code-sandboxes 1.9.30__tar.gz → 1.9.32__tar.gz

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.30
+Version: 1.9.32
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.30"
+__version__ = "1.9.32"

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/daytona_sandbox.py

@@ -510,6 +510,24 @@ class DaytonaSandbox(Sandbox):
         given = {key: value for key, value in settings.items() if value}
         return daytona.DaytonaConfig(**given) if given else None
 
+    def _snapshot_carries_a_gpu(self) -> bool:
+        """Whether the snapshot this sandbox starts from was built with a GPU (E2-17).
+
+        A GPU is baked into a snapshot with its other resources, so a sandbox
+        of one asks for a GPU without saying so, and Daytona refuses it unless
+        it is ephemeral, the same as one asked for with `gpu=`. The snapshot
+        record says: a GPU environment's artifact, launched by its id, reads
+        `gpu` there. One that cannot be read is taken to have none, and
+        Daytona's own refusal then says why.
+        """
+        if self._snapshot is None or self._daytona is None:
+            return False
+        try:
+            snapshot = self._daytona.snapshot.get(self._snapshot)
+        except Exception:
+            return False
+        return bool(getattr(snapshot, "gpu", 0))
+
     def _create_params(self, daytona: Any) -> Any:  # noqa: C901
         """What to ask Daytona for, from the configuration of this sandbox.
 
@@ -534,7 +552,7 @@ class DaytonaSandbox(Sandbox):
             ]
 
         resources = self._resources(daytona)
-        if _asks_for_a_gpu(resources):
+        if _asks_for_a_gpu(resources) or self._snapshot_carries_a_gpu():
             # Daytona will not create a GPU sandbox that outlives its stop:
             # "GPU sandboxes must be ephemeral; set autoDeleteInterval to 0".
             # It is a property of asking for a GPU at all, not of asking for

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/environments/adapters/daytona.py

@@ -69,18 +69,13 @@ would make an artifact refuse to build for a reason that says nothing about
 what it does once actually launched. A real answer needs a launched
 sandbox, which is a smoke test's job (E1-14), not this builder's.
 
-**GPU classes are not built here.** `gpu = True` on this builder is a true
-capability (Daytona's own hardware runs one, D-20), and `validate` leaves a
-GPU size class buildable rather than refusing it — the constraint table of
-section 6 has nothing against it, and an existing test
-(`test_a_gpu_spec_is_buildable_on_modal_and_daytona`) already pins that
-answer. What actually stops a GPU build today is upstream: the CUDA base
-channel is E2-17's to publish, and `bases.py` has no digest to resolve
-`python-cuda` to yet, so a `BuildRequest` for one cannot be constructed in
-practice. `build()` itself still guards it explicitly, refusing plainly
-rather than baking an unsourced guess at a GPU type and count into a
-snapshot, in case that ever changes before the real numbers do (section 11.3
-item 7).
+**A GPU is baked into the snapshot** (E2-17, D-20), from the spec's own
+`resources.accelerator`: its `type` is one of Daytona's GPUs, checked at
+`validate` so a GPU Daytona does not offer is refused before any build, and
+its `count` is the number of them. CPU and memory come from the spec's hints,
+or Daytona's own default for that GPU; the disk from the hints, or enough for
+the CUDA base. A sandbox of a GPU snapshot is ephemeral, which Daytona
+requires of every GPU sandbox (`DaytonaSandbox` reads the snapshot's `gpu`).
 
