aip-agents-binary 0.0.0__py3-none-any.whl

aip_agents/sandbox/__init__.py

@@ -0,0 +1,62 @@
+# flake8: noqa: F401
+"""Sandbox module for isolated code execution.
+
+This module provides abstractions for running code in sandboxed environments.
+All components support lazy loading to work with optional dependencies (e2b).
+
+Authors:
+    Putu Ravindra Wiguna (putu.r.wiguna@gdplabs.id)
+"""
+
+import warnings
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from aip_agents.sandbox.defaults import DEFAULT_SANDBOX_PACKAGES, DEFAULT_SANDBOX_TEMPLATE
+    from aip_agents.sandbox.e2b_runtime import E2BSandboxRuntime
+    from aip_agents.sandbox.sandbox_runtime import SandboxRuntime
+    from aip_agents.sandbox.template_builder import ensure_sandbox_template
+    from aip_agents.sandbox.types import SandboxExecutionResult
+
+_IMPORT_MAP = {
+    "SandboxRuntime": "aip_agents.sandbox.sandbox_runtime",
+    "E2BSandboxRuntime": "aip_agents.sandbox.e2b_runtime",
+    "ensure_sandbox_template": "aip_agents.sandbox.template_builder",
+    "ensure_ptc_template": "aip_agents.sandbox.template_builder",
+    "DEFAULT_SANDBOX_TEMPLATE": "aip_agents.sandbox.defaults",
+    "DEFAULT_SANDBOX_PACKAGES": "aip_agents.sandbox.defaults",
+    "SandboxExecutionResult": "aip_agents.sandbox.types",
+}
+
+_DEPRECATED_ALIASES = {
+    "ensure_ptc_template": "ensure_sandbox_template",
+}
+
+_cache: dict[str, Any] = {}
+
+
+def __getattr__(name: str) -> Any:
+    """Lazy import components on first access."""
+    if name in _cache:
+        return _cache[name]
+
+    if name in _IMPORT_MAP:
+        try:
+            module = __import__(_IMPORT_MAP[name], fromlist=[name])
+            target_name = _DEPRECATED_ALIASES.get(name, name)
+            _cache[name] = getattr(module, target_name)
+
+            if target_name != name:
+                warnings.warn(
+                    f"{name} is deprecated; use {target_name} instead",
+                    DeprecationWarning,
+                    stacklevel=2,
+                )
+            return _cache[name]
+        except ImportError as e:
+            raise ImportError(f"Failed to import {name}. Install with: pip install aip-agents[local]") from e
+
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+
+__all__ = list(_IMPORT_MAP.keys())

aip_agents/sandbox/defaults.py

@@ -0,0 +1,220 @@
+"""Defaults for sandbox templates and packages.
+
+Authors:
+    Putu Ravindra Wiguna (putu.r.wiguna@gdplabs.id)
+    Christian Trisno Sen Long Chen (christian.t.s.l.chen@gdplabs.id)
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from aip_agents.mcp.client.base_mcp_client import BaseMCPClient
+    from aip_agents.ptc.custom_tools import PTCCustomToolConfig
+
+DEFAULT_SANDBOX_TEMPLATE = "aip-agents-sandbox-v2-3"
+AIP_AGENTS_BINARY_LOCAL = "aip-agents-binary[local]"
+DEFAULT_SANDBOX_PACKAGES: tuple[str, ...] = (
+    AIP_AGENTS_BINARY_LOCAL,
+    "mcp",
+    "httpx",
+)
+
+# Backward compatibility aliases
+DEFAULT_PTC_TEMPLATE = DEFAULT_SANDBOX_TEMPLATE
+DEFAULT_PTC_PACKAGES = DEFAULT_SANDBOX_PACKAGES
+
+
+def _has_mcp_tools(mcp_client: BaseMCPClient | None) -> bool:
+    """Check if MCP tools are present.
+
+    Args:
+        mcp_client: The MCP client to check.
+
+    Returns:
+        True if MCP client has servers configured.
