diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
index fab9ebe2fb..d042da9f8a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
@@ -1,2 +1,3 @@
 DIST sandbox-2.29.tar.xz 452784 BLAKE2B 388f5d9c49134696bafbc6b882581396a9fa2e7caa6ccfb4376706d653f836ce18e0d77527c4c4f2ff753c0b920ab5ab60e151dd8a4e399e13dbc3fe7c0533d6 SHA512 15c0e6b71e8b8547b8188f857568c99b1925d5a837a289b21c4f842341361bf7119b96083697dc83546caf530daab700fb8c2704974e7cfb804d64bb5257a4b4
 DIST sandbox-2.30.tar.xz 455764 BLAKE2B eb3bf46aedda96154a96f31d31469b394fd7ea113c2f2f01e739c690f2305ce95e0e2c7b641c1c7e088d89a1c36b82ce7afd6422fd137b7d93fd5b601be43996 SHA512 4a7dd2c7c50ac68d1944bea1275d0b66789055342f3aaa507f7440926bf5d9639850a98fa036da539708b6dbe4766b60f960b738db1c5ee5518ca81d1a629cae
+DIST sandbox-2.31.tar.xz 456368 BLAKE2B 054b0ae229d64a4c9553a8ace64ccf2f1e1fee4c545a5b4135d363368e800f3e3af8930916411e8ef4836f437225ae9f092c1c8d39742482a44029832592590d SHA512 0b97c0e77bee58c50cf5aad6d158be546424bf4bc5f2e9ddd4322ca46c003ddca127c303fbe615ad2fefe519498c7221c5315d3ad98a947ea545c0640bc60649
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.30-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.30-r1.ebuild
index 7a018dc315..d916ab7fa1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.30-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.30-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -11,7 +11,7 @@ SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="+nnp"
 
 # pax-utils lower bound for bug #265376
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.31.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.31.ebuild
new file mode 100644
index 0000000000..1efc83d19f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.31.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit flag-o-matic multilib-minimal multiprocessing
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
+SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="+nnp"
+
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
+
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox"
+}
+
+src_prepare() {
+	default
+
+	if ! use nnp ; then
+		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
+	fi
+
+	# sandbox uses `__asm__ (".symver "...` which does
+	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
+	filter-lto
+}
+
+multilib_src_configure() {
+	filter-lfs-flags #90228
+
+	ECONF_SOURCE="${S}" econf
+}
+
+multilib_src_test() {
+	# Default sandbox build will run with --jobs set to # cpus.
+	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	doenvd "${FILESDIR}"/09sandbox
+
+	dodoc AUTHORS ChangeLog* README.md
+}
+
+pkg_postinst() {
+	mkdir -p "${EROOT}"/var/log/sandbox
+	chown root:portage "${EROOT}"/var/log/sandbox
+	chmod 0770 "${EROOT}"/var/log/sandbox
+}