 @module code_sandboxes.environments.adapters.daytona
 """
@@ -118,10 +113,10 @@ from ..resolve_conda import (
     micromamba_bootstrap_command,
     micromamba_install_command,
 )
-from ..spec import GPU_SIZE_CLASSES, Environment
+from ..spec import GPU_SIZE_CLASSES, Environment, EnvironmentSpec
 from .managed import ManagedBuilder
 
-__all__ = ["Builder"]
+__all__ = ["DAYTONA_GPUS", "Builder", "daytona_gpu"]
 
 #: Tags Daytona refuses for a snapshot's source image: each moves.
 MOVING_TAGS = ("latest", "lts", "stable")
@@ -148,6 +143,26 @@ _CPU_RESOURCES: dict[str, dict[str, int]] = {
 }
 
 
+#: The GPUs Daytona offers, as its SDK's `GpuType` names them (E2-17). Spelled
+#: out rather than read from the SDK, because `validate` runs where the SDK may
+#: not be installed; a test holds the two together.
+DAYTONA_GPUS: tuple[str, ...] = ("H100", "H200", "RTX-PRO-6000", "RTX-4090", "RTX-5090")
+
+#: A GPU snapshot's disk when the spec gives no hint: the CUDA base alone is
+#: about 15 GB, and Daytona's own default would not hold it with room to work.
+_GPU_DISK_GI = 50
+
+
+def daytona_gpu(accelerator_type: str) -> str | None:
+    """Daytona's name for an accelerator type, or `None` when Daytona has no such GPU.
+
+    `h100`, `H100` and `rtx_4090` name what Daytona calls `H100` and
+    `RTX-4090`; a `T4` or an `A100-80GB` is Modal's vocabulary, not Daytona's.
+    """
+    name = accelerator_type.strip().upper().replace("_", "-")
+    return name if name in DAYTONA_GPUS else None
+
+
 def _pip_lock_command(*, authored: bool) -> str:
     """Install the pip lock: `sync` to it, or `install` it over an authored Dockerfile.
 
@@ -204,8 +219,8 @@ class Builder(ManagedBuilder):
     #: 2026-09-17.
     forbidden_instructions = ()
     dependency_formats = ("requirements", "pyproject", "conda")
-    #: Daytona runs GPUs, on its own hardware and the owner's account (E2-17).
-    #: This builder does not build one yet: see `_own_findings`.
+    #: Daytona runs GPUs, on its own hardware and the owner's account (E2-17),
+    #: baked into the snapshot with the rest of its resources.
     gpu = True
     #: E0-04's spike found only a registry login for the private base, never
     #: a per-step arbitrary named secret (E3-05): `buildSecrets` is refused.
@@ -300,15 +315,7 @@ class Builder(ManagedBuilder):
                     field="spec.compatibility.regions",
                 )
             )
-        # A GPU class is left buildable here on purpose (`gpu = True`,
-        # D-20): the CUDA base E2-17 has not published yet, so a GPU
-        # `BuildRequest` cannot reach `build()` in practice — `bases.py`'s
-        # own resolver has no digest to resolve `python-cuda` to, and
-        # refuses first. `build()` itself still guards it explicitly (see
-        # its own docstring), so a spec that somehow got a `resolved_base`
-        # anyway is refused plainly rather than baking an unsourced guess
-        # at a GPU type and count into a snapshot.
-        #
+        findings.extend(self._accelerator_findings(environment.spec))
         # `spec.buildSecrets` needs no check of its own here: `supports_build_secrets
         # = False` above (E3-05, merged since this branch started) makes
         # `ManagedBuilder._own_findings` refuse it before this method is
@@ -330,18 +337,6 @@ class Builder(ManagedBuilder):
         (E0-04).
         """
         spec = request.environment.spec
-        if request.size_class in GPU_SIZE_CLASSES:
-            # `validate` leaves a GPU class buildable (`gpu = True`, D-20):
-            # `bases.py` has no CUDA digest to resolve yet, so this cannot
-            # be reached in practice — refused plainly here rather than
-            # baking an unsourced guess at a GPU type and count into a
-            # snapshot (E2-17 is what will give this real numbers).
-            raise EnvironmentsError(
-                CAPABILITY_UNSUPPORTED,
-                f"Daytona runs `{request.size_class}` on its own GPUs, but the CUDA base "
-                "and the GPU resource shape this needs are E2-17's, not built yet",
-                detail={"variant": self.variant, "missing": "E2-17"},
-            )
         sdk = self._daytona_sdk()
         client = self._client(sdk)
         name = f"dl-{request.environment.metadata.name}-v{request.version}-{request.build_uid}"
@@ -437,7 +432,7 @@ class Builder(ManagedBuilder):
                     logged.append(line)
                     self._log(line)
 