+    """
+    return mcp_client is not None and bool(getattr(mcp_client, "servers", None))
+
+
+def _has_custom_tools(custom_tools_config: PTCCustomToolConfig | None) -> bool:
+    """Check if custom tools are present and enabled.
+
+    Args:
+        custom_tools_config: The custom tools configuration to check.
+
+    Returns:
+        True if custom tools are enabled and tools list is non-empty.
+    """
+    return custom_tools_config is not None and custom_tools_config.enabled and bool(custom_tools_config.tools)
+
+
+def _has_native_aip_tools(custom_tools_config: PTCCustomToolConfig | None) -> bool:
+    """Check if native AIP tools are present.
+
+    Native AIP tools are package-based custom tools with import_path starting with "aip_agents.tools.".
+
+    Args:
+        custom_tools_config: The custom tools configuration to check.
+
+    Returns:
+        True if at least one native AIP tool is found.
+    """
+    if not _has_custom_tools(custom_tools_config):
+        return False
+
+    assert custom_tools_config is not None
+    for tool in custom_tools_config.tools:
+        if tool.get("kind") == "package":
+            import_path = tool.get("import_path", "")
+            if import_path.startswith("aip_agents.tools."):
+                return True
+
+    return False
+
+
+def _merge_requirements(packages: list[str], requirements: list[str]) -> None:
+    """Merge requirements into packages list, avoiding duplicates.
+
+    Args:
+        packages: Target list to merge into (modified in place).
+        requirements: Requirements to merge.
+    """
+    for req in requirements:
+        if req not in packages:
+            packages.append(req)
+
+
+def _merge_custom_requirements(
+    packages: list[str],
+    custom_tools_config: PTCCustomToolConfig | None,
+) -> None:
+    """Merge custom tool requirements into packages list.
+
+    Args:
+        packages: Target list to merge into (modified in place).
+        custom_tools_config: Custom tools configuration.
+    """
+    if not _has_custom_tools(custom_tools_config):
+        return
+
+    assert custom_tools_config is not None
+    if custom_tools_config.requirements:
+        _merge_requirements(packages, custom_tools_config.requirements)
+
+
+def _packages_for_default_template(
+    custom_tools_config: PTCCustomToolConfig | None,
+    user_packages: list[str] | None,
+) -> list[str] | None:
+    """Build package list when using the default template.
+
+    Args:
+        custom_tools_config: Custom tools configuration.
+        user_packages: Explicitly provided packages by user (None if not set).
+
+    Returns:
+        List of packages to install, or None to skip installation.
+    """
+    packages = list(user_packages) if user_packages is not None else []
+    _merge_custom_requirements(packages, custom_tools_config)
+    return packages if packages else None
+
+
+def _packages_for_other_templates(
+    *,
+    mcp_client: BaseMCPClient | None,
+    custom_tools_config: PTCCustomToolConfig | None,
+    user_packages: list[str] | None,
+) -> list[str] | None:
+    """Build package list when using a non-default template.
+
+    Args:
+        mcp_client: The MCP client (check if has servers for MCP tools).
+        custom_tools_config: Custom tools configuration.
+        user_packages: Explicitly provided packages by user (None if not set).
+
+    Returns:
+        List of packages to install, or None to skip installation.
+    """
+    packages = list(user_packages) if user_packages is not None else []
+    base_packages = _build_base_packages(mcp_client=mcp_client, custom_tools_config=custom_tools_config)
+    _merge_requirements(packages, base_packages)
+    _merge_custom_requirements(packages, custom_tools_config)
+    return packages if packages else None
+
+
+def _build_base_packages(
+    *,
+    mcp_client: BaseMCPClient | None,
+    custom_tools_config: PTCCustomToolConfig | None,
+) -> list[str]:
+    """Build base package list based on tool types.
+
+    Args:
+        mcp_client: The MCP client (check if has servers for MCP tools).
+        custom_tools_config: Custom tools configuration.
+
+    Returns:
+        List of base packages needed for the tool types present.
