code-sandboxes 1.9.34__tar.gz → 1.9.36__tar.gz

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/.github/workflows/environments-live.yml

@@ -4,18 +4,19 @@ name: Environments Live Matrix
 # providers, nightly (PLAN_ENV.md E2-11): a real, hash-verified lock, a real
 # build, a real launch, and the formal core tier — tests/test_environment_live_matrix.py.
 #
-# E2B and Modal carry their own already-documented, unticked gaps there
-# (E2-03's uid/gid mismatch; modal_sandbox.py's missing setpriv) and are
-# `xfail(strict=False)` in that file, so an ordinary failure there is
-# expected and does not fail this workflow. Daytona carries no such marker:
-# a failure there is a real regression, and this workflow opens (or
-# comments on) an issue naming it.
+# E2B carries its own documented, unticked gap there (E2-03: its services run
+# as root) and is `xfail(strict=False)` in that file, so an ordinary failure
+# there is expected and does not fail this workflow. Daytona and Modal carry
+# no such marker: a failure there is a real regression, and this workflow
+# opens (or comments on) an issue naming it.
 #
-# Needs, as repository secrets: E2B_API_KEY, DAYTONA_API_KEY, MODAL_TOKEN_ID,
-# MODAL_TOKEN_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY — the last two
-# scoped to read the approved base from ECR only (D-18). A secret that is
-# not set is not a workflow failure: the test each secret belongs to skips,
-# by name, and says so in the job summary.
+# Needs one repository secret, DATALAYER_API_KEY. The providers' keys are
+# Datalayer secrets of the account it belongs to, read at run time: E2B_API_KEY,
+# DAYTONA_API_KEY, MODAL_TOKEN_ID, MODAL_TOKEN_SECRET, and the AWS pair under
+# CODE_SANDBOXES_CI_AWS_ACCESS_KEY_ID and CODE_SANDBOXES_CI_AWS_SECRET_ACCESS_KEY,
+# a key of the base reader that can only pull the approved base from ECR (D-18).
+# A key that is not there skips the test it belongs to, by name, and the job
+# summary lists each leg's outcome; a Daytona leg that did not run fails the job.
 
 on:
   schedule:
@@ -55,6 +56,48 @@ jobs:
           uv pip install ".[e2b,daytona,modal,test]"
           uv pip install boto3
 
