Repository navigation
Serve every hosted sandbox over the Link - #525
Merged
Merged
Conversation
Provisioning mints the allocation's Serve credential with its device credential and stores only its digest, in the same transaction that records the allocation. sandbox.Bootstrap carries the Sandbox I/O service's input (Link URL, credential, allocation resource). Core validates the whole Bootstrap once with Bootstrap.Validate before Create; the Docker, E2B and microsandbox copies of that validation are gone. An invalid input creates nothing and releases the allocation as settled absent. Docker, E2B and microsandbox write the input to the private file /home/runtime/sandbox-io-bootstrap.json and start oac-sandbox-io beside the daemon as UID/GID 1000. The node wire carries the new field, so node.ProtocolVersion is 5; the E2B helper contract and the microsandbox helper's stdin input change with it. Every Runtime image ships /usr/local/bin/oac-sandbox-io, and the distribution verifies it. A public URL that gives no Link URL now rejects hosted selection and admission with ErrNoLink (409 sandbox_configuration_error). The opt-in Docker tests need a fixture image that contains oac-sandbox-io; a new one proves that a real Docker sandbox Serves its allocation through a test relay.
Every hosted sandbox runs outside Core's network namespace and dials the sandbox Link, so selection and admission reject a loopback or plain-http public URL for every provider with ErrPublicURLUnreachable. The rule no longer depends on a per-provider declaration, so the PublicOrigin configuration requirement is deleted.
The Link authority hashed a presented Serve credential with a raw SHA-256 while allocation reservation stored runtimedevice.HashCredential. Both sides now use HashCredential, as Attach already does.
Docker started oac-sandbox-io with an exec after ContainerStart, so a running container whose exec never ran was reported BootstrapComplete. The container command now starts the service in the background from the private files written before start and execs the daemon, so ContainerStart is the last mutating step.
The opt-in Serve test builds oac-sandbox-io from this tree and copies it into the image it derives, so a local run tests the current binary rather than whatever the fixture image ships.
One unit test sends a Create through Core's adapter, decodes the request as the helper does, and checks that it carries SandboxIO and that the helper's stdin payload holds exactly Runtime and SandboxIO.
One table test covers the gate Core applies before Create, including a SandboxIO resource that names another allocation, tenant or Environment.
The install options guide and Web comments still tied the HTTPS public URL requirement to E2B; it now applies to every sandbox backend.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every hosted sandbox now runs
oac-sandbox-ioand Serves its allocation over the sandbox Link. The change is additive: the in-sandbox daemon still runs Sessions until PR5.runtimedevice.HashCredential.sandbox.BootstrapcarriesSandboxIO(Link URL, credential, resource). Core validates the Bootstrap once insandbox_provider.gobeforeCreate, and the adapters' copies are deleted. Docker, E2B, microsandbox and the node Provider each deliver the input as a private file and startoac-sandbox-io. Docker starts both processes from the container's own command, soBootstrapCompleteimplies the service started. The node wire carries it increate(ProtocolVersion5). Every sandbox image includes the binary.PublicOrigin.SandboxLink(). Selection and admission of every hosted Provider reject a public URL that is loopback or not https, with the existingErrPublicURLUnreachable. A hosted sandbox runs outside Core's network namespace, and plain http has no Link. The per-ProviderPublicOriginrequirement is deleted. Hosted sandboxes therefore need an https, non-loopback public URL.sandbox-provider.md,sandbox-bootstrap.md,node-generation-protocol.md,sandbox-deployment.md,configuration.md,install.md,install-options.md,core-errors.mdandconsole-api-usage.md(+zh); the/core/v1annotation andmake openapi; the Web copy and its e2e fixture.Blind review (fresh Claude subagent), round 1: seven findings, all fixed (one public-origin rule, Docker start order, a
Bootstrap.Validaterejection table, a microsandbox delivery test, one Serve hash, the/core/v1contract, the Docker Serve test using this tree's binary). The coordinator reviewed the fix diff.Checks: focused tests for sandbox, deployment, api, runtimegateway, execution, sessions, the Postgres stores and
cmd/*; the Core integration suite;-race -count=50for the Link authority and runtimegateway; the opt-in Docker Serve test;make openapi,make check-sqlc, the E2B contract generator,make check-microsandbox-provider;agents-clientand Web unit tests; darwin/windows daemon builds;make check-names check-docs check-ci. Not run: Playwright browser cases. E2B and microsandbox real-machine runs are deferred to the final qualification.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.