-                resources = self._resources(sdk, request.size_class)
+                resources = self._resources(sdk, request.size_class, spec)
                 # A snapshot is region-scoped, and the region that scopes it is
                 # Daytona's, not this platform's. `validate` already refuses
                 # more than one, so the first is the only one.
@@ -505,10 +500,40 @@ class Builder(ManagedBuilder):
         )
         return sdk.Image.from_dockerfile(str(dockerfile))
 
-    def _resources(self, sdk: Any, size_class: str) -> Any:
-        """The CPU resources a size class bakes into the snapshot (§11.3 item 4)."""
-        shape = _CPU_RESOURCES.get(size_class, _CPU_RESOURCES["small"])
-        return sdk.Resources(cpu=shape["cpu"], memory=shape["memory"], disk=shape["disk"])
+    @staticmethod
+    def _accelerator_findings(spec: EnvironmentSpec) -> list[CapabilityFinding]:
+        """A GPU Daytona does not offer, refused before any build (E2-17)."""
+        accelerator = spec.resources.accelerator
+        if accelerator == "none" or daytona_gpu(accelerator.type):
+            return []
+        return [
+            CapabilityFinding(
+                code="DL_ENV_CAPABILITY_UNSUPPORTED",
+                message=(
+                    f"Daytona has no GPU called `{accelerator.type}`; it offers "
+                    + ", ".join(DAYTONA_GPUS)
+                ),
+                field="spec.resources.accelerator.type",
+            )
+        ]
+
+    def _resources(self, sdk: Any, size_class: str, spec: EnvironmentSpec) -> Any:
+        """What the snapshot bakes in: a class's CPU, or the spec's GPU (§11.3 item 4, E2-17)."""
+        accelerator = spec.resources.accelerator
+        if size_class not in GPU_SIZE_CLASSES or accelerator == "none":
+            shape = _CPU_RESOURCES.get(size_class, _CPU_RESOURCES["small"])
+            return sdk.Resources(cpu=shape["cpu"], memory=shape["memory"], disk=shape["disk"])
+        # D-4 gives the GPU classes no CPU or memory of their own (E4-11 has
+        # them, for Datalayer's nodes): the GPU is what the class is for, and
+        # Daytona sizes the rest of the machine for it unless the spec hints.
+        hints = spec.resources.hints
+        return sdk.Resources(
+            cpu=round(hints.cpu) if hints.cpu else None,
+            memory=round(hints.memory_gi) if hints.memory_gi else None,
+            disk=round(hints.disk_gi) if hints.disk_gi else _GPU_DISK_GI,
+            gpu=accelerator.count,
+            gpu_type=sdk.GpuType(daytona_gpu(accelerator.type)),
+        )
 
     def _register_base_pull(self, client: Any, resolved_base: str) -> str | None:
         """A private registry entry for this build's base pull (D-17, D-18).
@@ -657,20 +682,29 @@ class Builder(ManagedBuilder):
                 "lock pinned, and an artifact carries neither",
                 detail={"variant": self.variant},
             )
-        from ..conformance import expected_packages, run_core_tier
+        from ..conformance import expected_packages, run_accelerator_check, run_core_tier
 
         snapshot = artifact.provider_artifact_id or artifact.immutable_reference
         sandbox = self._smoke_test_sandbox(snapshot)
         self._log(f"Launching {snapshot} to smoke-test it")
         try:
             sandbox.start()
-            return run_core_tier(
+            result = run_core_tier(
                 sandbox,
                 python_version=environment.spec.language.version,
                 expected_packages=expected_packages(environment, lock_text or ""),
                 secret_values=tuple(secret_values),
                 restart=lambda: self._restart(sandbox),
             )
+            accelerator = environment.spec.resources.accelerator
+            if accelerator != "none":
+                # A GPU version is only the version its spec describes when
+                # its GPUs are visible and its CUDA is the spec's (check 11,
+                # E2-17): the core tier alone passes on a machine with none.
+                result.checks.append(
+                    run_accelerator_check(sandbox, cuda=accelerator.cuda, count=accelerator.count)
+                )
+            return result
         except EnvironmentsError:
             raise
         except Exception as error:

