code-sandboxes 1.9.19__tar.gz → 1.9.21__tar.gz

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.19
+Version: 1.9.21
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.19"
+__version__ = "1.9.21"

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/environments/adapters/daytona.py

@@ -179,7 +179,12 @@ class Builder(ManagedBuilder):
     title = "Daytona"
     #: A `packages` list and, for conda (E3-02), an `environment.yml`
     #: dependency file installed with `micromamba`.
-    build_sources = ("packages", "dependencyFile")
+    build_sources = ("packages", "dependencyFile", "dockerfile")
+    #: None beyond the contract's own (E3-03): `Image.from_dockerfile` keeps
+    #: the Dockerfile text as it is and Daytona builds it on a real Docker
+    #: builder, so the grammar it accepts is Docker's. Checked in the SDK on
+    #: 2026-09-17.
+    forbidden_instructions = ()
     dependency_formats = ("conda",)
     #: Daytona runs GPUs, on its own hardware and the owner's account (E2-17).
     #: This builder does not build one yet: see `_own_findings`.
@@ -419,6 +424,11 @@ class Builder(ManagedBuilder):
                     self._log(line)
 
                 resources = self._resources(sdk, request.size_class)
+                # A snapshot is region-scoped, and the region that scopes it is
+                # Daytona's, not this platform's. `validate` already refuses
+                # more than one, so the first is the only one.
+                declared = list(request.environment.spec.compatibility.regions)
+                region = declared[0] if declared else None
                 try:
                     snapshot = client.snapshot.create(
                         sdk.CreateSnapshotParams(
@@ -426,7 +436,15 @@ class Builder(ManagedBuilder):
                             image=image,
                             resources=resources,
                             entrypoint=_CONTRACT_ENTRYPOINT,
-                            region_id=request.region,
+                            # Only a region Daytona knows. `request.region` is
+                            # *Datalayer's* — `r1` — and sending it answered
+                            # "Region not found" on the first real Daytona
+                            # build (2026-09-17). The owner names a Daytona
+                            # region in `compatibility.regions`; with none,
+                            # the field is left out and the account's own
+                            # default decides, which is what every snapshot
+                            # in the owner's account already has.
+                            **({"region_id": region} if region else {}),
                         ),
                         on_logs=on_logs,
                         timeout=self.max_build_seconds,

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/environments/adapters/e2b.py

@@ -199,7 +199,24 @@ class Builder(ManagedBuilder):
     title = "E2B"
     #: A `packages` list and, for conda (E3-02), an `environment.yml`
     #: dependency file installed with `micromamba`.
-    build_sources = ("packages", "dependencyFile")
+    build_sources = ("packages", "dependencyFile", "dockerfile")
+    #: What E2B's own Dockerfile parser does not handle (E3-03). Read from the
+    #: SDK on 2026-09-17: `e2b.template.dockerfile_parser` branches on FROM,
+    #: RUN, COPY, ADD, WORKDIR, USER, ENV, ARG, CMD and ENTRYPOINT, and for
+    #: anything else **prints `Unsupported instruction` and carries on**. So a
+    #: template built from a Dockerfile naming one of these comes back without
+    #: it and reports success — which is exactly what a capability report
+    #: exists to prevent.
+    forbidden_instructions = (
+        "VOLUME",
+        "EXPOSE",
+        "HEALTHCHECK",
+        "SHELL",
+        "ONBUILD",
+        "STOPSIGNAL",
+        "LABEL",
+        "MAINTAINER",
+    )
     dependency_formats = ("conda",)
     #: Firecracker microVMs: no GPU passthrough.
     gpu = False

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/environments/adapters/managed.py

@@ -73,7 +73,11 @@ class ManagedBuilder:
     #: built for a managed variant yet (E3-01), so it is not listed here.
     dependency_formats: tuple[str, ...] = ()
     package_managers: tuple[str, ...] = ("uv", "pip")
-    #: Dockerfile instructions its own builder does not implement (§6).
+    #: Dockerfile instructions its own builder does not implement (§6, E3-03).
+    #: Checked against a `dockerfile`-sourced spec at `validate`, before
+    #: anything is queued — the point being to refuse an instruction a variant
+    #: would otherwise drop, rather than hand back an image quietly missing
+    #: whatever it asked for.
     forbidden_instructions: tuple[str, ...] = ()
     #: Where its artifacts live; empty when the variant is regionless.
     regions: tuple[str, ...] = ()
@@ -128,6 +132,8 @@ class ManagedBuilder:
             )
         elif spec.build.source == "dependencyFile":
             findings.extend(self._dependency_file_findings(spec))
+        elif spec.build.source == "dockerfile":
+            findings.extend(self._dockerfile_findings(spec))
         if spec.packages.python.manager not in self.package_managers:
             findings.append(
                 CapabilityFinding(
@@ -269,6 +275,36 @@ class ManagedBuilder:
 
