ODOO_DB_USER is different, replace DB_USER accordingly.

BACKUP_DIR="/opt/odoo-backups/YYYYMMDD-HHMMSS"
SANDBOX_DB="odoo_sandbox"
DB_USER="odoo"

cd /opt/odoo-sandbox

echo "=== Confirm sandbox database container ==="
sudo docker compose ps odoo-sandbox-db

echo
echo "=== Confirm current databases in sandbox PostgreSQL ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d postgres -c "
SELECT datname AS database_name
FROM pg_database
WHERE datistemplate = false
ORDER BY datname;
"

echo
echo "=== Drop sandbox database if it already exists ==="
sudo docker compose exec -T odoo-sandbox-db dropdb -U "$DB_USER" --if-exists "$SANDBOX_DB"

echo
echo "=== Create sandbox database ==="
sudo docker compose exec -T odoo-sandbox-db createdb -U "$DB_USER" "$SANDBOX_DB"

echo
echo "=== Restore database dump into sandbox database ==="
set -o pipefail
sudo cat "$BACKUP_DIR/database.dump" \
  | sudo docker compose exec -T odoo-sandbox-db pg_restore -U "$DB_USER" -d "$SANDBOX_DB" --no-owner --no-privileges --exit-on-error

RESTORE_EXIT_CODE=${PIPESTATUS[1]}
echo "pg_restore exit code: $RESTORE_EXIT_CODE"

if [ "$RESTORE_EXIT_CODE" -ne 0 ]; then
  echo "pg_restore failed. Stop here and review the error above."
  exit "$RESTORE_EXIT_CODE"
fi

echo
echo "=== Confirm core Odoo tables exist ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
SELECT table_name
FROM information_schema.tables
WHERE table_schema = 'public'
  AND table_name IN ('res_users', 'res_partner', 'ir_attachment', 'ir_module_module')
ORDER BY table_name;
"

echo
echo "=== Confirm sandbox database exists ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d postgres -c "
SELECT datname AS database_name
FROM pg_database
WHERE datistemplate = false
ORDER BY datname;
"

# Run on: sandbox host.
# These commands assume the Odoo service is odoo-sandbox.

BACKUP_DIR="/opt/odoo-backups/YYYYMMDD-HHMMSS"
SANDBOX_DB="odoo_sandbox"

cd /opt/odoo-sandbox

echo "=== Confirm sandbox Odoo container ==="
sudo docker compose ps odoo-sandbox

echo
echo "=== Prepare filestore parent folder inside sandbox container ==="
sudo docker compose exec -T odoo-sandbox sh -c "mkdir -p /var/lib/odoo/filestore"

echo
echo "=== Find sandbox Docker volumes ==="
sudo docker volume ls | grep -Ei "sandbox.*web|odoo-sandbox"

echo
echo "=== Restore filestore archive into temporary folder ==="
TMP_RESTORE="/tmp/odoo-filestore-restore-$SANDBOX_DB"
sudo rm -rf "$TMP_RESTORE"
mkdir -p "$TMP_RESTORE"

sudo tar -xzf "$BACKUP_DIR/filestore.tar.gz" -C "$TMP_RESTORE"

echo
echo "=== Show extracted filestore folder ==="
sudo find "$TMP_RESTORE" -mindepth 1 -maxdepth 1 -type d -print

echo
echo "=== Rename production filestore folder to sandbox database name if needed ==="
if [ -d "$TMP_RESTORE/odoo_prod" ] && [ "odoo_prod" != "$SANDBOX_DB" ]; then
  sudo mv "$TMP_RESTORE/odoo_prod" "$TMP_RESTORE/$SANDBOX_DB"
fi

echo
echo "=== Copy filestore into sandbox Odoo container ==="
sudo docker compose cp "$TMP_RESTORE/$SANDBOX_DB" "odoo-sandbox:/var/lib/odoo/filestore/$SANDBOX_DB"

echo
echo "=== Fix ownership inside sandbox container if needed ==="
sudo docker compose exec -T odoo-sandbox sh -c "chown -R $(id -u):$(id -g) /var/lib/odoo/filestore/$SANDBOX_DB || true"

echo
echo "=== Verify filestore inside sandbox container ==="
sudo docker compose exec -T odoo-sandbox sh -c "ls -la /var/lib/odoo/filestore/$SANDBOX_DB | head"

echo
echo "=== Check for accidental nested filestore folder ==="
sudo docker compose exec -T odoo-sandbox sh -c "test ! -d /var/lib/odoo/filestore/$SANDBOX_DB/$SANDBOX_DB && echo 'OK: no nested filestore folder' || echo 'WARNING: nested filestore folder detected'"

echo
echo "=== Clean temporary restore folder ==="
sudo rm -rf "$TMP_RESTORE"

