@cloudflare/sandbox 0.12.9 → 0.12.11

package/Dockerfile

@@ -5,20 +5,20 @@ ARG NODE_VERSION=24
 # cloudflared release — shared across glibc and musl image variants.
 # Bump this together with the architecture-specific checksums below.
 ARG CLOUDFLARED_VERSION=2026.3.0
+# fuse-overlayfs release — backs the copy-on-write layer of restored backups.
+# Pinned upstream because Ubuntu 22.04 ships 1.7.1, which returns EEXIST when
+# a restored directory is deleted, recreated and listed before files are
+# created in it (fixed in 1.15). Switch back to the distro package once the
+# base image ships 1.15 or newer.
+# Bump this together with the architecture-specific checksums below.
+ARG FUSE_OVERLAYFS_VERSION=1.18
 FROM oven/bun:${BUN_VERSION} AS bun-binary
 FROM node:${NODE_VERSION}-slim AS node-runtime
 
 # ============================================================================
-# cloudflared (Cloudflare Tunnel daemon) — enables sandbox.tunnels.*
-# Version pin lives at the top of this Dockerfile as a global ARG, shared
-# by every image variant so they ship the same release.
+# Release downloader — shared base for fetching pinned upstream binaries
 # ============================================================================
-FROM alpine:3.21 AS cloudflared-binary
-
-ARG TARGETARCH
-ARG CLOUDFLARED_VERSION
-ARG CLOUDFLARED_SHA256_AMD64=4a9e50e6d6d798e90fcd01933151a90bf7edd99a0a55c28ad18f2e16263a5c30
-ARG CLOUDFLARED_SHA256_ARM64=0755ba4cbab59980e6148367fcf53a8f3ec85a97deefd63c2420cf7850769bee
+FROM alpine:3.21 AS release-downloader
 
 # Inject the host's extra CA bundle when downloading behind a TLS-intercepting
 # proxy (e.g. Cloudflare WARP / Zero Trust). No-op when the secret isn't passed.
@@ -33,6 +33,18 @@ RUN --mount=type=secret,id=wrangler_ca \
         update-ca-certificates; \
     fi
 
+# ============================================================================
+# cloudflared (Cloudflare Tunnel daemon) — enables sandbox.tunnels.*
+# Version pin lives at the top of this Dockerfile as a global ARG, shared
+# by every image variant so they ship the same release.
+# ============================================================================
+FROM release-downloader AS cloudflared-binary
+
+ARG TARGETARCH
+ARG CLOUDFLARED_VERSION
+ARG CLOUDFLARED_SHA256_AMD64=4a9e50e6d6d798e90fcd01933151a90bf7edd99a0a55c28ad18f2e16263a5c30
+ARG CLOUDFLARED_SHA256_ARM64=0755ba4cbab59980e6148367fcf53a8f3ec85a97deefd63c2420cf7850769bee
+
 RUN set -eux; \
     arch="${TARGETARCH:-}"; \
     if [ -z "$arch" ]; then \
@@ -49,6 +61,32 @@ RUN set -eux; \
     chmod +x /cloudflared; \
     /cloudflared --version
 
+# ============================================================================
+# fuse-overlayfs — statically linked upstream release for the glibc images
+# ============================================================================
+FROM release-downloader AS fuse-overlayfs-binary
+
+ARG TARGETARCH
+ARG FUSE_OVERLAYFS_VERSION
+ARG FUSE_OVERLAYFS_SHA256_AMD64=56b0ae0aeb8abb308b068af2f137ed8d1bd239f4f27e21672ff0def861eea1e8
+ARG FUSE_OVERLAYFS_SHA256_ARM64=82fed736197b2a881a822e5357b488796f654e8371ce8573a1592331510a0133
+
+RUN set -eux; \
+    arch="${TARGETARCH:-}"; \
+    if [ -z "$arch" ]; then \
+      arch="$(apk --print-arch)"; \
+    fi; \
+    case "$arch" in \
+      amd64|x86_64) suffix=x86_64; sha="${FUSE_OVERLAYFS_SHA256_AMD64}" ;; \
+      arm64|aarch64) suffix=aarch64; sha="${FUSE_OVERLAYFS_SHA256_ARM64}" ;; \
+      *) echo "Unsupported arch for fuse-overlayfs: $arch" >&2; exit 1 ;; \
+    esac; \
+    url="https://github.com/containers/fuse-overlayfs/releases/download/v${FUSE_OVERLAYFS_VERSION}/fuse-overlayfs-${suffix}"; \
+    curl -fsSL -o /fuse-overlayfs "$url"; \
+    echo "$sha  /fuse-overlayfs" | sha256sum -c -; \
+    chmod +x /fuse-overlayfs; \
+    /fuse-overlayfs --version
+
 # Sandbox container images (default and python variants)
 # Multi-stage build optimized for Turborepo monorepo
 