+    """
+    packages: list[str] = []
+
+    if _has_mcp_tools(mcp_client):
+        packages.extend(["mcp", "httpx"])
+
+    if _has_custom_tools(custom_tools_config):
+        packages.append("langchain")
+
+    if _has_native_aip_tools(custom_tools_config):
+        if AIP_AGENTS_BINARY_LOCAL not in packages:
+            packages.append(AIP_AGENTS_BINARY_LOCAL)
+
+    return packages
+
+
+def select_sandbox_packages(
+    *,
+    mcp_client: BaseMCPClient | None,
+    custom_tools_config: PTCCustomToolConfig | None,
+    template: str | None,
+    user_packages: list[str] | None = None,
+    # Backward compatibility: accept old parameter name
+    user_ptc_packages: list[str] | None = None,
+) -> list[str] | None:
+    """Select minimal packages to install in sandbox based on tool types.
+
+    This function implements the smart package selection logic:
+    - DEFAULT_SANDBOX_TEMPLATE + no user packages: Skip install (template has all deps)
+    - DEFAULT_SANDBOX_TEMPLATE + user packages: User packages + PTCCustomToolConfig.requirements
+    - Other template + no user packages: Build packages from tool types
+    - Other template + user packages: User packages + tool-type packages + PTCCustomToolConfig.requirements
+
+    Key principle: Tools won't work without their required packages. Always ensure:
+    - MCP tools → mcp + httpx installed
+    - Custom LangChain tools → langchain installed
+    - Native AIP tools → aip-agents-binary[local] installed
+
+    Args:
+        mcp_client: The MCP client (check if has servers for MCP tools).
+        custom_tools_config: Custom tools configuration (includes tools list and .requirements field).
+        template: Sandbox template being used.
+        user_packages: Explicitly provided packages by user (None if not set).
+        user_ptc_packages: Deprecated. Use user_packages instead.
+
+    Returns:
+        List of packages to install, or None to skip installation.
+    """
+    # Handle backward compatibility
+    if user_ptc_packages is not None and user_packages is None:
+        user_packages = user_ptc_packages
+
+    if template == DEFAULT_SANDBOX_TEMPLATE:
+        return _packages_for_default_template(custom_tools_config, user_packages)
+
+    return _packages_for_other_templates(
+        mcp_client=mcp_client,
+        custom_tools_config=custom_tools_config,
+        user_packages=user_packages,
+    )

aip_agents/sandbox/dockerfiles/aip-agents-sandbox-v2-1-datasaur.Dockerfile

@@ -0,0 +1,120 @@
+FROM python:3.12
+
+USER root
+WORKDIR /root
+
+ENV JUPYTER_CONFIG_PATH=/root/.jupyter \
+    IPYTHON_CONFIG_PATH=/root/.ipython \
+    SERVER_PATH=/root/.server \
+    JAVA_VERSION=11 \
+    JAVA_HOME=/usr/lib/jvm/jdk-${JAVA_VERSION} \
+    IJAVA_VERSION=1.3.0 \
+    DENO_INSTALL=/opt/deno \
+    DENO_VERSION=v2.4.0 \
+    R_VERSION=4.5.* \
+    BUN_VERSION=1.1.38
+
+RUN : "1) Install base OS deps + signed NodeSource repo + nodejs" && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes \
+    apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    curl \
+    fonts-noto-cjk \
+    git \
+    gnupg \
+    jq \
+    ripgrep \
+    sudo \
+    util-linux && \
+    mkdir -p /etc/apt/keyrings && \
+    curl --proto '=https' --tlsv1.2 -fsSL \
+    -o /etc/apt/keyrings/nodesource.asc \
+    https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key && \
+    gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg /etc/apt/keyrings/nodesource.asc && \
+    chmod 644 /etc/apt/keyrings/nodesource.gpg && \
+    rm -f /etc/apt/keyrings/nodesource.asc && \
+    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" > /etc/apt/sources.list.d/nodesource.list && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes \
+    apt-get install -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/* && \
+    : "" && \
+    : "2) Bootstrap code-interpreter template files" && \
+    git clone --depth 1 --branch "@e2b/code-interpreter-template@0.2.1" \