+      # Each value is masked before it reaches the job's environment, and none
+      # is set on a later step's own `env:`, which would override it with an
+      # empty string.
+      - name: Read the providers' keys from Datalayer
+        env:
+          DATALAYER_API_KEY: ${{ secrets.DATALAYER_API_KEY }}
+          DATALAYER_IAM_URL: https://prod1.datalayer.run
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          import urllib.request
+
+          key = os.environ.get("DATALAYER_API_KEY", "")
+          if not key:
+              print("DATALAYER_API_KEY is not a secret of this repository: every leg will skip")
+              raise SystemExit(0)
+          request = urllib.request.Request(
+              os.environ["DATALAYER_IAM_URL"] + "/api/iam/v1/secrets/values",
+              headers={"Authorization": f"Bearer {key}"},
+          )
+          with urllib.request.urlopen(request, timeout=60) as response:
+              secrets = json.load(response).get("secrets") or {}
+          wanted = {
+              "DAYTONA_API_KEY": "DAYTONA_API_KEY",
+              "E2B_API_KEY": "E2B_API_KEY",
+              "MODAL_TOKEN_ID": "MODAL_TOKEN_ID",
+              "MODAL_TOKEN_SECRET": "MODAL_TOKEN_SECRET",
+              "AWS_ACCESS_KEY_ID": "CODE_SANDBOXES_CI_AWS_ACCESS_KEY_ID",
+              "AWS_SECRET_ACCESS_KEY": "CODE_SANDBOXES_CI_AWS_SECRET_ACCESS_KEY",
+          }
+          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as environment:
+              for variable, name in wanted.items():
+                  value = str(secrets.get(name) or "")
+                  if not value or "\n" in value:
+                      print(f"{variable}: no Datalayer secret {name} for this account")
+                      continue
+                  print(f"::add-mask::{value}")
+                  environment.write(f"{variable}={value}\n")
+                  print(f"{variable}: read from the Datalayer secret {name}")
+          PY
+
       - name: Configure AWS credentials
         run: |
           mkdir -p ~/.aws
@@ -63,9 +106,6 @@ jobs:
             echo "aws_access_key_id=${AWS_ACCESS_KEY_ID}"
             echo "aws_secret_access_key=${AWS_SECRET_ACCESS_KEY}"
           } > ~/.aws/credentials
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
       - name: Run the live matrix
         id: live
@@ -75,13 +115,51 @@ jobs:
             tests/test_environment_live_matrix.py \
             --junitxml=live-matrix-results.xml
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: us-east-1
-          E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
-          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
-          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
-          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+
+      # A leg whose secret is not set skips, and a run where every leg skipped
+      # reported success in under a second: the nightly was green every night
+      # while it tested nothing (found on 2026-09-18, "3 skipped in 0.61s").
+      # Each leg's outcome goes in the job summary, and a Daytona leg that did
+      # not run fails the job: it is the one this matrix is required to prove
+      # (PLAN_ENV.md, the Datalayer and Daytona target, E2-11).
+      - name: Say which legs ran, and refuse a Daytona leg that did not
+        if: always()
+        run: |
+          python - <<'PY'
+          import os
+          import sys
+          import xml.etree.ElementTree as ET
+
+          try:
+              cases = list(ET.parse("live-matrix-results.xml").getroot().iter("testcase"))
+          except (OSError, ET.ParseError) as error:
+              sys.exit(f"no JUnit report to read: {error}")
+          rows, daytona = [], None
+          for case in cases:
+              leg = (case.get("classname") or "").rsplit(".", 1)[-1]
+              skipped = case.find("skipped")
+              if skipped is not None:
+                  outcome = "skipped: " + (skipped.get("message") or "").strip()
+              elif case.find("failure") is not None or case.find("error") is not None:
+                  outcome = "failed"
+              else:
+                  outcome = "passed"
+              rows.append(f"| {leg} | {outcome} |")
+              if leg == "TestDaytona":
+                  daytona = outcome
+          summary = "| Leg | Outcome |\n|---|---|\n" + "\n".join(rows) + "\n"
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as handle:
+              handle.write(summary)
+          print(summary)
+          if daytona is None or daytona.startswith("skipped"):
+              sys.exit(
+                  f"The Daytona leg did not run ({daytona or 'absent'}): it is the one this "
+                  "matrix must prove, so a run without it is not a green run. Set the "
+                  "DATALAYER_API_KEY repository secret, whose account holds the "
+                  "DAYTONA_API_KEY and CODE_SANDBOXES_CI_AWS_* Datalayer secrets."
+              )
+          PY
 
       - name: Upload the JUnit report
         if: always()

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.34
+Version: 1.9.36
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.34"
+__version__ = "1.9.36"

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/code_sandboxes/environments/adapters/datalayer.py

@@ -76,6 +76,8 @@ from ..resolve import (
     WHEELHOUSE_PATH,
     apt_pins_in,
     apt_snapshot_in,
+    buildkit_proxy,
+    buildkit_proxy_options,
     locked_versions,
 )
 from ..resolve_conda import (
@@ -214,6 +216,11 @@ class Builder:
         importing this module needs no credentials.
     run
         How a subprocess is run, so a test can watch the argv without a daemon.
+    proxy
+        The build pool's egress proxy, as ``buildkitd`` reaches it (E1-06):
+        every step of the build goes through it. ``DATALAYER_BUILDKIT_PROXY``
+        by default; empty is a ``buildkitd`` whose steps reach the network
+        directly.
     """
 
     variant = "datalayer"
@@ -233,6 +240,7 @@ class Builder:
         run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
         max_build_seconds: int = DEFAULT_MAX_BUILD_SECONDS,
         resolve_secret: Callable[..., str] = resolve_build_secret,
+        proxy: str | None = None,
     ) -> None:
         self._log = log or (lambda _line: None)
         self._credential = credential
@@ -241,6 +249,8 @@ class Builder:
         self._tlscert = tlscert or os.environ.get("DATALAYER_BUILDKIT_TLSCERT", "").strip()
         self._tlskey = tlskey or os.environ.get("DATALAYER_BUILDKIT_TLSKEY", "").strip()
         self._tlscacert = tlscacert or os.environ.get("DATALAYER_BUILDKIT_TLSCACERT", "").strip()
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         self._region = region or os.environ.get("AWS_REGION", "us-east-1")
         self._ecr = ecr
         self._run = run or subprocess.run
@@ -530,6 +540,7 @@ class Builder:
                     "--metadata-file",
                     str(metadata),
                     *self._cache_options(request),
+                    *buildkit_proxy_options(self._proxy),
                     *secret_args,
                 ]
                 self._log(f"Building {reference} from {request.resolved_base}")

