code-sandboxes 1.9.27__tar.gz → 1.9.29__tar.gz

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.27
+Version: 1.9.29
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.27"
+__version__ = "1.9.29"

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/environments/adapters/datalayer.py

@@ -61,7 +61,7 @@ from ..builders import (
     owner_cache_repository,
     owner_repository,
 )
-from ..contract import SANDBOX_CONTRACT_V1
+from ..contract import SANDBOX_CONTRACT_V1, pin_dockerfile_base
 from ..errors import (
     ARTIFACT_MISSING,
     BUILD_FAILED,
@@ -145,6 +145,41 @@ def _secret_mount(secret: BuildSecret) -> str:
     return f"--mount=type=secret,id={secret.id},env={secret.name}"
 
 
+def _head(request: BuildRequest, authored: Any) -> list[str]:
+    """The Dockerfile's first lines: the frontend, what built it, and its base.
+
+    For a `dockerfile` source (E3-03) the base is the author's own
+    Dockerfile, its `FROM` pinned to the digest the resolver chose; the
+    contract's lines follow it, whatever came before them.
+    """
+    lines = [
+        f"# syntax={DOCKERFILE_FRONTEND}",
+        f"# Generated by Datalayer for {request.environment.metadata.name} "
+        f"v{request.version}, build {request.build_uid}.",
+        f"# Lock: {request.lock_digest}",
+    ]
+    if authored is not None:
+        lines.append(pin_dockerfile_base(authored.content, request.resolved_base).rstrip("\n"))
+    else:
+        lines.append(f"FROM {request.resolved_base}")
+    return lines
+
+
+def _pip_lock_command(find_links: str, *, authored: bool) -> str:
+    """Install the pip lock: `sync` to it, or `install` it over an authored Dockerfile.
+
+    `sync` removes whatever the lock does not name, and a `dockerfile`
+    source's lock does not name what the Dockerfile itself installed
+    (`DOCKERFILE_COVERAGE`). The lock's pins, the protected ones included,
+    win either way.
+    """
+    verb, target = ("install", "-r ") if authored else ("sync", "")
+    return (
+        f"uv pip {verb} --system --require-hashes --find-links {find_links} "
+        f"{target}/opt/datalayer/lock.txt"
+    )
+
+
 class Builder:
     """The Datalayer variant: BuildKit into the owner's ECR repository.
 
@@ -224,7 +259,7 @@ class Builder:
             # `image` resolves from an imported reference instead of an
             # approved base (E3-04). Neither changes how this builder itself
             # builds, once the resolver has done its part.
-            build_sources=("packages", "dependencyFile", "image"),
+            build_sources=("packages", "dependencyFile", "image", "dockerfile"),
             package_managers=("uv", "pip"),
             # Nothing is forbidden by the builder itself: BuildKit is the
             # reference implementation of a Dockerfile, and what the contract
@@ -301,12 +336,9 @@ class Builder:
         """
         spec = request.environment.spec
         apt = apt_pins_in(request.lock_text)
-        lines = [
-            f"# syntax={DOCKERFILE_FRONTEND}",
-            f"# Generated by Datalayer for {request.environment.metadata.name} "
-            f"v{request.version}, build {request.build_uid}.",
-            f"# Lock: {request.lock_digest}",
-            f"FROM {request.resolved_base}",
+        authored = spec.build.dockerfile if spec.build.source == "dockerfile" else None
+        lines = _head(request, authored)
+        lines += [
             f'LABEL io.datalayer.environment="{request.environment.metadata.name}" \\',
             f'      io.datalayer.environment.uid="{request.environment_uid}" \\',
             f'      io.datalayer.version="{request.version}" \\',
@@ -385,8 +417,7 @@ class Builder:
                     # `--find-links` for what no index has — a protected pin's
                     # own wheel, the fork's local version above all (E1-04).
                     "RUN --mount=type=cache,target=/root/.cache/uv "
-                    f"uv pip sync --system --require-hashes --find-links {find_links} "
-                    "/opt/datalayer/lock.txt",
+                    + _pip_lock_command(find_links, authored=authored is not None),
                 ]
             )
         # A build secret is mounted on the postInstall commands that name it

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/environments/adapters/daytona.py

@@ -102,7 +102,7 @@ from ..builders import (
     CapabilityFinding,
     ValidationResult,
 )
-from ..contract import SANDBOX_CONTRACT_V1
+from ..contract import SANDBOX_CONTRACT_V1, pin_dockerfile_base
 from ..errors import (
     ARTIFACT_MISSING,
     BUILD_FAILED,
@@ -148,6 +148,19 @@ _CPU_RESOURCES: dict[str, dict[str, int]] = {
 }
 