# Run on: sandbox host.
# Keep sandbox PostgreSQL running, but keep sandbox Odoo stopped while changing restored data.

SANDBOX_DB="odoo_sandbox"
DB_USER="odoo"

cd /opt/odoo-sandbox

echo "=== Stop sandbox Odoo before disabling side effects ==="
sudo docker compose stop odoo-sandbox

echo
echo "=== Neutralize sandbox base URL before any public access option ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
UPDATE ir_config_parameter
SET value = 'http://localhost:18069'
WHERE key = 'web.base.url';

INSERT INTO ir_config_parameter (key, value, create_uid, create_date, write_uid, write_date)
SELECT 'web.base.url', 'http://localhost:18069', 1, NOW(), 1, NOW()
WHERE NOT EXISTS (
  SELECT 1 FROM ir_config_parameter WHERE key = 'web.base.url'
);

SELECT key, value
FROM ir_config_parameter
WHERE key = 'web.base.url';
"

echo
echo "=== Disable outgoing mail servers in sandbox ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
UPDATE ir_mail_server SET active = false;
SELECT
  COUNT(*) AS outgoing_mail_servers_total,
  COUNT(*) FILTER (WHERE active = true) AS outgoing_mail_servers_still_active
FROM ir_mail_server;
"

echo
echo "=== Disable incoming mail servers if table exists ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
DO \$\$
BEGIN
  IF to_regclass('public.fetchmail_server') IS NOT NULL THEN
    UPDATE fetchmail_server SET active = false;
  END IF;
END
\$\$;

SELECT
  CASE
    WHEN to_regclass('public.fetchmail_server') IS NULL THEN 'fetchmail_server table not installed'
    ELSE 'fetchmail_server table checked'
  END AS incoming_mail_check;
"

echo
echo "=== Verify incoming mail servers if table exists ==="
if sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -tAc "SELECT to_regclass('public.fetchmail_server') IS NOT NULL;" | grep -q t; then
  sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
  SELECT
    COUNT(*) AS incoming_mail_servers_total,
    COUNT(*) FILTER (WHERE active = true) AS incoming_mail_servers_still_active
  FROM fetchmail_server;
  "
else
  echo "No incoming mail server table found. This is okay."
fi

echo
echo "=== Disable scheduled actions in sandbox ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
UPDATE ir_cron SET active = false;
SELECT
  COUNT(*) AS scheduled_actions_total,
  COUNT(*) FILTER (WHERE active = true) AS scheduled_actions_still_active,
  COUNT(*) FILTER (WHERE active = false) AS scheduled_actions_disabled
FROM ir_cron;
"

echo
echo "=== Final sandbox side-effect safety summary ==="
sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
SELECT 'Outgoing mail servers still active' AS check_name, COUNT(*)::text AS result
FROM ir_mail_server
WHERE active = true

UNION ALL

SELECT 'Scheduled actions still active' AS check_name, COUNT(*)::text AS result
FROM ir_cron
WHERE active = true

UNION ALL

SELECT 'Sandbox base URL' AS check_name, value AS result
FROM ir_config_parameter
WHERE key = 'web.base.url';
"

cd /opt/odoo-sandbox

echo "=== Restart sandbox Odoo ==="
sudo docker compose restart odoo-sandbox

echo
echo "=== Check sandbox Odoo logs ==="
sudo docker compose logs --tail=100 odoo-sandbox

echo
echo "=== Test local sandbox Odoo ==="
curl -I --connect-timeout 10 http://127.0.0.1:18069/ || echo "Sandbox Odoo did not respond yet. Check logs above."

Choose one access option.

Option A — Keep sandbox local-only with SSH tunnel
Best for technical restore validation and private testing.

# Run this from your local computer, not from the server:
ssh -L 18069:127.0.0.1:18069 your-user@your-server-ip

# Then open this on your local computer:
http://127.0.0.1:18069/

# Verify on the server that sandbox ports are local-only:
sudo ss -tulpn | grep -E ":18069|:18072"


Option B — Use a protected sandbox subdomain
Best for client delivery, user testing, training, or demos.