     # -- helpers for the subclasses -------------------------------------------
 
+    def _dockerfile_findings(self, spec: Any) -> list[CapabilityFinding]:
+        """Every instruction in the spec's Dockerfile this variant would not honour.
+
+        The contract's own refusals are `spec.py`'s to make and apply to every
+        variant alike; this is the narrower question of what *this* builder
+        does with a Dockerfile it accepts. Each is named with its line, since
+        a Dockerfile is somebody's file.
+        """
+        if not self.forbidden_instructions:
+            return []
+        dockerfile = getattr(spec.build, "dockerfile", None)
+        content = getattr(dockerfile, "content", "") or ""
+        if not content.strip():
+            return []
+        from ..contract import parse_dockerfile
+
+        refused = set(self.forbidden_instructions)
+        return [
+            CapabilityFinding(
+                code=CAPABILITY_UNSUPPORTED.code,
+                message=(
+                    f"line {instruction.line}: {self.title} does not implement "
+                    f"`{instruction.keyword}`"
+                ),
+                field="spec.build.dockerfile.content",
+            )
+            for instruction in parse_dockerfile(content)
+            if instruction.keyword in refused
+        ]
+
     @staticmethod
     def _spec_finding(message: str, field: str) -> CapabilityFinding:
         return CapabilityFinding(code=SPEC_INVALID.code, message=message, field=field)

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/environments/adapters/modal.py

@@ -286,7 +286,7 @@ class Builder(ManagedBuilder):
     title = "Modal"
     #: A `packages` list and, for conda (E3-02), an `environment.yml`
     #: dependency file installed with `micromamba_install`.
-    build_sources = ("packages", "dependencyFile")
+    build_sources = ("packages", "dependencyFile", "dockerfile")
     dependency_formats = ("conda",)
     #: Modal runs GPUs, in the owner's workspace (E2-17). This builder does
     #: not build one yet: see `build`'s own guard.

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/environments/attest.py

@@ -675,14 +675,43 @@ def attest_artifact(
     answers the mapping the workflow stores: the scan's decision, the
     signature, the SBOM and provenance references, and the size.
     """
+    variant = str(getattr(artifact, "variant", "") or "")
     reference = str(getattr(artifact, "immutable_reference", "") or "")
+    if variant and variant != "datalayer":
+        # D-11 is about the Datalayer artifact: it lives in this platform's
+        # registry, the scanner reads it there, cosign signs that digest, and
+        # the Operator refuses to start what is unsigned. A managed artifact
+        # is none of those things — it lives in the owner's own provider
+        # account (D-8) and is referenced the way that provider names it: a
+        # Daytona snapshot uuid, an E2B build id, a Modal `im-…`. There is no
+        # digest in a repository to scan or sign, and no Operator starting it.
+        #
+        # Attesting one anyway is what the first real Daytona build did, and
+        # it failed *after* the snapshot was built — the work done, the
+        # artifact live at the provider, and the build recorded as failed
+        # (2026-09-17).
+        #
+        # Publishing is not weakened by this: E2-15's gate requires the
+        # **Datalayer** artifact to have passed its scan, and that one is
+        # still attested here.
+        if log:
+            log(f"{variant} artifacts are not attested: {reference} is not a digest in a registry")
+        return {
+            "scan_summary": {},
+            "sbom_ref": "",
+            "provenance_ref": "",
+            "signature_ref": "",
+            "size_bytes": size_bytes,
+            "signed_now": False,
+            "licenses": [],
+        }
     registry, _, rest = reference.partition("/")
     repository, _, digest = rest.partition("@")
     if not (registry and repository and _DIGEST.match(digest)):
         raise EnvironmentsError(
             PROVIDER_ERROR,
             f"`{reference}` is not a digest in a repository, so it cannot be attested",
-            detail={"reference": reference},
+            detail={"reference": reference, "variant": variant},
         )
     use = attestor or Attestor(
         key=str(getattr(credential, "signing_key", "") or ""),