 
+def _pip_lock_command(*, authored: bool) -> str:
+    """Install the pip lock: `sync` to it, or `install` it over an authored Dockerfile.
+
+    `sync` would remove what the Dockerfile installed and the lock does not
+    name (E3-03, `DOCKERFILE_COVERAGE`).
+    """
+    verb, target = ("install", "-r ") if authored else ("sync", "")
+    return (
+        f"uv pip {verb} --system --require-hashes "
+        f"--find-links {WHEELHOUSE_IMAGE_PATH} {target}{_LOCK_PATH}"
+    )
+
+
 def _daytona_sdk() -> Any:
     try:
         import daytona
@@ -339,7 +352,8 @@ class Builder(ManagedBuilder):
                 lock_file = Path(scratch) / "lock.txt"
                 lock_file.write_text(request.lock_text, encoding="utf-8")
 
-                image = sdk.Image.base(request.resolved_base)
+                authored = spec.build.dockerfile if spec.build.source == "dockerfile" else None
+                image = self._starting_image(sdk, request, authored, Path(scratch))
                 # `env` before anything installs, the same order the
                 # Datalayer and E2B builders keep: a package that compiles
                 # against a library found through an env var behaves
@@ -394,10 +408,7 @@ class Builder(ManagedBuilder):
                     # Datalayer and E2B builders give: a user install lands
                     # under the content directory's own home, which the
                     # runtime mounts over.
-                    image = image.run_commands(
-                        "uv pip sync --system --require-hashes "
-                        f"--find-links {WHEELHOUSE_IMAGE_PATH} {_LOCK_PATH}"
-                    )
+                    image = image.run_commands(_pip_lock_command(authored=authored is not None))
                 image = image.dockerfile_commands([f"USER 1000:100\nWORKDIR {_CONTENT_DIR}"])
                 for command in files_step(request.environment, variant=self.variant):
                     image = image.run_commands(command)
@@ -477,6 +488,23 @@ class Builder(ManagedBuilder):
             contract_version=spec.contract or SANDBOX_CONTRACT_V1.version,
         )
 
+    @staticmethod
+    def _starting_image(sdk: Any, request: BuildRequest, authored: Any, scratch: Path) -> Any:
+        """The image the chain starts from: the base, or the author's Dockerfile on it.
+
+        A Dockerfile source (E3-03) starts from the author's own Dockerfile,
+        its base pinned to the digest the resolver chose — which is also what
+        the build's registry entry lets Daytona pull. The contract's steps are
+        chained after it either way.
+        """
+        if authored is None:
+            return sdk.Image.base(request.resolved_base)
+        dockerfile = scratch / "Dockerfile"
+        dockerfile.write_text(
+            pin_dockerfile_base(authored.content, request.resolved_base), encoding="utf-8"
+        )
+        return sdk.Image.from_dockerfile(str(dockerfile))
+
     def _resources(self, sdk: Any, size_class: str) -> Any:
         """The CPU resources a size class bakes into the snapshot (§11.3 item 4)."""
         shape = _CPU_RESOURCES.get(size_class, _CPU_RESOURCES["small"])

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/environments/contract.py

@@ -24,13 +24,13 @@ import argparse
 import re
 import shlex
 import sys
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
 from pydantic import BaseModel, ConfigDict
 
-from .bases import is_approved_repository
+from .bases import APPROVED_BASES, ApprovedBase, is_approved_repository
 from .errors import CAPABILITY_UNSUPPORTED, SPEC_INVALID, EnvironmentsError
 
 __all__ = [
@@ -43,14 +43,18 @@ __all__ = [
     "BuildContextEntry",
     "BuildContextFinding",
     "ContractRow",
+    "DockerfileBase",
     "DockerfileFinding",
     "DockerfileInstruction",
     "SandboxContract",
     "check_build_context",
     "check_dockerfile",
     "contract_markdown",
+    "dockerfile_base",
+    "dockerfile_findings_for_build",
     "get_contract",
     "parse_dockerfile",
+    "pin_dockerfile_base",
     "validate_build_context",
     "validate_dockerfile",
 ]
@@ -461,6 +465,188 @@ def check_dockerfile(text: str, *, contract: SandboxContract = SANDBOX_CONTRACT_
         )
 