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/environments/bases.py

@@ -59,6 +59,9 @@ class ApprovedBase(BaseModel):
     python_versions: tuple[str, ...]
     #: Whether the base carries CUDA, which a GPU size class requires.
     accelerator: bool = False
+    #: The CUDA toolkit the base pins, ``major.minor`` (E2-17): what a spec's
+    #: ``accelerator.cuda`` may ask for, and what check 11 reads back.
+    cuda: str | None = None
     #: Channel, then variant, to the digest resolution pins. A channel with no
     #: variant is approved and not yet published.
     channels: dict[str, dict[str, str]] = Field(default_factory=dict)
@@ -140,12 +143,23 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
             },
             snapshots={"2026.09": "20260916T120000Z"},
         ),
-        # E2-17: jupyter-python-cuda plus the same layer.
+        # E2-17: jupyter-python-cuda:0.3.1 (jupyter-python 0.2.2 and the CUDA
+        # 12.8 toolkit, pinned) plus the same layer, released 2026-09-18 to
+        # environments/base/python-cuda as `2026.09-bceb272088e4`. The doctor
+        # passes all fifteen checks and `nvcc` answers 12.8 without a GPU.
         ApprovedBase(
             ref="datalayer/python-cuda",
             python_versions=("3.13",),
             accelerator=True,
-            channels={"2026.09": {}},
+            cuda="12.8",
+            channels={
+                "2026.09": dict.fromkeys(
+                    ("datalayer", "e2b", "daytona", "modal"),
+                    "sha256:a6374a2d4ff07c8a8fe0a71ee605964f93319894cc4152c4e2a1af6258ac9e6a",
+                )
+            },
+            # After its CUDA layer's own `apt-get update`, which ran that day.
+            snapshots={"2026.09": "20260918T150000Z"},
         ),
     )
 }

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/environments/conformance.py

@@ -37,6 +37,7 @@ __all__ = [
     "cross_variant_packages",
     "drifted_from",
     "package_versions_of",
+    "run_accelerator_check",
     "run_conformance",
     "run_core_tier",
     "run_extended_tier",
@@ -487,7 +488,7 @@ def expected_packages(environment: Any, lock_text: str) -> dict[str, str]:
         return conda_expected_packages(dependency_file.content, lock_text or "")
     pinned = locked_versions(lock_text) if lock_text else {}
     names: list[str] = []
-    for text in environment.spec.packages.python.dependencies:
+    for text in _declared_dependencies(environment):
         try:
             names.append(canonicalize_name(Requirement(text).name))
         except InvalidRequirement:
@@ -495,6 +496,42 @@ def expected_packages(environment: Any, lock_text: str) -> dict[str, str]:
     return {name: pinned[name] for name in names if name in pinned}
 
 
+def _declared_dependencies(environment: Any) -> list[str]:
+    """The requirements a person declared, wherever the source keeps them.
+
+    A `dependencyFile` source names its packages in the file and leaves
+    `packages.python` empty, which is what the resolver reads too (E3-01).
+    Read from `packages.python` alone, check 5 was handed nothing for a
+    `requirements.txt` and passed for it, found live on 2026-09-18 (E3-08).
+    """
+    from .spec import parse_requirements_txt
+
+    build = environment.spec.build
+    dependency_file = build.dependency_file
+    if build.source == "dependencyFile" and dependency_file is not None:
+        if dependency_file.source_format == "requirements":
+            return parse_requirements_txt(dependency_file.content)
+        if dependency_file.source_format == "pyproject":
+            return _pyproject_dependencies(dependency_file.content)
+    return list(environment.spec.packages.python.dependencies)
+
+
+def _pyproject_dependencies(text: str) -> list[str]:
+    """`[project].dependencies` of a `pyproject.toml`, or none when it cannot be read."""
+    try:
+        import tomllib as toml
+    except ImportError:  # Python 3.10
+        try:
+            import tomli as toml  # type: ignore[no-redef]
+        except ImportError:
+            return []
+    try:
+        project = toml.loads(text).get("project") or {}
+    except toml.TOMLDecodeError:
+        return []
+    return [str(item) for item in project.get("dependencies") or []]
+
+
 def run_core_tier(
     sandbox: Sandbox,
     *,
@@ -560,30 +597,62 @@ def _egress(
     )
 