Example sandbox subdomain:
sandbox-odoo.example.com

The setup is similar to the Odoo HTTPS subdomain guide, but the sandbox Nginx site should proxy to:
- Odoo HTTP: 127.0.0.1:18069
- Odoo websocket/longpolling: 127.0.0.1:18072

Recommended protections:
- HTTPS certificate
- HTTP redirects to HTTPS
- database manager routes blocked
- strong Odoo admin password
- HTTP basic auth or IP allowlist if data is sensitive

Related guide:
Open the “How to host Odoo on a subdomain with HTTPS” guide from the Related guides section below, then adapt the upstream ports to the sandbox ports.


Step B1 — Create DNS record

In your DNS provider, create:

Type: A
Name: sandbox-odoo
Value: YOUR_SERVER_PUBLIC_IP
TTL: Auto or default

Then verify:

dig +short sandbox-odoo.example.com
dig @8.8.8.8 +short sandbox-odoo.example.com
dig @1.1.1.1 +short sandbox-odoo.example.com

If public DNS resolves but the server resolver does not, check authoritative DNS:

dig NS YOUR_DOMAIN.com +short

# Replace YOUR_DOMAIN.com with your real domain.
# Then query the authoritative nameservers directly:
for ns in $(dig NS YOUR_DOMAIN.com +short); do
  echo "--- $ns ---"
  dig @"$ns" +short sandbox-odoo.example.com
done


Step B2 — Create Basic Auth credentials

sudo apt update
sudo apt install -y apache2-utils

sudo htpasswd -c /etc/nginx/.htpasswd-odoo-sandbox sandbox


Step B3 — Create the initial HTTP Nginx site

sudo tee /etc/nginx/sites-available/sandbox-odoo.example.com >/dev/null <<'NGINX'
server {
    listen 80;
    listen [::]:80;

    server_name sandbox-odoo.example.com;

    client_max_body_size 100M;

    location ~* ^/web/database/(manager|selector|create|drop|backup|restore|duplicate) {
        return 403;
    }

    location / {
        proxy_pass http://127.0.0.1:18069;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 720s;
        proxy_connect_timeout 720s;
        proxy_send_timeout 720s;

        proxy_buffering off;
    }

    location /websocket {
        proxy_pass http://127.0.0.1:18072;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 720s;
        proxy_connect_timeout 720s;
        proxy_send_timeout 720s;
    }
}
NGINX

sudo ln -s /etc/nginx/sites-available/sandbox-odoo.example.com /etc/nginx/sites-enabled/sandbox-odoo.example.com 2>/dev/null || echo "Site may already be enabled"

sudo nginx -t
sudo systemctl reload nginx


Step B4 — Test HTTP before HTTPS

curl -I http://sandbox-odoo.example.com/
curl -I http://sandbox-odoo.example.com/web/database/manager

# If the server has a DNS cache issue but public DNS is correct, test with:
curl -I --resolve sandbox-odoo.example.com:80:YOUR_SERVER_PUBLIC_IP http://sandbox-odoo.example.com/
curl -I --resolve sandbox-odoo.example.com:80:YOUR_SERVER_PUBLIC_IP http://sandbox-odoo.example.com/web/database/manager


Step B5 — Issue HTTPS certificate

sudo certbot --nginx -d sandbox-odoo.example.com


Step B6 — Test HTTPS before Basic Auth

curl -I http://sandbox-odoo.example.com/
curl -I https://sandbox-odoo.example.com/
curl -I https://sandbox-odoo.example.com/web/database/manager

# If the server resolver still has DNS cache issues, test with:
curl -I --resolve sandbox-odoo.example.com:80:YOUR_SERVER_PUBLIC_IP http://sandbox-odoo.example.com/
curl -I --resolve sandbox-odoo.example.com:443:YOUR_SERVER_PUBLIC_IP https://sandbox-odoo.example.com/
curl -I --resolve sandbox-odoo.example.com:443:YOUR_SERVER_PUBLIC_IP https://sandbox-odoo.example.com/web/database/manager