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/code_sandboxes/environments/spec.py

@@ -55,10 +55,10 @@ __all__ = [
     "BUILD_SOURCES",
     "GPU_SIZE_CLASSES",
     "KIND",
+    "PUBLIC_PACKAGE_INDEX_HOSTS",
     "SIZE_CLASSES",
     "SUPPORTED_BUILD_SOURCES",
     "VARIANTS",
-    "PUBLIC_PACKAGE_INDEX_HOSTS",
     "Accelerator",
     "ArtifactStatus",
     "Base",
@@ -174,14 +174,12 @@ class Platform(_Model):
 #: reached with a credential the public does not hold. Matched on host, so the
 #: trailing `/simple` or its absence never decides it. `pypi.org` is the index;
 #: `files.pythonhosted.org` is where its wheels are served from.
-PUBLIC_PACKAGE_INDEX_HOSTS = frozenset(
-    {"pypi.org", "files.pythonhosted.org"}
-)
+PUBLIC_PACKAGE_INDEX_HOSTS = frozenset({"pypi.org", "files.pythonhosted.org"})
 
 
 def _package_index_host(url: str) -> str:
     """The host an index URL names, lower-cased and without its port, or `""`."""
-    from urllib.parse import urlsplit  # noqa: PLC0415
+    from urllib.parse import urlsplit
 
     try:
         return (urlsplit(url).hostname or "").lower()
@@ -214,9 +212,7 @@ PUBLIC_CONDA_CHANNELS = frozenset(
         "msys2",
     }
 )
-PUBLIC_CONDA_CHANNEL_HOSTS = frozenset(
-    {"conda.anaconda.org", "repo.anaconda.com", "anaconda.org"}
-)
+PUBLIC_CONDA_CHANNEL_HOSTS = frozenset({"conda.anaconda.org", "repo.anaconda.com", "anaconda.org"})
 
 
 def channel_is_public(channel: str) -> bool:
@@ -344,6 +340,25 @@ class DependencyFileSpec(_Model):
     lock_content: str = ""
 
 
+class DockerfileSpec(_Model):
+    """The Dockerfile a `dockerfile`-sourced version builds from (E3-03).
+
+    Inline, the way ``DependencyFileSpec`` carries a ``requirements.txt``: a
+    file the author brings lives in the spec, so ``check_dockerfile`` and
+    every variant's capability report can read it **before** anything is
+    queued — which is the whole point of refusing an instruction a variant
+    does not implement at ``validate`` rather than halfway through a build.
+
+    The build *context* — the extra files a ``COPY`` needs — is the separate
+    upload E3-03 describes, bounded and checked by ``validate_build_context``.
+    A Dockerfile with no context is the common case and needs no upload at
+    all.
+    """
+
+    #: The Dockerfile text.
+    content: str = ""
+
+
 class ImageSourceSpec(_Model):
     """An existing OCI image, imported as the build's base (E3-04).
 
@@ -370,6 +385,7 @@ class ImageSourceSpec(_Model):
 class BuildSpec(_Model):
     source: Literal["packages", "dependencyFile", "dockerfile", "image"] = "packages"
     dependency_file: DependencyFileSpec | None = None
+    dockerfile: DockerfileSpec | None = None
     image: ImageSourceSpec | None = None
 
 
@@ -486,6 +502,28 @@ def parse_requirements_txt(text: str) -> list[str]:
     return lines
 
 
+def _dockerfile_findings(dockerfile: DockerfileSpec | None) -> list[SpecFinding]:
+    """What a `dockerfile`-sourced version must carry, and what the contract refuses.
+
+    The contract's own refusals are reported here, at `validate`, rather than
+    at build time: a `FROM` that is not an approved base, a privileged build,
+    the host network, a Docker socket mount, a host bind mount, and every
+    instruction §6 does not allow. Each is named with its line, because a
+    Dockerfile is somebody's file and "it was refused" is not a reason.
+    """
+    field = "spec.build.dockerfile"
+    if dockerfile is None:
+        return [SpecFinding(field, "is required when `spec.build.source` is `dockerfile`")]
+    if not dockerfile.content.strip():
+        return [SpecFinding(f"{field}.content", "is empty; it is the Dockerfile text")]
+    from .contract import validate_dockerfile
+
+    return [
+        SpecFinding(f"{field}.content", f"line {finding.line}: {finding.message}")
+        for finding in validate_dockerfile(dockerfile.content)
+    ]
+
+
 def _dependency_file_findings(dependency_file: DependencyFileSpec | None) -> list[SpecFinding]:
     field = "spec.build.dependencyFile"
     if dependency_file is None:
@@ -644,6 +682,8 @@ def spec_findings(
         )
     if spec.build.source == "dependencyFile":
         findings.extend(_dependency_file_findings(spec.build.dependency_file))
+    elif spec.build.source == "dockerfile":
+        findings.extend(_dockerfile_findings(spec.build.dockerfile))
     elif spec.build.source == "image":
         findings.extend(_image_findings(spec.build.image))
 