 
-def _gpu(sandbox: Sandbox, requested: bool, cuda: str | None, timeout: float | None) -> CheckResult:
+def _gpu(
+    sandbox: Sandbox,
+    requested: bool,
+    cuda: str | None,
+    timeout: float | None,
+    count: int = 1,
+) -> CheckResult:
+    """Check 11: the GPUs asked for are visible, and CUDA is the spec's.
+
+    Two CUDA versions are read, and they answer different questions. The
+    image's own toolkit (`nvcc`, or the base's `CUDA_VERSION`) is what the
+    spec's `accelerator.cuda` names and the base channel pins. `nvidia-smi`'s
+    "CUDA Version" is the newest CUDA the host's *driver* runs, which the
+    image does not choose: comparing the spec with it failed a correct image
+    on any newer driver (found on 2026-09-18, E2-17). The driver only has to
+    be new enough for the toolkit.
+    """
     if not requested:
         return _result(11, True, gating=False, detail="no accelerator was requested")
     body = (
-        "import re as _dl_re, subprocess as _dl_sp\n"
-        "_dl_out = {'returncode': None, 'gpus': [], 'cuda': None}\n"
+        "import os as _dl_os, re as _dl_re, shutil as _dl_sh, subprocess as _dl_sp\n"
+        "_dl_out = {'returncode': None, 'gpus': [], 'driver': None, 'cuda': None}\n"
         "try:\n"
         "    _dl_run = _dl_sp.run(['nvidia-smi'], capture_output=True, text=True, timeout=30)\n"
         "    _dl_out['returncode'] = _dl_run.returncode\n"
         "    _dl_match = _dl_re.search(r'CUDA Version:\\s*([0-9.]+)', _dl_run.stdout)\n"
-        "    _dl_out['cuda'] = _dl_match.group(1) if _dl_match else None\n"
+        "    _dl_out['driver'] = _dl_match.group(1) if _dl_match else None\n"
         "    _dl_names = _dl_sp.run(['nvidia-smi', '--query-gpu=name', '--format=csv,noheader'], "
         "capture_output=True, text=True, timeout=30)\n"
         "    _dl_out['gpus'] = [_dl_l.strip() for _dl_l in _dl_names.stdout.splitlines() "
         "if _dl_l.strip()]\n"
         "except (OSError, _dl_sp.SubprocessError) as _dl_error:\n"
         "    _dl_out['error'] = str(_dl_error)\n"
+        "try:\n"
+        "    _dl_nvcc = _dl_sh.which('nvcc') or '/usr/local/cuda/bin/nvcc'\n"
+        "    _dl_run = _dl_sp.run([_dl_nvcc, '--version'], capture_output=True, text=True, "
+        "timeout=30)\n"
+        "    _dl_match = _dl_re.search(r'release ([0-9.]+),', _dl_run.stdout)\n"
+        "    _dl_out['cuda'] = _dl_match.group(1) if _dl_match else None\n"
+        "except (OSError, _dl_sp.SubprocessError):\n"
+        "    pass\n"
+        "_dl_out['cuda'] = _dl_out['cuda'] or _dl_os.environ.get('CUDA_VERSION') or None\n"
     )
     answer = probe(sandbox, _code(11, body, "_dl_out"), timeout=timeout)
     problems = []
-    if answer.get("returncode") != 0 or not answer.get("gpus"):
+    gpus = answer.get("gpus") or []
+    if answer.get("returncode") != 0 or not gpus:
         problems.append("no GPU is visible")
-    if cuda and not str(answer.get("cuda") or "").startswith(cuda):
-        problems.append(f"CUDA is {answer.get('cuda')}, not {cuda}")
+    elif len(gpus) < count:
+        problems.append(f"{len(gpus)} GPU(s) visible, not the {count} asked for")
+    toolkit = str(answer.get("cuda") or "")
+    if cuda and not _version_is(toolkit, cuda):
+        problems.append(f"CUDA is {toolkit or None}, not {cuda}")
+    driver = str(answer.get("driver") or "")
+    if toolkit and driver and _version_tuple(driver) < _version_tuple(toolkit):
+        problems.append(f"the driver runs CUDA up to {driver}, older than the image's {toolkit}")
     # A GPU version gates on this (E2-17): a version that asked for an
     # accelerator and cannot see it, or sees the wrong CUDA, is not the
     # version its spec describes. A version that asked for none never
@@ -592,6 +661,31 @@ def _gpu(sandbox: Sandbox, requested: bool, cuda: str | None, timeout: float | N
     return _result(11, not problems, gating=True, detail="; ".join(problems) or None, actual=answer)
 