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/code_sandboxes/environments/adapters/modal.py

@@ -96,13 +96,20 @@ end and the container exited before that first real exec ever reached it.
 The entrypoint now execs `sleep infinity` when it is given no arguments,
 and `"$@"` when it is — correct either way a caller invokes it.
 
-**A GPU size class is left buildable at `validate()`,** matching an existing
-test (`test_a_gpu_spec_is_buildable_on_modal_and_daytona`), and refused at
-`build()` instead, naming E2-17 — the same reasoning as Daytona's: the CUDA
-base is not published yet, so this cannot be reached in practice, and this
-builder does not know the launch-time `gpu=` argument to hand a size class
-either (D-20 leaves that to a later item; a GPU is Modal's own launch
-option, not an image property, per section 11.4 item 10).
+**And a sandbox with no command is not given no arguments** (found live on
+2026-09-18): Modal keeps the base's own CMD, `start-jupyter.sh`, under the
+new ENTRYPOINT where Docker would reset it, so the main process was a
+Jupyter server, which exits within a minute and ends the sandbox. A smoke
+test's restarted sandbox, started warm, died between checks 8 and 9. The
+artifact now sets its CMD to `sleep infinity`, and `ModalSandbox` names the
+same command when it launches an artifact, which also covers the ones built
+before.
+
+**A GPU is a launch option on Modal, not part of the image** (section 11.4
+item 10, E2-17). A GPU version builds the same image any version does, on the
+CUDA base; the spec's `accelerator` names one of Modal's GPUs, checked at
+`validate`, and the smoke test launches the image on it (`gpu="T4"`,
+`"H100:2"`) and adds check 11 to the core tier.
 
 **A build secret is attached to the `postInstall` steps that name it (E3-05).**
 `run_commands` takes a per-step `secrets=` collection, a mechanism E2B and
@@ -149,14 +156,42 @@ from ..files import files_step
 from ..redact import redact
 from ..resolve import WHEELHOUSE_IMAGE_PATH, apt_pins_in
 from ..resolve_conda import conda_lock_pip_requirements, is_conda_lock
-from ..spec import GPU_SIZE_CLASSES, BuildSecret, Environment, command_names_secret
+from ..spec import BuildSecret, Environment, command_names_secret
 from .managed import ManagedBuilder
 
-__all__ = ["UNIMPLEMENTED_INSTRUCTIONS", "Builder"]
+__all__ = ["MODAL_GPUS", "UNIMPLEMENTED_INSTRUCTIONS", "Builder", "modal_gpu"]
 
 #: What Modal's own Dockerfile builder does not implement (§6).
 UNIMPLEMENTED_INSTRUCTIONS = ("ONBUILD", "STOPSIGNAL", "VOLUME")
 
+#: The GPUs a Modal sandbox takes by name (E2-17), as its `gpu=` spells them.
+MODAL_GPUS: tuple[str, ...] = (
+    "T4",
+    "L4",
+    "A10G",
+    "L40S",
+    "A100",
+    "A100-40GB",
+    "A100-80GB",
+    "H100",
+    "H200",
+    "B200",
+)
+
+
+def modal_gpu(accelerator_type: str, count: int = 1) -> str | None:
+    """Modal's `gpu=` for an accelerator, or `None` when Modal has no such GPU.
+
+    `t4` and `a100_80gb` name what Modal calls `T4` and `A100-80GB`, and a
+    count above one is Modal's `"H100:2"`. An `RTX-4090` is Daytona's
+    vocabulary, not Modal's.
+    """
+    name = accelerator_type.strip().upper().replace("_", "-")
+    if name not in MODAL_GPUS:
+        return None
+    return f"{name}:{count}" if count > 1 else name
+
+
 #: `uv`, pinned the same way every other builder's bootstrap is (E1-04/E3-04).
 _UV_VERSION = "0.12.11"
 
