code-sandboxes 1.8.2__tar.gz → 1.9.2__tar.gz

code_sandboxes-1.9.2/.github/workflows/environments-live.yml

@@ -0,0 +1,181 @@
+name: Environments Live Matrix
+
+# The managed Environment builders (E2-03, E2-04, E2-05) against the real
+# providers, nightly (PLAN_ENV.md E2-11): a real, hash-verified lock, a real
+# build, a real launch, and the formal core tier — tests/test_environment_live_matrix.py.
+#
+# E2B and Modal carry their own already-documented, unticked gaps there
+# (E2-03's uid/gid mismatch; modal_sandbox.py's missing setpriv) and are
+# `xfail(strict=False)` in that file, so an ordinary failure there is
+# expected and does not fail this workflow. Daytona carries no such marker:
+# a failure there is a real regression, and this workflow opens (or
+# comments on) an issue naming it.
+#
+# Needs, as repository secrets: E2B_API_KEY, DAYTONA_API_KEY, MODAL_TOKEN_ID,
+# MODAL_TOKEN_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY — the last two
+# scoped to read the approved base from ECR only (D-18). A secret that is
+# not set is not a workflow failure: the test each secret belongs to skips,
+# by name, and says so in the job summary.
+
+on:
+  schedule:
+    # 04:17 UTC: off-peak for every provider this reaches, and away from the
+    # hour boundary every other scheduled workflow in this org tends to pick.
+    - cron: '17 4 * * *'
+  workflow_dispatch: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+# The default token on this repository is read-only: without this, a genuine
+# matrix failure would still 403 trying to label and open the issue that is
+# meant to report it (found in review).
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  live-matrix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup UV
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: latest
+          python-version: '3.13'
+          activate-environment: true
+
+      - name: Install dependencies
+        run: |
+          uv pip install ".[e2b,daytona,modal,test]"
+          uv pip install boto3
+
+      - name: Configure AWS credentials
+        run: |
+          mkdir -p ~/.aws
+          {
+            echo "[default]"
+            echo "aws_access_key_id=${AWS_ACCESS_KEY_ID}"
+            echo "aws_secret_access_key=${AWS_SECRET_ACCESS_KEY}"
+          } > ~/.aws/credentials
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Run the live matrix
+        id: live
+        continue-on-error: true
+        run: |
+          CODE_SANDBOXES_LIVE=1 pytest -q -m live \
+            tests/test_environment_live_matrix.py \
+            --junitxml=live-matrix-results.xml
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: us-east-1
+          E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
+          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+
+      - name: Upload the JUnit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: environments-live-results
+          path: live-matrix-results.xml
+          retention-days: 14
+
+      - name: Summarize genuine failures (not xfail) naming provider and check
+        if: steps.live.outcome == 'failure'
+        run: |
+          python - <<'PY'
+          import xml.etree.ElementTree as ET
+
+          tree = ET.parse("live-matrix-results.xml")
+          lines = []
+          for testcase in tree.getroot().iter("testcase"):
+              # An expected-fail (E2B/Modal's own documented gaps) is reported
+              # by pytest's junit writer as its own case with neither
+              # <failure> nor <error> — only a genuine, un-marked failure
+              # (Daytona, or a real regression anywhere else) has one.
+              node = testcase.find("failure")
+              if node is None:
+                  node = testcase.find("error")
+              if node is None:
+                  continue
+              name = f"{testcase.get('classname')}::{testcase.get('name')}"
+              detail = (node.get("message") or node.text or "").strip()
+              short = "\n".join(detail.splitlines()[:20])
+              lines.append(f"### `{name}`\n\n```\n{short}\n```")
+
+          with open("failures.md", "w") as handle:
+              handle.write("\n\n".join(lines))
+          print(f"{len(lines)} genuine failure(s) found")
+          PY
+
+      - name: Ensure the environments-live label exists
+        if: steps.live.outcome == 'failure'
+        continue-on-error: true # already existing is not an error
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.createLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'environments-live',
+              color: 'b60205',
+              description: 'The nightly Environments live matrix (E2-11)',
+            });
+
+      - name: Open or update an issue naming the provider and the check
+        if: steps.live.outcome == 'failure'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const detail = fs.readFileSync('failures.md', 'utf8').trim();
+            if (!detail) {
+              // Every failure was inside an `xfail` — nothing genuinely
+              // broke (see the module docstring's own reasoning).
+              return;
+            }
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const body = [
+              `The nightly [environments live matrix](${runUrl}) failed for real — not the two already-documented \`xfail\` gaps (E2-03's uid/gid, Modal's missing \`setpriv\`).`,
+              '',
+              detail,
+            ].join('\n');
+            const title = 'environments-live: nightly failure';
+            const existing = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'environments-live',
+            });
+            const found = existing.data.find((issue) => issue.title === title);
+            if (found) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: found.number,
+                body,
+              });
+            } else {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title,
+                body,
+                labels: ['environments-live'],
+              });
+            }
+
+      - name: Fail the job if something genuinely broke
+        if: steps.live.outcome == 'failure'
+        run: exit 1