 
+# --- A Dockerfile source's base, and how it is built (E3-03) -----------------------------
+
+
+@dataclass(frozen=True)
+class DockerfileBase:
+    """The approved base a Dockerfile builds on: its channel, and the `FROM` lines naming it."""
+
+    ref: str
+    channel: str
+    lines: tuple[int, ...]
+
+
+@dataclass(frozen=True)
+class _ApprovedFrom:
+    line: int
+    image: str
+    ref: str
+    tag: str
+    digest: str
+
+
+def _from_image(instruction: DockerfileInstruction) -> tuple[str, str | None]:
+    """A `FROM`'s image and its stage name, flags skipped."""
+    tokens = _tokens(instruction.arguments)
+    for index, argument in enumerate(tokens):
+        if argument.startswith("--"):
+            continue
+        rest = tokens[index + 1 :]
+        alias = rest[1].lower() if len(rest) >= 2 and rest[0].upper() == "AS" else None
+        return argument, alias
+    return "", None
+
+
+def _approved_froms(text: str, bases: Mapping[str, ApprovedBase]) -> list[_ApprovedFrom]:
+    """Every `FROM` naming an approved base, in order; a stage name is not a base."""
+    stages: set[str] = set()
+    found: list[_ApprovedFrom] = []
+    for instruction in parse_dockerfile(text):
+        if instruction.keyword != "FROM":
+            continue
+        image, alias = _from_image(instruction)
+        if image and image.lower() not in stages and "$" not in image:
+            repository, _, digest = image.partition("@")
+            last = repository.rsplit("/", 1)[-1]
+            name, _, tag = last.partition(":")
+            repository = repository[: len(repository) - len(last)] + name
+            for base in bases.values():
+                if any(
+                    repository == known or repository.endswith("/" + known)
+                    for known in (base.ref, base.repository)
+                ):
+                    found.append(_ApprovedFrom(instruction.line, image, base.ref, tag, digest))
+                    break
+        if alias:
+            stages.add(alias)
+    return found
+
+
+def dockerfile_findings_for_build(
+    text: str, bases: Mapping[str, ApprovedBase] = APPROVED_BASES
+) -> list[DockerfileFinding]:
+    """What a Dockerfile source must also be to be built, beyond what the contract allows.
+
+    - **One base, named by its channel.** Every `FROM` of an approved base
+      names the same base, and its channel as the tag
+      (`datalayer/python-cpu:2026.09`): the build pins that channel to its
+      digest, the way a `packages` source's base is pinned (D-9), and the
+      lock is solved in it. A digest is refused rather than trusted — which
+      channel it belongs to is what the build must know.
+    - **No build context yet.** A `COPY` or `ADD` from the context needs the
+      upload this item also describes, which is not taken yet; without it
+      the file is absent and the build fails halfway. From another stage
+      (`--from=`), from a heredoc, and `ADD` of a URL need none.
+    - **The default escape character.** The build appends its own lines,
+      continued with a backslash.
+    """
+    findings: list[DockerfileFinding] = []
+    for raw in text.splitlines():
+        directive = _DIRECTIVE.match(raw.strip())
+        if not directive:
+            break
+        if directive.group(1).lower() == "escape" and directive.group(2) != "\\":
+            findings.append(
+                DockerfileFinding(
+                    1, "escape", "keep the default escape character: the build appends lines to it"
+                )
+            )
+    named: list[_ApprovedFrom] = []
+    for found in _approved_froms(text, bases):
+        channels = bases[found.ref].channels
+        if found.digest:
+            message = f"name `{found.ref}` by its channel, not a digest: the build pins the channel"