@@ -152,7 +190,6 @@ ENV SANDBOX_VERSION=${SANDBOX_VERSION}
 # - fuse3: FUSE filesystem support (replaces legacy fuse, needed by s3fs/squashfuse/fuse-overlayfs)
 # - squashfs-tools: create squashfs archives (mksquashfs)
 # - squashfuse: mount squashfs in userspace (FUSE)
-# - fuse-overlayfs: userspace overlayfs for copy-on-write snapshots
 # Cache-bust: 2 - Clear apt cache to force fresh package list
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -160,7 +197,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
     rm -rf /var/cache/apt/* /var/lib/apt/lists/* && \
     apt-get update && apt-get install -y --no-install-recommends \
-    s3fs fuse3 squashfs-tools squashfuse fuse-overlayfs \
+    s3fs fuse3 squashfs-tools squashfuse \
     ca-certificates curl wget procps git unzip zip jq file \
     inotify-tools \
     libssl3 zlib1g libbz2-1.0 libreadline8 libsqlite3-0 \
@@ -173,6 +210,10 @@ RUN sed -i 's/#user_allow_other/user_allow_other/' /etc/fuse.conf
 # fusermount requires /etc/mtab to locate active mounts
 RUN ln -sf /proc/mounts /etc/mtab
 
+# Userspace overlayfs for copy-on-write backup restores
+COPY --from=fuse-overlayfs-binary /fuse-overlayfs /usr/bin/fuse-overlayfs
+RUN fuse-overlayfs --version
+
 # Install Node.js from official Node image (defaults to 24 LTS,
 # override via --build-arg NODE_VERSION=<version>)
 COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node

package/dist/bridge/index.js

@@ -1,6 +1,6 @@
-import "../dist-B_eXrP83.js";
+import "../dist-C3AQh4A0.js";
 import "../errors-CpkKPbWC.js";
-import { S as validateTunnelName, r as getSandbox, w as streamFile, x as validatePort, y as SandboxSecurityError } from "../sandbox-D0rNqxlr.js";
+import { S as validateTunnelName, r as getSandbox, w as streamFile, x as validatePort, y as SandboxSecurityError } from "../sandbox-DKbJiquI.js";
 import { DurableObject, env, tracing } from "cloudflare:workers";
 import { Hono } from "hono";
 
@@ -115,12 +115,23 @@ function validateSessionId(id) {
 /**
 * Convert an SSE stream from readFileStream() into a raw byte stream.
 * Decodes base64 chunks for binary files and UTF-8-encodes text chunks.
+* Reads up to the first chunk before returning. A missing file arrives as an
+* error event inside a successful stream, so it rejects here, while the caller
+* can still choose the HTTP status.
 */
-function sseToByteStream(sse) {
+async function sseToByteStream(sse) {
 	const encoder = new TextEncoder();
+	const enqueue = (controller, chunk) => {
+		controller.enqueue(chunk instanceof Uint8Array ? chunk : encoder.encode(chunk));
+	};
+	const chunks = streamFile(sse);
+	const first = await chunks.next();
 	return new ReadableStream({ async start(controller) {
 		try {
-			for await (const chunk of streamFile(sse)) controller.enqueue(chunk instanceof Uint8Array ? chunk : encoder.encode(chunk));
+			if (!first.done) {
+				enqueue(controller, first.value);
+				for await (const chunk of chunks) enqueue(controller, chunk);
+			}
 			controller.close();
 		} catch (err) {
 			controller.error(err);
@@ -2056,14 +2067,16 @@ function createBridgeApp(config) {
 			executor = await sandbox.getSession(sessionId);
 		}
 		try {
-			const stream = await executor.readFileStream(resolvedPath);
-			return new Response(sseToByteStream(stream), {
+			const byteStream = await sseToByteStream(await executor.readFileStream(resolvedPath));
+			return new Response(byteStream, {
 				status: 200,
 				headers: { "Content-Type": "application/octet-stream" }
 			});
 		} catch (err) {
-			if (err.code === "FILE_NOT_FOUND") return errorJson(`File not found: ${resolvedPath}`, "workspace_read_not_found", 404);
-			return errorJson(`read failed: ${err instanceof Error ? err.message : String(err)}`, "exec_transport_error", 502);
+			const code = err.code;
+			const msg = err instanceof Error ? err.message : String(err);
+			if (code === "FILE_NOT_FOUND" || msg.startsWith("File streaming error: File not found: ")) return errorJson(`File not found: ${resolvedPath}`, "workspace_read_not_found", 404);
+			return errorJson(`read failed: ${msg}`, "exec_transport_error", 502);
 		}
 	}));
 	app.put(`${apiPrefix}/sandbox/:id/file/*`, traced("write_file", async (c) => {
@@ -2185,7 +2198,7 @@ function createBridgeApp(config) {
 			if (result.exitCode !== 0) return errorJson(`tar failed (exit ${result.exitCode}): ${result.stderr}`, "workspace_archive_read_error", 502);
 			const stream = await sandbox.readFileStream(tmpPath);
 			sandbox.exec(`rm -f ${shellQuote(tmpPath)}`).catch(() => {});
-			return new Response(sseToByteStream(stream), {
+			return new Response(await sseToByteStream(stream), {
 				status: 200,
 				headers: { "Content-Type": "application/octet-stream" }
 			});