 
+def _version_tuple(version: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in re.findall(r"\d+", version))
+
+
+def _version_is(version: str, asked: str) -> bool:
+    """Whether `version` is what `asked` names: `12` and `12.8` both name 12.8.3."""
+    wanted = _version_tuple(asked)
+    return bool(wanted) and _version_tuple(version)[: len(wanted)] == wanted
+
+
+def run_accelerator_check(
+    sandbox: Sandbox,
+    *,
+    cuda: str | None = None,
+    count: int = 1,
+    timeout: float | None = 120.0,
+) -> CheckResult:
+    """Appendix B check 11 alone, gating, for a version that asked for an accelerator (E2-17).
+
+    What a builder's smoke test adds to the core tier for a GPU version: the
+    rest of the extended tier records, and this one decides.
+    """
+    return _guard(11, True, lambda: _gpu(sandbox, True, cuda, timeout, count))
+
+
 def _throughput(
     sandbox: Sandbox, contract: SandboxContract, minimum: float, timeout: float | None
 ) -> CheckResult:
@@ -658,6 +752,7 @@ def run_extended_tier(
     contract: SandboxContract = SANDBOX_CONTRACT_V1,
     accelerator_requested: bool = False,
     cuda_version: str | None = None,
+    accelerator_count: int = 1,
     egress_allowed: Sequence[str] = (),
     egress_blocked: Sequence[str] = (),
     cold_start_seconds: float | None = None,
@@ -675,7 +770,7 @@ def run_extended_tier(
         _guard(
             11,
             accelerator_requested,
-            lambda: _gpu(sandbox, accelerator_requested, cuda_version, timeout),
+            lambda: _gpu(sandbox, accelerator_requested, cuda_version, timeout, accelerator_count),
         ),
         _guard(12, False, lambda: _throughput(sandbox, contract, minimum_mib_per_second, timeout)),
         _guard(13, False, lambda: _cold_start(cold_start_seconds, cold_start_budget)),

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/environments/resolve.py

@@ -39,6 +39,7 @@ Where the solve runs is the :class:`ResolveRunner`'s business:
 from __future__ import annotations
 
 import hashlib
+import os
 import re
 import shlex
 import shutil
@@ -860,9 +861,38 @@ def locked_versions(lock_text: str) -> dict[str, str]:
         ]
         if len(pinned) == 1:
             versions[canonicalize_name(requirement.name)] = pinned[0]
+        elif requirement.url:
+            wheel = _wheel_version(requirement.name, requirement.url)
+            if wheel:
+                versions[canonicalize_name(requirement.name)] = wheel
     return versions
 