+        elif not found.tag:
+            example = next(iter(channels), "2026.09")
+            message = f"name `{found.ref}`'s channel as its tag, such as `{found.ref}:{example}`"
+        elif found.tag not in channels:
+            message = f"`{found.ref}` has no channel `{found.tag}`; channels: " + (
+                ", ".join(channels) or "none"
+            )
+        else:
+            named.append(found)
+            continue
+        findings.append(DockerfileFinding(found.line, "FROM", message))
+    if len({(found.ref, found.tag) for found in named}) > 1:
+        findings.append(
+            DockerfileFinding(
+                named[1].line,
+                "FROM",
+                "every approved base is the same base and channel: the build pins one",
+            )
+        )
+    for instruction in parse_dockerfile(text):
+        if instruction.keyword not in ("COPY", "ADD"):
+            continue
+        tokens = _tokens(instruction.arguments)
+        if "<<" in instruction.arguments or any(t.startswith("--from=") for t in tokens):
+            continue
+        sources = [t for t in tokens if not t.startswith("--")][:-1]
+        local = [s for s in sources if not re.match(r"^(https?|git)://|^git@", s, re.IGNORECASE)]
+        if local:
+            findings.append(
+                DockerfileFinding(
+                    instruction.line,
+                    instruction.keyword,
+                    f"copies `{local[0]}` from the build context, which this deployment does not "
+                    "take yet: bake it with a `RUN` or a heredoc, or copy it from another stage",
+                )
+            )
+    return sorted(findings, key=lambda finding: finding.line)
+
+
+def dockerfile_base(
+    text: str, bases: Mapping[str, ApprovedBase] = APPROVED_BASES
+) -> DockerfileBase:
+    """The approved base a Dockerfile source is built on, or a refusal naming the line."""
+    refused = [
+        finding
+        for finding in dockerfile_findings_for_build(text, bases)
+        if finding.instruction in ("FROM", "escape")
+    ]
+    if refused:
+        raise EnvironmentsError(
+            SPEC_INVALID,
+            f"line {refused[0].line}: {refused[0].message}",
+            detail={"field": "spec.build.dockerfile", "line": refused[0].line},
+        )
+    found = _approved_froms(text, bases)
+    if not found:
+        raise EnvironmentsError(
+            SPEC_INVALID,
+            "the Dockerfile builds on no approved base",
+            detail={"field": "spec.build.dockerfile"},
+        )
+    return DockerfileBase(
+        ref=found[0].ref,
+        channel=found[0].tag,
+        lines=tuple(item.line for item in found),
+    )
+
+
+def pin_dockerfile_base(
+    text: str, reference: str, bases: Mapping[str, ApprovedBase] = APPROVED_BASES
+) -> str:
+    """The Dockerfile as it is built: each `FROM` of its base pinned to `reference`.
+
+    Only the image of those lines changes; comments, the author's own
+    continuations and the stage names stay as written. The parser directives
+    go, because the build states its own frontend first (`# syntax=`), and a
+    directive anywhere but the very top is only a comment.
+    """
+    images = {found.line: found.image for found in _approved_froms(text, bases)}
+    rewritten: list[str] = []
+    in_directives = True
+    for number, raw in enumerate(text.splitlines(), start=1):
+        if in_directives and _DIRECTIVE.match(raw.strip()):
+            continue
+        in_directives = False
+        image = images.get(number)
+        rewritten.append(raw.replace(image, reference, 1) if image else raw)
+    return "\n".join(rewritten) + "\n"
+
+
 # --- The build context (E3-03) -------------------------------------------------------
 
