Refactor: create sandbox outside of provisioner