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/CHANGELOG.md

@@ -8,6 +8,93 @@
 
 ## Unreleased
 
+## 1.9.2
+
+- **A real ECR repository name is lowercase; a real owner uid is not**
+  (`environments.adapters.datalayer.owner_repository`, new
+  `owner_cache_repository`; PLAN_ENV.md E1-07). Found live, 2026-09-14, the
+  first real Datalayer build ever run for a real account's own uid rather
+  than a lowercase test fixture: `DescribeRepositories` refused outright,
+  "Invalid parameter at 'repositoryName'" — this project's own uids are
+  ULIDs, conventionally uppercase, and ECR repository names match
+  `[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*` per path segment. Both the owner's own
+  repository and the owner's cache repository are lowered at the one place
+  each is built, so every caller (create, inspect, exists, delete, the
+  cache import/export) stays consistent with itself.
+
+## 1.9.1
+
+- **mTLS to the build pool's `buildkitd`** (`environments.adapters.datalayer.Builder`,
+  `environments.resolve.BuildkitResolveRunner`; PLAN_ENV.md E1-06/E1-07). Both
+  drivers of `buildctl` took only `--addr`, which is what every prior live
+  drill needed against a plain-socket, ephemeral `buildkitd` — never a real
+  one. The build pool's real daemon on r1 takes mTLS connections only, so
+  reaching it needed three more flags neither driver had: `--tlscert`,
+  `--tlskey` and `--tlscacert`, each read from `DATALAYER_BUILDKIT_TLSCERT`,
+  `DATALAYER_BUILDKIT_TLSKEY` and `DATALAYER_BUILDKIT_TLSCACERT` when not
+  passed explicitly (`Builder`, matching how it already reads
+  `DATALAYER_BUILDKIT_ADDR`) or passed in by the caller (`BuildkitResolveRunner`,
+  constructed by durable's own `activities_environments.py`, which now reads
+  and forwards the same three). All three or none — a partial set is treated
+  as none, since a `buildkitd` requiring mTLS refuses a client carrying only
+  some of them at the daemon, with a less useful error than refusing here.
+
+## 1.9.0
+
+- **The Daytona builder** (`environments.adapters.daytona`, PLAN_ENV.md
+  E2-04). A snapshot built from the approved Datalayer base — `uv pip sync --require-hashes` against the resolved lock, your files, `postInstall`
+  commands, and an explicit `tini -- sleep infinity` entrypoint — with the
+  owner's own Daytona organization, never this package's ambient
+  credentials. Confirmed live against a real, hash-verified lock: a real
+  snapshot reaches `Active` and a sandbox launched from it passes the full
+  sandbox contract, doctor included — the one managed variant, of the
+  three landing here, whose build-time state and launched state fully
+  agree.
+- **The E2B builder** (`environments.adapters.e2b`, PLAN_ENV.md E2-03). A
+  template built from `code-interpreter-v1` — E2B's own proprietary
+  code-interpreter server ships baked into it only, so the build starts
+  there rather than from the Datalayer base and reconciles whatever it
+  shipped to exactly what the lock pins. Two live-found identity bugs are
+  fixed: `code-interpreter-v1` already holds an account at uid 1000 and a
+  group at gid 100 of its own, so the old `useradd` was silently landing
+  elsewhere — the build now renames the existing account instead — and the
+  base sets no locale at all, now set explicitly. A real build passes the
+  contract's doctor check in full. **Still open:** a launched sandbox
+  currently runs as root, not the contract's `1000:100` — the two
+  `systemd` services that actually execute a launched sandbox's code have
+  no `User=` of their own, and E2B's private server hardcodes `/home/user`
+  as the working directory, independent of anything the build sets.
+- **The Modal builder** (`environments.adapters.modal`, PLAN_ENV.md E2-05).
+  An image built `from_aws_ecr` off the approved base, with a per-build
+  Secret made and torn down around it. The contract's own identity is put
+  back at launch: `modal_sandbox.py`'s session driver now drops itself to
+  `1000:100` for a sandbox launched from a built Environments artifact
+  specifically (gated on `image_id`, so general Modal sandbox usage
+  elsewhere is unaffected) — Modal ignores the image's own `USER`, so this
+  is the only place it can be restored. A separate, previously
+  silently-fatal bug is also fixed: the real launcher creates the sandbox
+  with no command arguments at all, so an entrypoint relying on `exec "$@"` alone was a no-op and every launched environment exited within
+  seconds; the entrypoint now falls back to `sleep infinity` when given
+  none. **Still open:** two of the core tier's checks (imports, filesystem)
+  still fail on a launched sandbox, for a reason not yet root-caused —
+  confirmed specific to a contract-built image under repeated `exec`, not
+  the identity fix.
+- **A real, shared bug in all three managed launchers, found in review**:
+  `start()` creates the remote sandbox well before it marks itself
+  started, while `stop()` was guarded on that flag rather than on the
+  resource itself — a failure in between left a real, running sandbox
+  that `stop()` skipped entirely, orphaned for good. Fixed identically in
+  `daytona_sandbox.py`, `modal_sandbox.py` and `e2b_sandbox.py`.
+- **A nightly live matrix for the three managed builders**
+  (`.github/workflows/environments-live.yml`, PLAN_ENV.md E2-11). Builds a
+  real artifact on each real provider from a real, hash-verified lock,
+  launches a sandbox from it, and runs the formal core tier — opening (or
+  commenting on) an issue naming the provider and the check on a genuine
+  failure. E2B and Modal run `xfail(strict=False)` for their own
+  already-documented gaps above; Daytona carries no such marker. Needs
+  provider secrets added to the repository before it does anything for
+  real.
+
 ## 1.8.2
 
