A pipe-friendly, pure builder for Bsdkrun.Sandbox.create/1's options — volumes, mounts, ports and the like are only ever bound at boot (the bsdkrun CLI has no runtime "attach" for them), so building the spec up with with_*/2 calls before create/1 is how a volume or network gets attached "by pipe":

Bsdkrun.Sandbox.new(os: :linux, image: "alpine")
|> Bsdkrun.Sandbox.with_volume("web")
|> Bsdkrun.Sandbox.with_network("devnet")
|> Bsdkrun.Sandbox.with_port("8080:80")
|> Bsdkrun.Sandbox.create!()

Nothing is sent to bsdkrun until create/1 (or create!/1) runs.