+    https://github.com/e2b-dev/code-interpreter /tmp/code-interpreter-template && \
+    cp /tmp/code-interpreter-template/template/requirements.txt /root/requirements.txt && \
+    cp -r /tmp/code-interpreter-template/template/server /root/.server && \
+    mkdir -p /root/.config/matplotlib /root/.jupyter /root/.ipython/profile_default/startup && \
+    cp /tmp/code-interpreter-template/template/matplotlibrc /root/.config/matplotlib/.matplotlibrc && \
+    cp /tmp/code-interpreter-template/template/start-up.sh /root/.jupyter/start-up.sh && \
+    cp /tmp/code-interpreter-template/template/jupyter_server_config.py /root/.jupyter/ && \
+    cp /tmp/code-interpreter-template/template/ipython_kernel_config.py /root/.ipython/profile_default/ && \
+    cp -r /tmp/code-interpreter-template/template/startup_scripts /root/.ipython/profile_default/startup && \
+    rm -rf /tmp/code-interpreter-template && \
+    : "" && \
+    : "3) Install Python/Node runtimes and patch server timeout" && \
+    pip install --no-cache-dir -r requirements.txt && \
+    pip install --no-cache-dir "aip-agents-binary[local]" httpx mcp && \
+    pip install --no-cache-dir bash_kernel && \
+    ipython kernel install --name "python3" --user && \
+    python -m bash_kernel.install --user && \
+    # Pinned to latest commit as of 2026-05-20 (no semver tags exist in this repo).
+    # Commit hash avoids SonarCloud SCA "unresolved dependency version" warning.
+    npm install -g --ignore-scripts git+https://github.com/e2b-dev/ijavascript.git#79cb7d56dcfe0df9ff55eff0ca4dc920a6dcc361 && \
+    npm rebuild -g && \
+    ijsinstall --install=global && \
+    sed -i \
+    "s/client = httpx.AsyncClient()/client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))/" \
+    /root/.server/main.py && \
+    grep -q \
+    "client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))" \
+    /root/.server/main.py && \
+    python -m venv .server/.venv && \
+    .server/.venv/bin/pip install --no-cache-dir -r .server/requirements.txt && \
+    chmod +x .jupyter/start-up.sh && \
+    : "" && \
+    : "4) Install Datasaur runtime dependencies" && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends unzip && \
+    mkdir -p /etc/apt/keyrings && \
+    curl --proto '=https' --tlsv1.2 -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+    | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
+    chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+    > /etc/apt/sources.list.d/github-cli.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends gh && \
+    curl --proto '=https' --tlsv1.2 -fsSL https://bun.sh/install | bash -s -- "bun-v${BUN_VERSION}" && \
+    export BUN_INSTALL=/root/.bun && \
+    export PATH="$BUN_INSTALL/bin:$PATH" && \
+    npm install -g @playwright/cli@1.50.0 --ignore-scripts && \
+    playwright-cli install --skills && \
+    npx -y playwright install chrome && \
+    command -v gh && \
+    command -v node && \
+    command -v npm && \
+    command -v bun && \
+    command -v playwright-cli && \
+    gh --version && \
+    node --version && \
+    npm --version && \
+    bun --version && \
+    playwright-cli --version && \
+    rm -rf /var/lib/apt/lists/* && \
+    : "" && \
+    : "5) Create runtime user and sudo policy" && \
+    (id -u user >/dev/null 2>&1 || useradd -m user) && \
+    mkdir -p /home/user && \
+    chown -R user:user /home/user && \
+    (grep -q "^user ALL=(ALL) NOPASSWD: ALL$" /etc/sudoers || \
+    echo "user ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers)
+
+ENV BUN_INSTALL=/root/.bun
+ENV PATH="$BUN_INSTALL/bin:$PATH"
+
+USER user
+WORKDIR /home/user
+
+ENTRYPOINT ["sudo", "/root/.jupyter/start-up.sh"]

aip_agents/sandbox/dockerfiles/aip-agents-sandbox-v2-1.Dockerfile

@@ -0,0 +1,100 @@
+FROM python:3.12
+
+USER root
+WORKDIR /root
+
+ENV JUPYTER_CONFIG_PATH=/root/.jupyter \
+    IPYTHON_CONFIG_PATH=/root/.ipython \
+    SERVER_PATH=/root/.server
+
+RUN : "1) Install base OS deps + signed NodeSource repo + nodejs" && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes \
+    apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    curl \
+    fonts-noto-cjk \
+    git \
+    gnupg \
+    jq \
+    libcairo2-dev \
+    libgirepository1.0-dev \
+    pkg-config \
+    python3-dev \
+    ripgrep \
+    sudo \
+    util-linux && \
+    mkdir -p /etc/apt/keyrings && \
+    curl --proto '=https' --tlsv1.2 -fsSL \
+    -o /etc/apt/keyrings/nodesource.asc \
+    https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key && \
+    gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg /etc/apt/keyrings/nodesource.asc && \
+    chmod 644 /etc/apt/keyrings/nodesource.gpg && \
+    rm -f /etc/apt/keyrings/nodesource.asc && \
+    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" > /etc/apt/sources.list.d/nodesource.list && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes \
+    apt-get install -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/* && \
+    : "" && \
+    : "2) Bootstrap code-interpreter template files" && \
+    git clone --depth 1 --branch "@e2b/code-interpreter-template@0.2.1" \
+    https://github.com/e2b-dev/code-interpreter /tmp/code-interpreter-template && \
+    cp /tmp/code-interpreter-template/template/requirements.txt /root/requirements.txt && \
+    cp -r /tmp/code-interpreter-template/template/server /root/.server && \
+    mkdir -p /root/.config/matplotlib /root/.jupyter /root/.ipython/profile_default/startup && \
+    cp /tmp/code-interpreter-template/template/matplotlibrc /root/.config/matplotlib/.matplotlibrc && \
+    cp /tmp/code-interpreter-template/template/start-up.sh /root/.jupyter/start-up.sh && \
+    cp /tmp/code-interpreter-template/template/jupyter_server_config.py /root/.jupyter/ && \
+    cp /tmp/code-interpreter-template/template/ipython_kernel_config.py /root/.ipython/profile_default/ && \
+    cp -r /tmp/code-interpreter-template/template/startup_scripts /root/.ipython/profile_default/startup && \
+    rm -rf /tmp/code-interpreter-template && \
+    : "" && \
+    : "3) Install Python/Node runtimes and patch server timeout" && \
+    PIP_INDEX_URL=https://download.pytorch.org/whl/cpu \
+    PIP_EXTRA_INDEX_URL=https://pypi.org/simple \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: "torch==2.5.1+cpu" && \
+    echo "torch==2.5.1+cpu" > /tmp/constraints.txt && \
+    PIP_INDEX_URL=https://download.pytorch.org/whl/cpu \
+    PIP_EXTRA_INDEX_URL=https://pypi.org/simple \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: -c /tmp/constraints.txt -r requirements.txt && \
+    PIP_INDEX_URL=https://download.pytorch.org/whl/cpu \
+    PIP_EXTRA_INDEX_URL=https://pypi.org/simple \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: \
+    "aip-agents-binary[local]~=0.6.62" \
+    "httpx==0.28.1" \
+    "mcp==1.25.0" && \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: "bash_kernel==0.10.0" && \
+    ipython kernel install --name "python3" --user && \
+    python -m bash_kernel.install --user && \
+    # Pinned to latest commit as of 2026-05-20 (no semver tags exist in this repo).
+    # Commit hash avoids SonarCloud SCA "unresolved dependency version" warning.
+    npm install -g --ignore-scripts git+https://github.com/e2b-dev/ijavascript.git#79cb7d56dcfe0df9ff55eff0ca4dc920a6dcc361 && \
+    npm rebuild -g && \
+    ijsinstall --install=global && \
+    sed -i \
+    "s/client = httpx.AsyncClient()/client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))/" \
+    /root/.server/main.py && \
+    grep -q \
+    "client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))" \
+    /root/.server/main.py && \
+    python -m venv .server/.venv && \
+    # Do NOT add --only-binary :all: here. The server's requirements.txt may include
+    # packages that require compilation (e.g. C extensions). --only-binary silently
+    # skips them, leaving the venv incomplete. uvicorn then fails to start on port
+    # 49999 at sandbox boot, causing the "port not open" error in E2B sandboxes.