@@ -951,11 +991,7 @@ def publication_findings(environment: Environment) -> list[SpecFinding]:
                 PUBLICATION_BLOCKED,
             )
         )
-    private = [
-        url
-        for url in environment.spec.packages.python.indexes
-        if not index_is_public(url)
-    ]
+    private = [url for url in environment.spec.packages.python.indexes if not index_is_public(url)]
     if private:
         findings.append(
             SpecFinding(

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/schemas/environment-v1alpha1.json

@@ -95,6 +95,17 @@
           ],
           "default": null
         },
+        "dockerfile": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/DockerfileSpec"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null
+        },
         "image": {
           "anyOf": [
             {
@@ -219,6 +230,19 @@
       "title": "DependencyFileSpec",
       "type": "object"
     },
+    "DockerfileSpec": {
+      "additionalProperties": false,
+      "description": "The Dockerfile a `dockerfile`-sourced version builds from (E3-03).\n\nInline, the way ``DependencyFileSpec`` carries a ``requirements.txt``: a\nfile the author brings lives in the spec, so ``check_dockerfile`` and\nevery variant's capability report can read it **before** anything is\nqueued \u2014 which is the whole point of refusing an instruction a variant\ndoes not implement at ``validate`` rather than halfway through a build.\n\nThe build *context* \u2014 the extra files a ``COPY`` needs \u2014 is the separate\nupload E3-03 describes, bounded and checked by ``validate_build_context``.\nA Dockerfile with no context is the common case and needs no upload at\nall.",
+      "properties": {
+        "content": {
+          "default": "",
+          "title": "Content",
+          "type": "string"
+        }
+      },
+      "title": "DockerfileSpec",
+      "type": "object"
+    },
     "EnvironmentSpec": {
       "additionalProperties": false,
       "properties": {

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/tests/test_environment_attest.py

@@ -19,12 +19,13 @@ from __future__ import annotations
 
 import json
 import subprocess
+from types import SimpleNamespace
 
 import pytest
 
 from code_sandboxes.environments.attest import Attestor, attest_artifact, licenses_of, signature_tag
 from code_sandboxes.environments.builders import ArtifactReference
-from code_sandboxes.environments.errors import EnvironmentsError
+from code_sandboxes.environments.errors import PROVIDER_ERROR, EnvironmentsError
 from code_sandboxes.environments.policy import (
     DEFAULT_POLICY,
     Finding,
@@ -613,27 +614,25 @@ class TestAttestingAnArtifact:
         assert cosign.argv == [], "a blocked artifact must not be signed"
 
     def test_a_reference_that_is_not_a_digest_cannot_be_attested(self) -> None:
-        artifact = ArtifactReference(
-            variant="modal",
-            immutable_reference="im-1234567890",
-            provider_artifact_id="im-1234567890",
-            contract_version="sandbox-contract/v1",
-        )
+        """A `datalayer` artifact must be a digest in this platform's registry.
+
+        `attest_artifact` takes `artifact: Any`, so nothing guarantees every
+        caller went through the model validator that would have refused this.
+        """
+        artifact = SimpleNamespace(variant="datalayer", immutable_reference="im-1234567890")
         with pytest.raises(EnvironmentsError) as raised:
             attest_artifact(artifact=artifact, attestor=an_attestor())
         assert raised.value.code.code == "DL_ENV_PROVIDER_ERROR"
 