 
+def _wheel_version(name: str, url: str) -> str | None:
+    """The version of a direct reference to a wheel, read from its file name.
+
+    How a `pyproject` lock brings Datalayer's `jupyter-server` fork, which no
+    index serves (E3-08): `uv` records a hash only for a wheel it fetched by
+    URL, so the export pins it as `jupyter-server @ https://…whl`, with no
+    `==` for the version. The wheel's name carries one, and nothing else here
+    does. A reference that is not a wheel of the same distribution pins none.
+    """
+    from urllib.parse import unquote, urlsplit
+
+    from packaging.utils import InvalidWheelFilename, canonicalize_name, parse_wheel_filename
+
+    filename = unquote(urlsplit(url).path.rsplit("/", 1)[-1])
+    if not filename.endswith(".whl"):
+        return None
+    try:
+        wheel_name, version, _build, _tags = parse_wheel_filename(filename)
+    except InvalidWheelFilename:
+        return None
+    if wheel_name != canonicalize_name(name):
+        return None
+    return str(version)
+
+
 def apt_pins_in(lock_text: str) -> dict[str, str]:
     """The apt versions a lock records, by package.
 
@@ -1058,10 +1088,12 @@ def _verified_pyproject_lock(
         root = Path(directory)
         (root / "pyproject.toml").write_text(dependency_file.content, encoding="utf-8")
         (root / "uv.lock").write_text(dependency_file.lock_content, encoding="utf-8")
+        environment = _uv_environment(root)
         try:
             checked = invoke(
                 [resolved_uv, "lock", "--dry-run"],
                 cwd=root,
+                env=environment,
                 capture_output=True,
                 text=True,
                 timeout=timeout,
@@ -1109,6 +1141,7 @@ def _verified_pyproject_lock(
         exported = invoke(
             [resolved_uv, "export", "--locked", "--format", "requirements.txt"],
             cwd=root,
+            env=environment,
             capture_output=True,
             text=True,
             timeout=timeout,
@@ -1138,6 +1171,23 @@ def _verified_pyproject_lock(
     }
 
 
+def _uv_environment(root: Path) -> dict[str, str]:
+    """What `uv` checks a lock with: its cache in the scratch directory, and no downloads.
+
+    The durable worker runs as a user with no home, so `uv`'s default cache
+    under `~/.cache` could not be made, and neither could the interpreter it
+    downloads when none satisfies `requires-python` (found on 2026-09-18, E3-08).
+    The interpreter comes from the worker's image instead, where the base
+    channel's own Python is installed: a check that fetched one per resolve would
+    be a check that depends on the network in a way nothing records.
+    """
+    return {
+        **os.environ,
+        "UV_CACHE_DIR": str(root / ".uv-cache"),
+        "UV_PYTHON_DOWNLOADS": "never",
+    }
+
+
 def _refuse_unless_protected_pins_are_locked(packages: Mapping[str, str]) -> None:
     """A `pyproject` source is never merged with Datalayer's pins (E3-01):
     bringing your own lock is the point, so nothing is force-injected the

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/code_sandboxes/environments/spec.py

@@ -497,6 +497,12 @@ def _index_findings(field: str, url: str) -> list[SpecFinding]:
     return []
 
 
+def _same_cuda(asked: str, carried: str) -> bool:
+    """Whether a spec's CUDA names the base's: `12` and `12.8` both name 12.8."""
+    asked_parts = asked.strip().split(".")
+    return carried.strip().split(".")[: len(asked_parts)] == asked_parts
+
+
 def parse_requirements_txt(text: str) -> list[str]:
     """The requirement lines of a `requirements.txt`, comments and blanks dropped.
 