+    .server/.venv/bin/pip install --no-cache-dir -r .server/requirements.txt && \
+    chmod +x .jupyter/start-up.sh && \
+    : "" && \
+    : "4) Create runtime user and sudo policy" && \
+    (id -u user >/dev/null 2>&1 || useradd -m user) && \
+    mkdir -p /home/user && \
+    chown -R user:user /home/user && \
+    (grep -q "^user ALL=(ALL) NOPASSWD: ALL$" /etc/sudoers || \
+    echo "user ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers)
+
+USER user
+WORKDIR /home/user
+
+ENTRYPOINT ["sudo", "/root/.jupyter/start-up.sh"]

aip_agents/sandbox/dockerfiles/aip-agents-sandbox-v2-2-datasaur.Dockerfile

@@ -0,0 +1,143 @@
+FROM python:3.12
+
+USER root
+WORKDIR /root
+
+ENV JUPYTER_CONFIG_PATH=/root/.jupyter \
+    IPYTHON_CONFIG_PATH=/root/.ipython \
+    SERVER_PATH=/root/.server \
+    BUN_VERSION=1.1.38
+
+RUN : "1) Install base OS deps + signed NodeSource repo + nodejs" && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes \
+    apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    curl \
+    fonts-noto-cjk \
+    git \
+    gnupg \
+    jq \
+    libcairo2-dev \
+    libgirepository1.0-dev \
+    pkg-config \
+    python3-dev \
+    ripgrep \
+    sudo \
+    util-linux && \
+    mkdir -p /etc/apt/keyrings && \
+    curl --proto '=https' --tlsv1.2 -fsSL \
+    -o /etc/apt/keyrings/nodesource.asc \
+    https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key && \
+    gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg /etc/apt/keyrings/nodesource.asc && \
+    chmod 644 /etc/apt/keyrings/nodesource.gpg && \
+    rm -f /etc/apt/keyrings/nodesource.asc && \
+    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" > /etc/apt/sources.list.d/nodesource.list && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes \
+    apt-get install -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/* && \
+    : "" && \
+    : "2) Bootstrap code-interpreter template files" && \
+    git clone --depth 1 --branch "@e2b/code-interpreter-template@0.2.1" \
+    https://github.com/e2b-dev/code-interpreter /tmp/code-interpreter-template && \
+    cp /tmp/code-interpreter-template/template/requirements.txt /root/requirements.txt && \
+    cp -r /tmp/code-interpreter-template/template/server /root/.server && \
+    mkdir -p /root/.config/matplotlib /root/.jupyter /root/.ipython/profile_default/startup && \
+    cp /tmp/code-interpreter-template/template/matplotlibrc /root/.config/matplotlib/.matplotlibrc && \
+    cp /tmp/code-interpreter-template/template/start-up.sh /root/.jupyter/start-up.sh && \
+    cp /tmp/code-interpreter-template/template/jupyter_server_config.py /root/.jupyter/ && \
+    cp /tmp/code-interpreter-template/template/ipython_kernel_config.py /root/.ipython/profile_default/ && \
+    cp -r /tmp/code-interpreter-template/template/startup_scripts /root/.ipython/profile_default/startup && \
+    rm -rf /tmp/code-interpreter-template && \
+    : "" && \
+    : "3) Install Python/Node runtimes and patch server timeout" && \
+    PIP_INDEX_URL=https://download.pytorch.org/whl/cpu \
+    PIP_EXTRA_INDEX_URL=https://pypi.org/simple \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: "torch==2.5.1+cpu" && \
+    echo "torch==2.5.1+cpu" > /tmp/constraints.txt && \
+    PIP_INDEX_URL=https://download.pytorch.org/whl/cpu \
+    PIP_EXTRA_INDEX_URL=https://pypi.org/simple \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: -c /tmp/constraints.txt -r requirements.txt && \
+    PIP_INDEX_URL=https://download.pytorch.org/whl/cpu \
+    PIP_EXTRA_INDEX_URL=https://pypi.org/simple \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: \
+    "aip-agents-binary[local]~=0.6.62" \
+    "boto3==1.43.6" \
+    "httpx==0.28.1" \
+    "mcp==1.25.0" && \
+    TMPDIR=/var/tmp pip install --no-cache-dir --only-binary :all: "bash_kernel==0.10.0" && \
+    ipython kernel install --name "python3" --user && \
+    python -m bash_kernel.install --user && \
+    # Pinned to latest commit as of 2026-05-20 (no semver tags exist in this repo).