 #: A `dockerfile` source uploads a build context to object storage. These bound
@@ -515,9 +701,7 @@ def validate_build_context(
         elif ".." in components:
             findings.append(BuildContextFinding(path, "escapes the context with `..`"))
         if entry.is_symlink:
-            findings.append(
-                BuildContextFinding(path, "is a symlink, which could read a host file")
-            )
+            findings.append(BuildContextFinding(path, "is a symlink, which could read a host file"))
         if entry.size_bytes > MAX_CONTEXT_FILE_BYTES:
             findings.append(
                 BuildContextFinding(
@@ -526,9 +710,7 @@ def validate_build_context(
             )
         total += entry.size_bytes
     if len(entries) > MAX_CONTEXT_FILES:
-        findings.append(
-            BuildContextFinding("", f"has more than {MAX_CONTEXT_FILES} files")
-        )
+        findings.append(BuildContextFinding("", f"has more than {MAX_CONTEXT_FILES} files"))
     if total > MAX_CONTEXT_TOTAL_BYTES:
         findings.append(
             BuildContextFinding("", f"is over the {MAX_CONTEXT_TOTAL_BYTES}-byte total limit")

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/environments/resolve.py

@@ -83,6 +83,8 @@ __all__ = [
     "APT_PIN_PREFIX",
     "APT_SNAPSHOT_PREFIX",
     "CONSTRAINTS_PATH",
+    "COVERAGE_PREFIX",
+    "DOCKERFILE_COVERAGE",
     "LOCK_FORMAT",
     "PROTECTED_PIN_PREFIX",
     "BuildkitResolveRunner",
@@ -129,6 +131,13 @@ WHEELHOUSE_PATH = Path(__file__).parent / "constraints" / "wheelhouse"
 #: How an apt pin is written in the lock. A comment, so every reader of a
 #: ``pip`` requirements file — the CLI's diff included — ignores it.
 APT_PIN_PREFIX = "# datalayer-apt: "
+#: What a lock says it does not cover, as a header line.
+COVERAGE_PREFIX = "# datalayer-coverage: "
+#: A `dockerfile` source's lock (E3-03): what the resolver saw, and no more.
+DOCKERFILE_COVERAGE = (
+    "the declared packages and Datalayer's protected pins only; what the Dockerfile's own "
+    "instructions install is not locked, so a rebuild may install different versions of it"
+)
 #: The Ubuntu snapshot the apt pins were taken from, as the lock records it.
 #: The builder installs the pins from the same snapshot, since a pinned
 #: version can leave the live mirror (D-9).
@@ -889,6 +898,7 @@ def lock_document(
     python_version: str,
     base_reference: str,
     merged: MergedRequirements,
+    coverage: str | None = None,
 ) -> dict[str, Any]:
     """The stored lock: its text, its digest, and what a reader needs from it.
 
@@ -912,6 +922,10 @@ def lock_document(
         f"# python: {python_version}",
         f"# base: {base_reference}",
     ]
+    if coverage:
+        # What this lock does not cover, in the lock itself: it travels with
+        # the version, and a reader of the lock is who needs to know (E3-03).
+        header.append(f"{COVERAGE_PREFIX}{coverage}")
     for pin in outcome.apt_pins.items():
         header.append(f"{APT_PIN_PREFIX}{pin[0]}={pin[1]}")
     if outcome.apt_pins and outcome.apt_source:
@@ -938,6 +952,9 @@ def resolve_bases(
     variants: Sequence[str],
     bases: dict[str, ApprovedBase] = APPROVED_BASES,
     registry: str | None = None,
+    *,
+    ref: str | None = None,
+    channel: str | None = None,
 ) -> dict[str, str]:
     """Each variant's base, pinned by digest (D-9, §4).
 
@@ -947,15 +964,15 @@ def resolve_bases(
     Hub. Bare ``<repository>@sha256:…`` otherwise, which is what every test
     and fixture that never passes a credential still gets.
     """
-    base = bases.get(environment.spec.base.ref)
-    repository = base.repository if base is not None else environment.spec.base.ref
+    ref = ref or environment.spec.base.ref
+    channel = channel or environment.spec.base.channel
+    base = bases.get(ref)
+    repository = base.repository if base is not None else ref
     if registry:
         repository = f"{registry}/{repository}"
     resolved: dict[str, str] = {}
     for variant in variants:
-        digest = resolve_base(
-            environment.spec.base.ref, environment.spec.base.channel, variant, bases
-        )
+        digest = resolve_base(ref, channel, variant, bases)
         resolved[variant] = f"{repository}@{digest}"
     return resolved
 
@@ -1238,13 +1255,15 @@ def resolve_environment(
     environment = parse_environment(spec)
     python = environment.spec.packages.python
     source = environment.spec.build.source
-    if source not in ("packages", "dependencyFile", "image"):
-        raise EnvironmentsError(
-            CAPABILITY_UNSUPPORTED,
-            f"`{source}` is not resolved yet: only `packages`, `dependencyFile` and `image` "
-            "are, in this phase",
-            detail={"field": "spec.build.source", "source": source},
-        )
+    # A Dockerfile names its own base in `FROM` (E3-03): that is what is
+    # pinned and solved in, never `spec.base`, which the schema still asks for.
+    dockerfile = environment.spec.build.dockerfile if source == "dockerfile" else None
+    base_ref, base_channel = environment.spec.base.ref, environment.spec.base.channel
+    if dockerfile is not None:
+        from .contract import dockerfile_base
+
+        named = dockerfile_base(dockerfile.content, bases)
+        base_ref, base_channel = named.ref, named.channel
     if python.manager == "conda":
         raise EnvironmentsError(
             CAPABILITY_UNSUPPORTED,
@@ -1262,7 +1281,14 @@ def resolve_environment(
             resolve_secret=resolve_secret,
         )
         if source == "image"
-        else resolve_bases(environment, wanted, bases, registry=_registry_of(credential))
+        else resolve_bases(
+            environment,
+            wanted,
+            bases,
+            registry=_registry_of(credential),
+            ref=base_ref,
+            channel=base_channel,
+        )
     )
     dependency_file = environment.spec.build.dependency_file
     if source == "dependencyFile" and dependency_file is not None:
@@ -1312,11 +1338,7 @@ def resolve_environment(
         registry_auth=_registry_auth(credential),
         bootstrap_uv=(source == "image"),
         # An imported image is not an approved base, and names no channel.
-        apt_snapshot=(
-            ""
-            if source == "image"
-            else channel_snapshot(environment.spec.base.ref, environment.spec.base.channel, bases)
-        ),
+        apt_snapshot=("" if source == "image" else channel_snapshot(base_ref, base_channel, bases)),
     )
     outcome = (runner or BuildkitResolveRunner()).solve(request, say)
     document = lock_document(
@@ -1324,6 +1346,7 @@ def resolve_environment(
         python_version=environment.spec.language.version,
         base_reference=solving_in,
         merged=merged,
+        coverage=DOCKERFILE_COVERAGE if dockerfile is not None else None,
     )
     say(
         f"Locked {document['package_count']} packages"