@@ -960,6 +966,18 @@ def spec_findings(
                 "spec.base.ref", f"`{base.ref}` has no CUDA; a GPU size class needs a CUDA base"
             )
         )
+    # The CUDA a spec asks for is the base's toolkit, which a channel pins
+    # (E2-17): a version that asks for another would build and then fail
+    # check 11 in every sandbox it starts.
+    cuda = resources.accelerator.cuda if wants_gpu else None
+    if cuda and base is not None and base.cuda and not _same_cuda(cuda, base.cuda):
+        findings.append(
+            SpecFinding(
+                "spec.resources.accelerator.cuda",
+                f"`{base.ref}` carries CUDA {base.cuda}, not {cuda}; ask for {base.cuda} "
+                "or leave `cuda` out",
+            )
+        )
 
     variants = spec.compatibility.variants
     if not variants.required:

{code_sandboxes-1.9.30 → code_sandboxes-1.9.32}/docs/docs/environments/specification.mdx

@@ -37,12 +37,12 @@ A document is refused with `DL_ENV_SPEC_INVALID` when a field is wrong, and with
 | `commands.postInstall` | none | At most 32 non-empty commands, run after the packages are installed. |
 | `buildSecrets` | none | `id` is a Datalayer secret id, `dlsec_...`; `mountAs` is `env` or `file`; `name` is the variable or file name. Ids and names are unique. Secrets are injected into the build step that needs them and never written into the artifact. |
 | `resources.sizeClass` | `small` | `small`, `medium`, `large`, `gpu-small` or `gpu-large`. A GPU class needs an accelerator and a CUDA base; an accelerator needs a GPU class. Datalayer runs no GPU nodes yet, so a GPU class is built for Modal and Daytona, which bring their own GPUs; E2B has none. |
-| `resources.accelerator` | `none` | `none`, or `type`, `count` and `cuda`. |
+| `resources.accelerator` | `none` | `none`, or `type`, `count` and `cuda`. `type` is the provider's own name for the GPU (Daytona: `H100`, `H200`, `RTX-PRO-6000`, `RTX-4090`, `RTX-5090`), and a GPU a variant does not offer is refused for it at `validate`. `cuda` is the base's toolkit: `datalayer/python-cuda:2026.09` carries 12.8, and another version is refused. |
 | `resources.hints` | none | `cpu`, `memoryGi`, `diskGi`: positive numbers, within the size class. |
 | `compatibility.variants.required` | `[datalayer]` | At least one of `datalayer`, `e2b`, `daytona`, `modal`. |
 | `compatibility.variants.optional` | none | The same variants, none of them also required. |
 | `compatibility.regions` | none | Region names. |
-| `build.source` | `packages` | `packages`, `dependencyFile` (a `requirements.txt`; a `pyproject.toml` whose own `uv.lock` is checked against Datalayer's protected pins and exported rather than re-resolved; or a conda `environment.yml`, resolved in its own `micromamba` solve into an explicit lock with the protected pins merged over its `pip:` layer) and `image` (an existing image from a bootstrap registry allowlist, replacing the approved base) all resolve on the Datalayer variant; `image` from a private registry, and `dockerfile`, are refused until they do. |
+| `build.source` | `packages` | `packages`; `dependencyFile` (a `requirements.txt`; a `pyproject.toml` whose own `uv.lock` is checked against Datalayer's protected pins and exported rather than re-resolved; or a conda `environment.yml`, resolved in its own `micromamba` solve into an explicit lock with the protected pins merged over its `pip:` layer); `dockerfile` (`build.dockerfile.content`, inline: its `FROM` names an approved base with its channel as the tag, which is what resolves, and what its own instructions install is not locked, as the lock's header says); and `image` (an existing image from a bootstrap registry allowlist, replacing the approved base). `packages`, a `requirements.txt`, a `pyproject.toml` with its `uv.lock`, a conda `environment.yml` and `dockerfile` build on the Datalayer and Daytona variants. A `pyproject.toml`'s `uv.lock` has to lock Datalayer's `jupyter-server` fork, which no package index serves: the project takes it by URL from [the fork's release](https://github.com/datalayer-externals/jupyter-server/releases/tag/v2.21.0-datalayer.1), in `[tool.uv.sources]`, which is also what makes `uv` record its hash. `image` resolves but does not yet start as a sandbox, because the imported image has no Datalayer runtime layer; `image` from a private registry, and a `COPY` from a Dockerfile's build context, are refused. |
 
 ## The spec digest