 - **A sandbox can be asked whether it is still alive, and the answer no longer

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/Makefile

@@ -54,6 +54,11 @@ live-matrix:
 kill-relaunch:
 	CODE_SANDBOXES_LIVE=1 pytest -q -m live tests/test_the_kill_relaunch_drill.py
 
+## The managed Environment builders against the real providers: a real
+## resolved lock, build, launch, and the formal core tier (E2-11).
+environments-live:
+	CODE_SANDBOXES_LIVE=1 pytest -q -m live tests/test_environment_live_matrix.py
+
 clean: ## clean
 	git clean -fdx
 

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.8.2
+Version: 1.9.2
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License
@@ -109,7 +109,7 @@ Description-Content-Type: text/markdown
 [![Become a Sponsor](https://img.shields.io/static/v1?label=Become%20a%20Sponsor&message=%E2%9D%A4&logo=GitHub&style=flat&color=1ABC9C)](https://github.com/sponsors/datalayer)
 [![PyPI - Version](https://img.shields.io/pypi/v/code-sandboxes)](https://pypi.org/project/code-sandboxes)
 
-# { } 📦 Code Sandboxes
+# 📦 Code Sandboxes
 
 Code Sandboxes (`code_sandboxes`) is a Python package for running code in isolated sandbox variants through a unified API.
 

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/README.md

@@ -9,7 +9,7 @@
 [![Become a Sponsor](https://img.shields.io/static/v1?label=Become%20a%20Sponsor&message=%E2%9D%A4&logo=GitHub&style=flat&color=1ABC9C)](https://github.com/sponsors/datalayer)
 [![PyPI - Version](https://img.shields.io/pypi/v/code-sandboxes)](https://pypi.org/project/code-sandboxes)
 
-# { } 📦 Code Sandboxes
+# 📦 Code Sandboxes
 
 Code Sandboxes (`code_sandboxes`) is a Python package for running code in isolated sandbox variants through a unified API.
 