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/environments/spec.py

@@ -535,11 +535,23 @@ def _dockerfile_findings(dockerfile: DockerfileSpec | None) -> list[SpecFinding]
         return [SpecFinding(field, "is required when `spec.build.source` is `dockerfile`")]
     if not dockerfile.content.strip():
         return [SpecFinding(f"{field}.content", "is empty; it is the Dockerfile text")]
-    from .contract import validate_dockerfile
-
+    from .contract import dockerfile_findings_for_build, validate_dockerfile
+
+    # The contract's refusals, then what building it needs on top (E3-03):
+    # one approved base named by its channel, and no build context yet. The
+    # second set is not the contract's — a variant could honour both — so it
+    # is its own list, and a line the contract already refused is not named
+    # twice.
+    findings = validate_dockerfile(dockerfile.content)
+    refused = {finding.line for finding in findings}
+    findings += [
+        finding
+        for finding in dockerfile_findings_for_build(dockerfile.content)
+        if finding.line not in refused
+    ]
     return [
         SpecFinding(f"{field}.content", f"line {finding.line}: {finding.message}")
-        for finding in validate_dockerfile(dockerfile.content)
+        for finding in sorted(findings, key=lambda finding: finding.line)
     ]
 
 

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/code_sandboxes/jupyter_server_sandbox.py

@@ -650,13 +650,17 @@ class JupyterServerSandbox(Sandbox):
                 "Failed to restart Jupyter kernel: the server answered %s", response.status_code
             )
             return False
-        # The websocket the client holds is to the kernel that has just been
-        # replaced; reconnecting is what makes the next execution land in the
-        # new interpreter rather than on a channel nobody is reading.
-        with contextlib.suppress(Exception):
-            self._client.stop()
-        with contextlib.suppress(Exception):
-            self._client.start()
+        # **The websocket is kept, never reconnected.** jupyter-server binds a
+        # kernel's websocket to the kernel id, not to its process, and moves
+        # it onto the restarted kernel itself — which is how JupyterLab's own
+        # restart works. Reconnecting here broke every restart instead:
+        # `jupyter_kernel_client` caches its shell and IOPub channels bound to
+        # the socket they were built with, so after `stop()` and `start()` the
+        # client held a new socket while its channels still wrote to the
+        # closed one. The next execution answered `ok` with no output — found
+        # on r1, 2026-09-18, as checks 7, 8 and 9 all failing together, and
+        # reproduced against the approved base itself, with the deployed
+        # client. Swallowing both calls' errors is what hid it.
         return True
 
     @marks_execution

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/tests/test_environment_datalayer_builder.py

@@ -475,7 +475,7 @@ class TestWhatItSaysItCannotBuild:
     def test_this_variant_has_no_gpu_yet(self) -> None:
         capabilities = a_builder().capabilities()
         assert capabilities.supports_gpu is False
-        assert capabilities.build_sources == ("packages", "dependencyFile", "image")
+        assert capabilities.build_sources == ("packages", "dependencyFile", "image", "dockerfile")
         assert capabilities.package_managers == ("uv", "pip")
 
 

{code_sandboxes-1.9.27 → code_sandboxes-1.9.29}/tests/test_environment_daytona_builder.py

@@ -114,6 +114,11 @@ class FakeImage:
     def base(cls, ref: str) -> FakeImage:
         return cls([Call("base", (ref,))])
 
+    @classmethod
+    def from_dockerfile(cls, path: str) -> FakeImage:
+        """The text is read now: the builder's scratch file is gone by the time a test looks."""
+        return cls([Call("from_dockerfile", (path,), {"content": Path(path).read_text()})])
+
     def env(self, env_vars: dict[str, str]) -> FakeImage:
         self.calls.append(Call("env", (env_vars,)))
         return self