@@ -180,6 +215,8 @@ _ENTRYPOINT_PATH = "/opt/datalayer/bin/entrypoint.sh"
 #: is given keeps it alive for that; `exec "$@"` still wins when something
 #: is, for a caller that does supply a command directly.
 _ENTRYPOINT_SCRIPT = '#!/bin/sh\nif [ "$#" -eq 0 ]; then exec sleep infinity; fi\nexec "$@"\n'
+#: The artifact's CMD: what a sandbox started with no command of its own runs.
+_KEEP_ALIVE_COMMAND = ("sleep", "infinity")
 
 
 def _modal_sdk() -> Any:
@@ -269,7 +306,10 @@ def _intermediates_of(built: Any) -> tuple[str, ...]:
             if hasattr(dependency, "deps"):
                 walk(dependency)
         object_id = getattr(image, "object_id", None)
-        if object_id and image is not built:
+        # Only images: the build's ECR secret is in `deps()` too, and has an
+        # `st-` id `ImageDelete` refuses ("not a valid Image ID", found live
+        # on 2026-09-18). It is deleted by the build itself, as a secret.
+        if object_id and image is not built and str(object_id).startswith("im-"):
             found.append(str(object_id))
 
     try:
@@ -393,6 +433,18 @@ class Builder(ManagedBuilder):
                         field=f"spec.buildSecrets[{index}].mountAs",
                     )
                 )
+        accelerator = environment.spec.resources.accelerator
+        if accelerator != "none" and modal_gpu(accelerator.type) is None:
+            findings.append(
+                CapabilityFinding(
+                    code="DL_ENV_CAPABILITY_UNSUPPORTED",
+                    message=(
+                        f"Modal has no GPU called `{accelerator.type}`; it offers "
+                        + ", ".join(MODAL_GPUS)
+                    ),
+                    field="spec.resources.accelerator.type",
+                )
+            )
         return findings
 
     # -- Building -------------------------------------------------------------
@@ -406,18 +458,6 @@ class Builder(ManagedBuilder):
         launch, not here, for the same reason.
         """
         spec = request.environment.spec
-        if request.size_class in GPU_SIZE_CLASSES:
-            # `validate` leaves a GPU class buildable (`gpu = True`, D-20):
-            # the CUDA base E2-17 has not published yet, so this cannot be
-            # reached in practice — refused plainly here rather than
-            # guessing at the launch-time `gpu=` argument this class needs
-            # (section 11.4 item 10 is a launch concern, not a build one).
-            raise EnvironmentsError(
-                CAPABILITY_UNSUPPORTED,
-                f"Modal runs `{request.size_class}` on its own GPUs, but the CUDA base this "
-                "needs is E2-17's, not built yet",
-                detail={"variant": self.variant, "missing": "E2-17"},
-            )
         # Resolved before Modal is touched: a secret IAM will not give stops
         # the build with nothing to clean up in the owner's workspace.
         declared, values = self._resolved_secrets(request)
@@ -469,7 +509,19 @@ class Builder(ManagedBuilder):
                 for command in files_step(request.environment, variant=self.variant):
                     image = image.run_commands(command)
                 image = _post_install(image, spec.commands.post_install, declared, step_secrets)
-                image = image.workdir(_CONTENT_DIR).entrypoint([_ENTRYPOINT_PATH])
+                # The base's own CMD is `start-jupyter.sh`, and Modal keeps
+                # it under a new ENTRYPOINT where Docker would reset it: a
+                # sandbox started with no command ran a Jupyter server as its
+                # main process, which exits within a minute and takes the
+                # sandbox with it (found live on 2026-09-18, the restarted
+                # sandbox of a smoke test dying mid-tier). What holds the
+                # container is `sleep`; Jupyter is started by exec, when
+                # asked (`ModalSandbox.prepare_jupyter_server`).
+                image = (
+                    image.workdir(_CONTENT_DIR)
+                    .entrypoint([_ENTRYPOINT_PATH])
+                    .cmd(list(_KEEP_ALIVE_COMMAND))
+                )
 
                 logged: list[str] = []
                 buffer = io.StringIO()
@@ -717,11 +769,13 @@ class Builder(ManagedBuilder):
             )
         from ...modal_sandbox import ModalSandbox
         from ...models import SandboxConfig
-        from ..conformance import expected_packages, run_core_tier
+        from ..conformance import expected_packages, run_accelerator_check, run_core_tier
 