+    # Commit hash avoids SonarCloud SCA "unresolved dependency version" warning.
+    npm install -g --ignore-scripts git+https://github.com/e2b-dev/ijavascript.git#79cb7d56dcfe0df9ff55eff0ca4dc920a6dcc361 && \
+    npm rebuild -g && \
+    ijsinstall --install=global && \
+    sed -i \
+    "s/client = httpx.AsyncClient()/client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))/" \
+    /root/.server/main.py && \
+    grep -q \
+    "client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))" \
+    /root/.server/main.py && \
+    python -m venv .server/.venv && \
+    # Do NOT add --only-binary :all: here. The server's requirements.txt may include
+    # packages that require compilation (e.g. C extensions). --only-binary silently
+    # skips them, leaving the venv incomplete. uvicorn then fails to start on port
+    # 49999 at sandbox boot, causing the "port not open" error in E2B sandboxes.
+    .server/.venv/bin/pip install --no-cache-dir -r .server/requirements.txt && \
+    chmod +x .jupyter/start-up.sh && \
+    : "" && \
+    : "4) Install Datasaur runtime dependencies" && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends unzip && \
+    mkdir -p /etc/apt/keyrings && \
+    curl --proto '=https' --tlsv1.2 -fsSL \
+    -o /tmp/githubcli-archive-keyring.gpg \
+    https://cli.github.com/packages/githubcli-archive-keyring.gpg && \
+    gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+    /tmp/githubcli-archive-keyring.gpg && \
+    rm -f /tmp/githubcli-archive-keyring.gpg && \
+    chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+    > /etc/apt/sources.list.d/github-cli.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends gh && \
+    curl --proto '=https' --tlsv1.2 -fsSL \
+    -o /tmp/bun-install.sh \
+    https://bun.sh/install && \
+    echo "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd  /tmp/bun-install.sh" | sha256sum -c - && \
+    bash /tmp/bun-install.sh -- "bun-v${BUN_VERSION}" && \
+    rm -f /tmp/bun-install.sh && \
+    export BUN_INSTALL=/root/.bun && \
+    export PATH="$BUN_INSTALL/bin:$PATH" && \
+    npm install -g @playwright/cli@0.1.11 --ignore-scripts && \
+    playwright-cli install --skills && \
+    npx --ignore-scripts -y playwright install chrome && \
+    command -v gh && \
+    command -v node && \
+    command -v npm && \
+    command -v bun && \
+    command -v playwright-cli && \
+    gh --version && \
+    node --version && \
+    npm --version && \
+    bun --version && \
+    playwright-cli --version && \
+    rm -rf /var/lib/apt/lists/* && \
+    : "" && \
+    : "5) Create runtime user and sudo policy" && \
+    (id -u user >/dev/null 2>&1 || useradd -m user) && \
+    mkdir -p /home/user && \
+    chown -R user:user /home/user && \
+    (grep -q "^user ALL=(ALL) NOPASSWD: ALL$" /etc/sudoers || \
+    echo "user ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers)
+
+ENV BUN_INSTALL=/root/.bun
+ENV PATH="$BUN_INSTALL/bin:$PATH"
+
+USER user
+WORKDIR /home/user
+
+ENTRYPOINT ["sudo", "/root/.jupyter/start-up.sh"]