     def test_a_malformed_digest_cannot_be_attested_either(self) -> None:
         """`sha256:bad` starts with `sha256:` too: only a whole one is
-        accepted (found on PR #27's Copilot review). `e2b` rather than
-        `datalayer`, whose own model validator already refuses a malformed
-        digest before this function ever sees it — `attest_artifact` takes
-        `artifact: Any`, so nothing guarantees every caller went through it."""
-        artifact = ArtifactReference(
-            variant="e2b",
+        accepted (found on PR #27's Copilot review). Asked of `datalayer`,
+        since that is the variant this check is for — `attest_artifact` takes
+        `artifact: Any`, so nothing guarantees every caller went through the
+        model validator that would have refused it."""
+        artifact = SimpleNamespace(
+            variant="datalayer",
             immutable_reference=f"{REGISTRY}/{REPOSITORY}@sha256:bad",
-            provider_artifact_id="sha256:bad",
-            contract_version="sandbox-contract/v1",
         )
         with pytest.raises(EnvironmentsError) as raised:
             attest_artifact(artifact=artifact, attestor=an_attestor())
@@ -749,3 +748,43 @@ class TestLicencesFromTheSbom:
         """Never a reason to fail a build: a licence list is worth having, not dying for."""
         for document in (None, {}, {"packages": None}, {"components": [1, 2]}, "spdx"):
             assert licenses_of(document) == []
+
+
+class TestWhatIsAttestedAndWhatIsNot:
+    """D-11 is about the Datalayer artifact, not every artifact.
+
+    It lives in this platform's registry: the scanner reads it there, cosign
+    signs that digest, and the Operator refuses to start what is unsigned. A
+    managed artifact is none of those things — it lives in the owner's own
+    provider account (D-8), named the way that provider names it.
+    """
+
+    def _artifact(self, variant: str, reference: str):
+        return SimpleNamespace(variant=variant, immutable_reference=reference)
+
+    def test_a_daytona_snapshot_is_not_attested(self) -> None:
+        """Its reference is a uuid, and attesting it anyway failed the first
+        real Daytona build *after* the snapshot was already built
+        (2026-09-17)."""
+        answer = attest_artifact(
+            artifact=self._artifact("daytona", "51d10ab0-d98d-4117-bdb5-918e98646c92"),
+            size_bytes=1234,
+        )
+        assert answer["scan_summary"] == {}
+        assert answer["signature_ref"] == ""
+        assert answer["signed_now"] is False
+        # What the provider told us is still recorded.
+        assert answer["size_bytes"] == 1234
+
+    def test_an_e2b_build_id_and_a_modal_image_id_are_not_either(self) -> None:
+        for variant, reference in (("e2b", "bld-123"), ("modal", "im-abc123")):
+            answer = attest_artifact(artifact=self._artifact(variant, reference))
+            assert answer["signed_now"] is False, variant
+            assert answer["scan_summary"] == {}, variant
+
+    def test_a_datalayer_artifact_that_is_not_a_digest_still_fails(self) -> None:
+        """The check that matters is kept where it means something."""
+        with pytest.raises(EnvironmentsError) as raised:
+            attest_artifact(artifact=self._artifact("datalayer", "not-a-digest"))
+        assert raised.value.code is PROVIDER_ERROR
+        assert "cannot be attested" in str(raised.value)

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/tests/test_environment_daytona_builder.py

@@ -568,12 +568,28 @@ class TestBuildingASnapshot:
         resources = daytona.client.snapshot.create_calls[0].args[0].resources
         assert (resources.cpu, resources.memory, resources.disk) == (cpu, memory, disk)
 
-    def test_the_region_is_passed_through(self) -> None:
+    def test_the_region_sent_is_daytonas_own_not_this_platforms(self) -> None:
+        """`request.region` is Datalayer's — `r1` — and Daytona answered
+        "Region not found" for it on the first real build (2026-09-17).
+
+        The owner names a Daytona region in `compatibility.regions`; that is
+        the one that scopes the snapshot.
+        """
         daytona = FakeDaytonaModule()
-        a_builder(daytona=daytona).build(a_request(region="eu"))
+        a_builder(daytona=daytona).build(
+            a_request(region="r1", spec={"compatibility": {"regions": ["eu"]}})
+        )
         params = daytona.client.snapshot.create_calls[0].args[0]
         assert params.region_id == "eu"
 
+    def test_with_no_region_named_the_account_default_decides(self) -> None:
+        """The field is left out rather than filled with something Daytona
+        does not know — which is what every snapshot in a real account has."""
+        daytona = FakeDaytonaModule()
+        a_builder(daytona=daytona).build(a_request(region="r1"))
+        params = daytona.client.snapshot.create_calls[0].args[0]
+        assert params.region_id is None
+
     def test_the_snapshot_is_named_after_the_environment_and_version(self) -> None:
         daytona = FakeDaytonaModule()
         a_builder(daytona=daytona).build(a_request())