         sdk = self._modal_sdk()
+        accelerator = environment.spec.resources.accelerator
+        gpu = None if accelerator == "none" else modal_gpu(accelerator.type, accelerator.count)
         sandbox = ModalSandbox(
-            config=SandboxConfig(name=f"smoke-{artifact.provider_artifact_id}"),
+            config=SandboxConfig(name=f"smoke-{artifact.provider_artifact_id}", gpu=gpu),
             app_name=f"dl-{environment.metadata.name}",
             image_id=artifact.provider_artifact_id,
             client=self._client(sdk),
@@ -729,13 +783,21 @@ class Builder(ManagedBuilder):
         self._log(f"Launching {artifact.provider_artifact_id} to smoke-test it")
         try:
             sandbox.start()
-            return run_core_tier(
+            result = run_core_tier(
                 sandbox,
                 python_version=environment.spec.language.version,
                 expected_packages=expected_packages(environment, lock_text or ""),
                 secret_values=tuple(secret_values),
                 restart=lambda: self._restart(sandbox),
             )
+            if gpu is not None:
+                # The core tier passes on a machine with no GPU: a GPU version
+                # is the version its spec describes only when its GPUs are
+                # visible and its CUDA is the spec's (check 11, E2-17).
+                result.checks.append(
+                    run_accelerator_check(sandbox, cuda=accelerator.cuda, count=accelerator.count)
+                )
+            return result
         except EnvironmentsError:
             raise
         except Exception as error:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/code_sandboxes/environments/resolve.py

@@ -83,6 +83,7 @@ if TYPE_CHECKING:
 __all__ = [
     "APT_PIN_PREFIX",
     "APT_SNAPSHOT_PREFIX",
+    "BUILDKIT_PROXY_ENV",
     "CONSTRAINTS_PATH",
     "COVERAGE_PREFIX",
     "DOCKERFILE_COVERAGE",
@@ -98,6 +99,8 @@ __all__ = [
     "apt_pins",
     "apt_pins_in",
     "apt_snapshot_in",
+    "buildkit_proxy",
+    "buildkit_proxy_options",
     "lock_document",
     "locked_versions",
     "merge_requirements",
@@ -145,6 +148,46 @@ DOCKERFILE_COVERAGE = (
 APT_SNAPSHOT_PREFIX = "# datalayer-apt-snapshot: "
 _SNAPSHOT_ID = re.compile(r"^\d{8}T\d{6}Z$")
 
+#: Where a build's own steps reach the network through, when the build pool
+#: gives them nowhere else to go (E1-06): an HTTP proxy that allows only the
+#: package indexes, the snapshot mirrors and the registries. The address is
+#: the one `buildkitd` itself sees, since a step runs in its network.
+BUILDKIT_PROXY_ENV = "DATALAYER_BUILDKIT_PROXY"
+_PROXY_URL = re.compile(r"^http://[A-Za-z0-9.\-]+:\d{1,5}$")
+
+
+def buildkit_proxy(proxy: str | None = None) -> str:
+    """The proxy a build's steps go through: ``proxy``, or the environment's.
+
+    Empty is no proxy, which is what a `buildkitd` with open egress needs
+    (`plane local`'s own). Anything that is not ``http://host:port`` is
+    refused rather than handed to every package manager of every build.
+    """
+    value = (os.environ.get(BUILDKIT_PROXY_ENV, "") if proxy is None else proxy).strip()
+    if value and not _PROXY_URL.match(value):
+        raise ValueError(f"{BUILDKIT_PROXY_ENV} must be http://host:port, not {value!r}")
+    return value
+
+
+def buildkit_proxy_options(proxy: str) -> list[str]:
+    """The ``buildctl`` options that send a build's steps through ``proxy``.
+
+    The Dockerfile frontend predefines these build args: a ``RUN`` step sees
+    them without an ``ARG``, they never reach the image's config or history,
+    and they do not change a cache key. Both spellings, since ``apt`` and
+    ``curl`` read only the lower-case one for plain HTTP and ``uv``, ``pip``
+    and ``micromamba`` read either.
+    """
+    if not proxy:
+        return []
+    options: list[str] = []
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+        options += ["--opt", f"build-arg:{name}={proxy}"]
+    for name in ("NO_PROXY", "no_proxy"):
+        options += ["--opt", f"build-arg:{name}=127.0.0.1,localhost"]
+    return options
+
+
 #: How a protected pin is recorded in the lock.
 PROTECTED_PIN_PREFIX = "# datalayer-protected: "
 