Step B7 — Add Basic Auth after HTTPS works

sudo tee /etc/nginx/sites-available/sandbox-odoo.example.com >/dev/null <<'NGINX'
server {
    listen 80;
    listen [::]:80;

    server_name sandbox-odoo.example.com;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name sandbox-odoo.example.com;

    ssl_certificate /etc/letsencrypt/live/sandbox-odoo.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sandbox-odoo.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    client_max_body_size 100M;

    # Block database manager routes before they reach Odoo.
    # auth_basic off avoids showing a password prompt for a route that is always forbidden.
    location ~* ^/web/database/(manager|selector|create|drop|backup|restore|duplicate) {
        auth_basic off;
        return 403;
    }

    location / {
        auth_basic "Odoo Sandbox";
        auth_basic_user_file /etc/nginx/.htpasswd-odoo-sandbox;

        proxy_pass http://127.0.0.1:18069;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 720s;
        proxy_connect_timeout 720s;
        proxy_send_timeout 720s;

        proxy_buffering off;
    }

    location /websocket {
        auth_basic "Odoo Sandbox";
        auth_basic_user_file /etc/nginx/.htpasswd-odoo-sandbox;

        proxy_pass http://127.0.0.1:18072;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 720s;
        proxy_connect_timeout 720s;
        proxy_send_timeout 720s;
    }
}
NGINX

sudo nginx -t
sudo systemctl reload nginx


Step B8 — Final protected HTTPS test

curl -I https://sandbox-odoo.example.com/
curl -I https://sandbox-odoo.example.com/web/database/manager

# If DNS cache is still delayed on the server:
curl -I --resolve sandbox-odoo.example.com:443:YOUR_SERVER_PUBLIC_IP https://sandbox-odoo.example.com/
curl -I --resolve sandbox-odoo.example.com:443:YOUR_SERVER_PUBLIC_IP https://sandbox-odoo.example.com/web/database/manager


Step B9 — Update the sandbox Odoo base URL

After exposing the sandbox through a subdomain, update the restored sandbox database so Odoo generates URLs using the sandbox domain instead of the production domain.

SANDBOX_DB="odoo_sandbox"
DB_USER="odoo"

cd /opt/odoo-sandbox

sudo docker compose exec -T odoo-sandbox-db psql -U "$DB_USER" -d "$SANDBOX_DB" -c "
UPDATE ir_config_parameter
SET value = 'https://sandbox-odoo.example.com'
WHERE key = 'web.base.url';

INSERT INTO ir_config_parameter (key, value, create_uid, create_date, write_uid, write_date)
SELECT 'web.base.url', 'https://sandbox-odoo.example.com', 1, NOW(), 1, NOW()
WHERE NOT EXISTS (
  SELECT 1 FROM ir_config_parameter WHERE key = 'web.base.url'
);

SELECT key, value
FROM ir_config_parameter
WHERE key = 'web.base.url';
"

sudo docker compose restart odoo-sandbox


Option C — Temporary public access only
Best for short controlled tests.

Use only when needed:
- expose access for a short test window
- restrict access with basic auth, IP allowlist, or VPN
- remove the Nginx site or disable access after the test
- do not leave restored production data publicly reachable


Basic verification commands for any option:

echo "=== Sandbox direct ports should not be public ==="
sudo ss -tulpn | grep -E ":18069|:18072"

echo
echo "=== Docker published ports ==="
sudo docker ps --format "table {{.Names}}\t{{.Ports}}"

echo
echo "=== Local sandbox response ==="
curl -I http://127.0.0.1:18069/

echo
echo "=== Protected HTTPS homepage should require Basic Auth if Option B is used ==="
curl -I https://sandbox-odoo.example.com/

echo
echo "=== Database manager route should be blocked if Option B is used ==="
curl -I https://sandbox-odoo.example.com/web/database/manager

Manual verification checklist:

1. Open the sandbox Odoo URL.
2. Log in with a known admin user.
3. Confirm key records exist:
   - users
   - contacts
   - products
   - invoices
   - sales orders
4. Open records with attachments or images.
5. Confirm custom modules are installed or available.
6. Confirm reports load.
7. Confirm no real emails or webhooks are triggered.
8. Document any restore issues.

After the test, decide:

Option A — Keep the sandbox
- useful for training and future tests
- must be maintained and secured
- should be clearly labeled

Option B — Reset the sandbox
- useful before each test cycle
- restore a fresh backup when needed

Option C — Destroy the sandbox
- safest after one-time restore testing
- frees server resources
- reduces exposure