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.8.2"
+__version__ = "1.9.2"

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/code_sandboxes/daytona_sandbox.py

@@ -655,17 +655,21 @@ class DaytonaSandbox(Sandbox):
         )
 
     def stop(self) -> None:
-        if not self._started:
+        # Guarded on the resource itself, not `_started` (found in review):
+        # `start()` creates the remote sandbox well before it marks itself
+        # started, so a failure in between — `create_context`, building
+        # `SandboxInfo` — would otherwise leave a real, running sandbox that
+        # `stop()` skips entirely and this object can never clean up again.
+        if self._sandbox is None:
             return
-        if self._sandbox is not None:
-            try:
-                if self._delete_on_stop:
-                    self._sandbox.delete()
-                else:
-                    self._sandbox.stop()
-            except Exception:
-                logger.debug("Ignoring error while stopping the Daytona sandbox", exc_info=True)
-            self._sandbox = None
+        try:
+            if self._delete_on_stop:
+                self._sandbox.delete()
+            else:
+                self._sandbox.stop()
+        except Exception:
+            logger.debug("Ignoring error while stopping the Daytona sandbox", exc_info=True)
+        self._sandbox = None
         self._daytona = None
         self._jupyter_endpoint = None
         self._contexts.clear()

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/code_sandboxes/e2b_sandbox.py

@@ -419,14 +419,18 @@ class E2BSandbox(Sandbox):
         return self._allow_internet_access
 
     def stop(self) -> None:
-        if not self._started:
+        # Guarded on the resource itself, not `_started` (found in review):
+        # `start()` creates the remote sandbox well before it marks itself
+        # started, so a failure in between — `create_context`, building
+        # `SandboxInfo` — would otherwise leave a real, running sandbox that
+        # `stop()` skips entirely and this object can never clean up again.
+        if self._sandbox is None:
             return
-        if self._sandbox is not None:
-            try:
-                self._sandbox.kill()
-            except Exception:
-                logger.debug("Ignoring error while killing the E2B sandbox", exc_info=True)
-            self._sandbox = None
+        try:
+            self._sandbox.kill()
+        except Exception:
+            logger.debug("Ignoring error while killing the E2B sandbox", exc_info=True)
+        self._sandbox = None
         self._contexts.clear()
         self._jupyter_endpoint = None
         self._volume_mounts.stopped()

{code_sandboxes-1.8.2 → code_sandboxes-1.9.2}/code_sandboxes/environments/adapters/datalayer.py

@@ -71,7 +71,12 @@ from ..files import files_step
 from ..resolve import WHEELHOUSE_IMAGE_PATH, WHEELHOUSE_PATH, apt_pins_in, locked_versions
 from ..spec import BuildSecret, Environment
 
-__all__ = ["ECR_ENVIRONMENT_PREFIX", "Builder", "owner_repository"]
+__all__ = [
+    "ECR_ENVIRONMENT_PREFIX",
+    "Builder",
+    "owner_cache_repository",
+    "owner_repository",
+]
 
 #: Where an owner's environments live in ECR (D-10).
 ECR_ENVIRONMENT_PREFIX = "environments/u/"
@@ -89,10 +94,32 @@ DEFAULT_MAX_ARTIFACT_BYTES = 20 * 1024**3
 
 
 def owner_repository(owner_uid: str, environment_name: str) -> str:
-    """The owner's repository for one environment: ``environments/u/<owner>/<name>``."""
+    """The owner's repository for one environment: ``environments/u/<owner>/<name>``.
+
+    Lowercased: an ECR repository name matches
+    ``[a-z0-9]+((\\.|_|__|-+)[a-z0-9]+)*`` per path segment, and this
+    project's own uids are ULIDs, conventionally uppercase — found live,
+    2026-09-14, the first real build ever run for a real account's own
+    uid rather than a lowercase test fixture: ``DescribeRepositories``
+    refused it outright, "Invalid parameter at 'repositoryName'". Lowering
+    both segments here, the one place this reference is built, keeps every
+    caller (create, inspect, exists, delete) consistent with itself without
+    each needing to remember to.
+    """
     if not owner_uid or not environment_name:
         raise ValueError("an owner and an environment name make the repository")
-    return f"{ECR_ENVIRONMENT_PREFIX}{owner_uid}/{environment_name}"
+    return f"{ECR_ENVIRONMENT_PREFIX}{owner_uid}/{environment_name}".lower()
+
+
+def owner_cache_repository(owner_uid: str) -> str:
+    """The owner's own BuildKit cache repository: ``environments/cache/u/<owner>``.
+
+    Lowercased for the same reason ``owner_repository`` is (a ULID, not a
+    lowercase test fixture, is what a real build actually names).
+    """
+    if not owner_uid:
+        raise ValueError("an owner makes the cache repository")
+    return f"environments/cache/u/{owner_uid}".lower()
 