@@ -623,8 +666,11 @@ class BuildkitResolveRunner:
         tlscacert: str | None = None,
         apt_snapshot: str = "",
         timeout: float = 900.0,
+        proxy: str | None = None,
     ) -> None:
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         #: The build pool's `buildkitd` takes mTLS connections only
         #: (PLAN_ENV.md E1-06); a plain-socket one, such as `plane local`'s
         #: own ephemeral daemon, needs none of these three. All or nothing,
@@ -761,6 +807,7 @@ class BuildkitResolveRunner:
                 f"dockerfile={root}",
                 "--output",
                 f"type=local,dest={out}",
+                *buildkit_proxy_options(self._proxy),
             ]
             say(f"Solving the lock in {request.base_reference}")
             try:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/code_sandboxes/environments/resolve_conda.py

@@ -68,6 +68,8 @@ from .resolve import (
     WHEELHOUSE_PATH,
     MergedRequirements,
     ProtectedPin,
+    buildkit_proxy,
+    buildkit_proxy_options,
     merge_requirements,
 )
 
@@ -684,8 +686,11 @@ class BuildkitCondaResolveRunner:
         tlskey: str | None = None,
         tlscacert: str | None = None,
         timeout: float = 1200.0,
+        proxy: str | None = None,
     ) -> None:
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         self._tlscert = tlscert or ""
         self._tlskey = tlskey or ""
         self._tlscacert = tlscacert or ""
@@ -778,6 +783,7 @@ class BuildkitCondaResolveRunner:
                 f"dockerfile={root}",
                 "--output",
                 f"type=local,dest={out}",
+                *buildkit_proxy_options(self._proxy),
             ]
             say(f"Solving the conda lock in {request.base_reference}")
             try:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/code_sandboxes/modal_sandbox.py

@@ -441,7 +441,16 @@ class ModalSandbox(Sandbox):
                 for mount_path, volume_id in self._volume_mounts.requested.items()
             }
 
-        self._sandbox = modal.Sandbox.create(**create_kwargs)
+        # An Environments artifact's main process only holds the container:
+        # everything this class runs in it is an exec, Jupyter included
+        # (`prepare_jupyter_server`). Named here rather than left to the
+        # image, since an artifact built before code-sandboxes 1.9.36 carries
+        # its base's `start-jupyter.sh` as its CMD, which Modal runs under the
+        # entrypoint; that server exits within a minute and ends the sandbox
+        # (found live on 2026-09-18: a smoke test's restarted sandbox died
+        # between checks 8 and 9).
+        command = ("sleep", "infinity") if self._image_id else ()
+        self._sandbox = modal.Sandbox.create(*command, **create_kwargs)
         self._volume_mounts.created()
         self._start_driver()
 

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/pyproject.toml

@@ -105,6 +105,10 @@ filterwarnings = [
   # use of the client in a test became an exception. It took the live matrix
   # against a real Datalayer sandbox down before the sandbox was reached.
   "module:Datalayer is migrating its paths to use standard platformdirs:DeprecationWarning",
+  # The Daytona SDK (0.205) reads its own deprecated `DaytonaConfig.server_url`
+  # inside `Daytona(config)`: with `error` in force, every live Daytona test
+  # failed before reaching Daytona, and a nightly that skipped hid it.
+  "ignore:`server_url` is deprecated:DeprecationWarning",
 ]
 
 [tool.mypy]

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/tests/test_environment_builders.py

@@ -326,10 +326,10 @@ def test_files_and_contents_build_are_baked_together() -> None:
 
 
 def test_a_contents_build_entry_without_its_digest_will_not_parse() -> None:
-    with pytest.raises(Exception):
-        environment(
-            contents_build=[{"source": "https://data.example/x", "path": "/opt/x"}]
-        )
+    with pytest.raises(EnvironmentsError) as raised:
+        environment(contents_build=[{"source": "https://data.example/x", "path": "/opt/x"}])
+    assert raised.value.code.code == "DL_ENV_SPEC_INVALID"
+    assert "sha256" in raised.value.message
 
 
 def test_the_neutral_modules_import_no_provider_sdk() -> None:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/tests/test_environment_contract.py