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/tests/test_environment_managed_builders.py

@@ -55,11 +55,7 @@ def environment(**spec: Any) -> Environment:
 #: A `dependencyFile` conda source: an `environment.yml` a managed variant
 #: builds with `micromamba` (E3-02).
 CONDA_ENVIRONMENT_YML = (
-    "name: geo\n"
-    "channels: [conda-forge]\n"
-    "dependencies:\n"
-    "  - python=3.13\n"
-    "  - gdal\n"
+    "name: geo\nchannels: [conda-forge]\ndependencies:\n  - python=3.13\n  - gdal\n"
 )
 
 
@@ -102,15 +98,33 @@ class TestTheCapabilitySets:
         assert get_builder("modal").capabilities().supports_gpu is True
         assert get_builder("daytona").capabilities().supports_gpu is True
 
-    def test_only_modal_forbids_instructions_its_builder_never_implemented(self) -> None:
-        """Modal implements its own Dockerfile builder; the others hand a
-        Dockerfile to BuildKit, which implements all of them."""
+    def test_each_variant_forbids_what_its_own_builder_will_not_honour(self) -> None:
+        """Modal implements its own Dockerfile builder, and E2B parses a
+        Dockerfile into Template SDK calls; Daytona hands the text to a real
+        Docker builder, which implements all of them.
+
+        E2B's list is read from its SDK (E3-03, 2026-09-17):
+        `e2b.template.dockerfile_parser` branches on FROM, RUN, COPY, ADD,
+        WORKDIR, USER, ENV, ARG, CMD and ENTRYPOINT, and for anything else
+        **prints `Unsupported instruction` and carries on** — so a template
+        built from a Dockerfile naming one of these comes back without it and
+        reports success. That is the case a capability report exists for.
+        """
         assert set(get_builder("modal").capabilities().forbidden_instructions) == {
             "ONBUILD",
             "STOPSIGNAL",
             "VOLUME",
         }
-        assert get_builder("e2b").capabilities().forbidden_instructions == ()
+        assert set(get_builder("e2b").capabilities().forbidden_instructions) == {
+            "VOLUME",
+            "EXPOSE",
+            "HEALTHCHECK",
+            "SHELL",
+            "ONBUILD",
+            "STOPSIGNAL",
+            "LABEL",
+            "MAINTAINER",
+        }
         assert get_builder("daytona").capabilities().forbidden_instructions == ()
 
     def test_each_one_bounds_how_long_a_build_may_take(self) -> None:
@@ -120,10 +134,13 @@ class TestTheCapabilitySets:
             seconds = get_builder(variant).capabilities().max_build_seconds
             assert seconds and 0 < seconds <= 60 * 60, variant
 
-    def test_this_phase_builds_a_package_list_and_a_conda_file(self) -> None:
+    def test_this_phase_builds_a_package_list_a_conda_file_and_a_dockerfile(self) -> None:
+        """All three take a Dockerfile (E3-03), each through its own door:
+        E2B parses one into Template SDK calls, Daytona hands the text to a
+        real Docker builder, Modal builds it with its own frontend."""
         for variant in MANAGED:
             sources = get_builder(variant).capabilities().build_sources
-            assert sources == ("packages", "dependencyFile"), variant
+            assert sources == ("packages", "dependencyFile", "dockerfile"), variant
 
 
 # -- what each one refuses ------------------------------------------------------
@@ -230,10 +247,29 @@ class TestWhatIsSaidBeforeAnythingIsQueued:
 