 
 def _secret_mount(secret: BuildSecret) -> str:
@@ -127,6 +154,15 @@ class Builder:
         looks like (E1-06).
     address
         ``buildkitd``'s address, when it is not the default socket.
+    tlscert, tlskey, tlscacert
+        Paths to the client certificate, its key, and the CA that signed
+        ``buildkitd``'s own server certificate — the build pool's daemon
+        takes mTLS connections only (PLAN_ENV.md E1-06), so a ``tcp://``
+        ``address`` with none of these set fails the handshake, not the
+        build. Unset (the default) is right for a plain-socket
+        ``buildkitd``, such as ``plane local``'s own ephemeral one, which
+        was every ``buildkitd`` this adapter had ever actually built
+        against before the pool on r1 existed.
     region
         The registry's region, for the ECR API calls.
     ecr
@@ -145,6 +181,9 @@ class Builder:
         credential: Any = None,
         buildctl: str | None = None,
         address: str | None = None,
+        tlscert: str | None = None,
+        tlskey: str | None = None,
+        tlscacert: str | None = None,
         region: str | None = None,
         ecr: Any = None,
         run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
@@ -155,6 +194,9 @@ class Builder:
         self._credential = credential
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
         self._address = address or os.environ.get("DATALAYER_BUILDKIT_ADDR", "").strip()
+        self._tlscert = tlscert or os.environ.get("DATALAYER_BUILDKIT_TLSCERT", "").strip()
+        self._tlskey = tlskey or os.environ.get("DATALAYER_BUILDKIT_TLSKEY", "").strip()
+        self._tlscacert = tlscacert or os.environ.get("DATALAYER_BUILDKIT_TLSCACERT", "").strip()
         self._region = region or os.environ.get("AWS_REGION", "us-east-1")
         self._ecr = ecr
         self._run = run or subprocess.run
@@ -359,7 +401,7 @@ class Builder:
         repository = owner_repository(request.owner_uid, request.environment.metadata.name)
         registry = self._registry_host()
         self._ensure_repository(repository)
-        self._ensure_cache_repository(f"environments/cache/u/{request.owner_uid}")
+        self._ensure_cache_repository(owner_cache_repository(request.owner_uid))
         tag = f"v{request.version}-{request.build_uid}"
         reference = f"{registry}/{repository}:{tag}"
         with tempfile.TemporaryDirectory(prefix="dl-build-") as directory:
@@ -384,6 +426,7 @@ class Builder:
                 command = [
                     self._buildctl,
                     *(["--addr", self._address] if self._address else []),
+                    *self._tls_options(),
                     "build",
                     "--frontend",
                     "dockerfile.v0",
@@ -534,6 +577,22 @@ class Builder:
             self._ecr = boto3.client("ecr", region_name=self._region)
         return self._ecr
 
+    def _tls_options(self) -> list[str]:
+        """The ``buildctl`` global flags for the build pool's mTLS (E1-06).
+
+        All three or none: a `buildkitd` that takes mTLS refuses a client
+        with only some of them, so a partial set here would fail at the
+        daemon with a confusing error rather than a clear one about the
+        deployment's own configuration.
+        """
+        if not (self._tlscert and self._tlskey and self._tlscacert):
+            return []
+        return [
+            f"--tlscert={self._tlscert}",
+            f"--tlskey={self._tlskey}",
+            f"--tlscacert={self._tlscacert}",
+        ]
+
     def _registry_host(self) -> str:
         registry = str(getattr(self._credential, "registry", "") or "")
         if not registry:
@@ -605,7 +664,7 @@ class Builder:
     def _cache_options(self, request: BuildRequest) -> list[str]:
         """The owner's cache, imported and exported: never another owner's (D-12)."""
         registry = self._registry_host()
-        cache = f"{registry}/environments/cache/u/{request.owner_uid}:{self.variant}"
+        cache = f"{registry}/{owner_cache_repository(request.owner_uid)}:{self.variant}"
         return [
             "--import-cache",
             f"type=registry,ref={cache}",