@@ -163,9 +163,7 @@ def test_a_plain_build_context_passes() -> None:
         ),
     ],
 )
-def test_a_forbidden_context_member_is_refused(
-    entry: BuildContextEntry, message: str
-) -> None:
+def test_a_forbidden_context_member_is_refused(entry: BuildContextEntry, message: str) -> None:
     findings = validate_build_context([entry])
     assert any(finding.message == message for finding in findings), findings
     with pytest.raises(EnvironmentsError) as refused:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/tests/test_environment_datalayer_builder.py

@@ -726,6 +726,27 @@ class TestBuildingAndPushing:
         a_builder(run=buildctl, tlscert="/certs/client/tls.crt").build(a_request())
         assert not any(arg.startswith("--tls") for arg in buildctl.argv)
 
+    def test_the_steps_go_through_the_pools_proxy(self, monkeypatch) -> None:
+        """The build pool lets a step reach the network only through its
+        proxy (E1-06), so every step is handed it, in both spellings."""
+        monkeypatch.setenv("DATALAYER_BUILDKIT_PROXY", "http://127.0.0.1:3128")
+        buildctl = Buildctl()
+        a_builder(run=buildctl).build(a_request())
+        for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+            assert f"build-arg:{name}=http://127.0.0.1:3128" in buildctl.argv
+        assert "build-arg:NO_PROXY=127.0.0.1,localhost" in buildctl.argv
+
+    def test_no_proxy_when_none_is_set(self, monkeypatch) -> None:
+        """A `buildkitd` whose steps reach the network directly needs none."""
+        monkeypatch.delenv("DATALAYER_BUILDKIT_PROXY", raising=False)
+        buildctl = Buildctl()
+        a_builder(run=buildctl).build(a_request())
+        assert not any("proxy" in arg.lower() for arg in buildctl.argv)
+
+    def test_a_proxy_that_is_not_http_host_port_is_refused(self) -> None:
+        with pytest.raises(ValueError, match="DATALAYER_BUILDKIT_PROXY"):
+            a_builder(proxy="socks5://127.0.0.1:1080")
+
     def test_the_docker_config_does_not_outlive_the_build(self) -> None:
         """A registry password base64'd into a file the worker keeps forever
         is a credential leak on disk, whichever way the build ends (found on

{code_sandboxes-1.9.34 → code_sandboxes-1.9.36}/tests/test_environment_live_matrix.py

@@ -243,25 +243,12 @@ class TestDaytona:
 
 
 class TestModal:
-    """`xfail(strict=False)`: checks 5 (imports) and 6 (filesystem) fail —
-    confirmed live, 2026-09-13, the session driver refusing to start
-    against a sandbox that reports itself already shutting down, while 1,
-    2, 3, 4, 7, 8 and 9 all pass. This used to be attributed to the
-    identity gap (checks 1/2 failed too, then) — closed since, live: a
-    contract-built artifact's `ModalSandbox` now drops its driver to
-    `1000:100` (`_start_driver`, gated on `image_id` so a plain
-    `ModalSandbox` is unaffected), and checks 1/2 pass with it. 5/6 turned
-    out to be a separate, still-unexplained issue: a plain, non-Environments
-    `ModalSandbox` runs several sequential snippets with no trouble at all
-    over the same span, so this is specific to a contract-built artifact's
-    image under repeated `exec`. An `XPASS` here means that's closed too."""
+    """No `xfail` since 2026-09-18: a real artifact, built by the production
+    builder and launched by image id, passes all nine checks, check 9 included
+    with a secret to scan for, right after check 8. The break recorded under
+    E2-05 (the exec channel gone after check 8) no longer reproduces; the
+    kernel-restart fix of 1.9.28, check 7's own path, is the likeliest cause."""
 
-    @pytest.mark.xfail(
-        reason="checks 5 and 6 fail on a session driver restart the sandbox refuses, "
-        "specific to a contract-built artifact and not yet root-caused (identity, "
-        "checks 1 and 2, is fixed)",
-        strict=False,
-    )
     def test_build_launch_and_the_core_tier(self, real_lock: tuple[str, str]) -> None:
         _skip_unless_available("modal")
         import modal