     def test_a_source_this_phase_does_not_build_is_refused_by_name(self) -> None:
         for variant in MANAGED:
-            report = get_builder(variant).validate(environment(build={"source": "dockerfile"}))
+            report = get_builder(variant).validate(environment(build={"source": "image"}))
             assert report.supported is False, variant
-            assert "`dockerfile` is not built for" in messages(report)
-            assert "it builds packages, dependencyFile" in messages(report)
+            assert "`image` is not built for" in messages(report)
+            assert "it builds packages, dependencyFile, dockerfile" in messages(report)
+
+    def test_an_instruction_a_variant_would_drop_is_refused_with_its_line(self) -> None:
+        """The case this exists for: E2B's parser prints `Unsupported
+        instruction` and carries on, so without this the template comes back
+        missing what the Dockerfile asked for and the build reports success."""
+        dockerfile = "FROM datalayer/python-cpu:2026.09\nRUN true\nVOLUME /data\n"
+        report = get_builder("e2b").validate(
+            environment(build={"source": "dockerfile", "dockerfile": {"content": dockerfile}})
+        )
+        assert report.supported is False
+        assert "line 3: E2B does not implement `VOLUME`" in messages(report)
+
+    def test_a_dockerfile_a_variant_can_honour_is_accepted(self) -> None:
+        """Daytona builds the text as it is, so Docker's own grammar is the limit."""
+        dockerfile = "FROM datalayer/python-cpu:2026.09\nVOLUME /data\nEXPOSE 8888\n"
+        report = get_builder("daytona").validate(
+            environment(build={"source": "dockerfile", "dockerfile": {"content": dockerfile}})
+        )
+        assert report.supported is True, messages(report)
 
     def test_a_conda_dependency_file_is_buildable_on_every_managed_variant(self) -> None:
         for variant in MANAGED:
@@ -415,8 +451,11 @@ def test_every_variant_validates_with_no_provider_sdk_installed() -> None:
             assert builder.capabilities().variant == variant
             report = builder.validate(environment())
             assert report.supported is True, f"{variant}: {messages(report)}"
+            # A refusal each variant still makes, and makes without an SDK.
+            # `dockerfile` stopped being one when E3-03 gave all three a door
+            # into it, so a managed variant is asked about `image` instead.
             refused = get_builder(variant).validate(
-                environment(build={"source": "dockerfile"})
+                environment(build={"source": "image"})
                 if variant != "datalayer"
                 else environment(
                     resources={"sizeClass": "gpu-small", "accelerator": {"type": "A10G"}}

{code_sandboxes-1.9.19 → code_sandboxes-1.9.21}/tests/test_environment_spec.py

@@ -322,14 +322,46 @@ def test_an_invalid_field_outranks_something_unsupported() -> None:
     }
 
 
-def test_a_dockerfile_source_is_accepted_and_keeps_its_own_base() -> None:
-    # E3-03: the base is the `FROM` its uploaded Dockerfile names, so
-    # `spec.base` is not checked against the approved table (as for `image`).
+def a_dockerfile_document(content: str) -> dict[str, Any]:
     data = mutated("spec.build.source", "dockerfile")
+    data["spec"]["build"]["dockerfile"] = {"content": content}
+    return data
+
+
+def test_a_dockerfile_source_is_accepted_and_keeps_its_own_base() -> None:
+    # E3-03: the base is the `FROM` the Dockerfile names, so `spec.base` is
+    # not checked against the approved table (as for `image`).
+    data = a_dockerfile_document("FROM datalayer/python-cpu:2026.09\nRUN true\n")
     data["spec"]["base"]["ref"] = "python"
     assert _codes(data) == {}
 
 
+def test_a_dockerfile_source_without_a_dockerfile_is_refused() -> None:
+    """`source: dockerfile` with nowhere to read the file from is not a spec."""
+    data = mutated("spec.build.source", "dockerfile")
+    assert _codes(data) == {"spec.build.dockerfile": "DL_ENV_SPEC_INVALID"}
+
+
+def test_an_empty_dockerfile_is_refused() -> None:
+    assert _codes(a_dockerfile_document("   \n")) == {
+        "spec.build.dockerfile.content": "DL_ENV_SPEC_INVALID"
+    }
+
+
+def test_the_contract_refuses_a_dockerfile_at_validate_naming_the_line() -> None:
+    """A Dockerfile is somebody's file: "it was refused" is not a reason.
+
+    The refusals are the contract's own — an unapproved base, the host
+    network, a privileged build, a Docker socket mount — and they are made
+    here, before anything is queued, rather than partway through a build.
+    """
+    data = a_dockerfile_document("FROM ubuntu:22.04\nRUN --network=host apt-get update\n")
+    assert _codes(data) == {"spec.build.dockerfile.content": "DL_ENV_SPEC_INVALID"}
+    messages = [finding.message for finding in spec_findings(parse_environment(data))]
+    assert any("line 1" in message and "approved" in message for message in messages)
+    assert any("line 2" in message and "host network" in message for message in messages)
+
+
 # -- Dependency files (E3-01) --------------------------------------------------