code-sandboxes 1.9.35__tar.gz → 1.9.36__tar.gz

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.35
+Version: 1.9.36
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.35"
+__version__ = "1.9.36"

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/code_sandboxes/environments/adapters/datalayer.py

@@ -76,6 +76,8 @@ from ..resolve import (
     WHEELHOUSE_PATH,
     apt_pins_in,
     apt_snapshot_in,
+    buildkit_proxy,
+    buildkit_proxy_options,
     locked_versions,
 )
 from ..resolve_conda import (
@@ -214,6 +216,11 @@ class Builder:
         importing this module needs no credentials.
     run
         How a subprocess is run, so a test can watch the argv without a daemon.
+    proxy
+        The build pool's egress proxy, as ``buildkitd`` reaches it (E1-06):
+        every step of the build goes through it. ``DATALAYER_BUILDKIT_PROXY``
+        by default; empty is a ``buildkitd`` whose steps reach the network
+        directly.
     """
 
     variant = "datalayer"
@@ -233,6 +240,7 @@ class Builder:
         run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
         max_build_seconds: int = DEFAULT_MAX_BUILD_SECONDS,
         resolve_secret: Callable[..., str] = resolve_build_secret,
+        proxy: str | None = None,
     ) -> None:
         self._log = log or (lambda _line: None)
         self._credential = credential
@@ -241,6 +249,8 @@ class Builder:
         self._tlscert = tlscert or os.environ.get("DATALAYER_BUILDKIT_TLSCERT", "").strip()
         self._tlskey = tlskey or os.environ.get("DATALAYER_BUILDKIT_TLSKEY", "").strip()
         self._tlscacert = tlscacert or os.environ.get("DATALAYER_BUILDKIT_TLSCACERT", "").strip()
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         self._region = region or os.environ.get("AWS_REGION", "us-east-1")
         self._ecr = ecr
         self._run = run or subprocess.run
@@ -530,6 +540,7 @@ class Builder:
                     "--metadata-file",
                     str(metadata),
                     *self._cache_options(request),
+                    *buildkit_proxy_options(self._proxy),
                     *secret_args,
                 ]
                 self._log(f"Building {reference} from {request.resolved_base}")

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/code_sandboxes/environments/adapters/modal.py

@@ -96,6 +96,15 @@ end and the container exited before that first real exec ever reached it.
 The entrypoint now execs `sleep infinity` when it is given no arguments,
 and `"$@"` when it is — correct either way a caller invokes it.
 
+**And a sandbox with no command is not given no arguments** (found live on
+2026-09-18): Modal keeps the base's own CMD, `start-jupyter.sh`, under the
+new ENTRYPOINT where Docker would reset it, so the main process was a
+Jupyter server, which exits within a minute and ends the sandbox. A smoke
+test's restarted sandbox, started warm, died between checks 8 and 9. The
+artifact now sets its CMD to `sleep infinity`, and `ModalSandbox` names the
+same command when it launches an artifact, which also covers the ones built
+before.
+
 **A GPU is a launch option on Modal, not part of the image** (section 11.4
 item 10, E2-17). A GPU version builds the same image any version does, on the
 CUDA base; the spec's `accelerator` names one of Modal's GPUs, checked at
@@ -206,6 +215,8 @@ _ENTRYPOINT_PATH = "/opt/datalayer/bin/entrypoint.sh"
 #: is given keeps it alive for that; `exec "$@"` still wins when something
 #: is, for a caller that does supply a command directly.
 _ENTRYPOINT_SCRIPT = '#!/bin/sh\nif [ "$#" -eq 0 ]; then exec sleep infinity; fi\nexec "$@"\n'
+#: The artifact's CMD: what a sandbox started with no command of its own runs.
+_KEEP_ALIVE_COMMAND = ("sleep", "infinity")
 
 
 def _modal_sdk() -> Any:
@@ -498,7 +509,19 @@ class Builder(ManagedBuilder):
                 for command in files_step(request.environment, variant=self.variant):
                     image = image.run_commands(command)
                 image = _post_install(image, spec.commands.post_install, declared, step_secrets)
-                image = image.workdir(_CONTENT_DIR).entrypoint([_ENTRYPOINT_PATH])
+                # The base's own CMD is `start-jupyter.sh`, and Modal keeps
+                # it under a new ENTRYPOINT where Docker would reset it: a
+                # sandbox started with no command ran a Jupyter server as its
+                # main process, which exits within a minute and takes the
+                # sandbox with it (found live on 2026-09-18, the restarted
+                # sandbox of a smoke test dying mid-tier). What holds the
+                # container is `sleep`; Jupyter is started by exec, when
+                # asked (`ModalSandbox.prepare_jupyter_server`).
+                image = (
+                    image.workdir(_CONTENT_DIR)
+                    .entrypoint([_ENTRYPOINT_PATH])
+                    .cmd(list(_KEEP_ALIVE_COMMAND))
+                )
 
                 logged: list[str] = []
                 buffer = io.StringIO()

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/code_sandboxes/environments/resolve.py

@@ -83,6 +83,7 @@ if TYPE_CHECKING:
 __all__ = [
     "APT_PIN_PREFIX",
     "APT_SNAPSHOT_PREFIX",
+    "BUILDKIT_PROXY_ENV",
     "CONSTRAINTS_PATH",
     "COVERAGE_PREFIX",
     "DOCKERFILE_COVERAGE",
@@ -98,6 +99,8 @@ __all__ = [
     "apt_pins",
     "apt_pins_in",
     "apt_snapshot_in",
+    "buildkit_proxy",
+    "buildkit_proxy_options",
     "lock_document",
     "locked_versions",
     "merge_requirements",
@@ -145,6 +148,46 @@ DOCKERFILE_COVERAGE = (
 APT_SNAPSHOT_PREFIX = "# datalayer-apt-snapshot: "
 _SNAPSHOT_ID = re.compile(r"^\d{8}T\d{6}Z$")
 
+#: Where a build's own steps reach the network through, when the build pool
+#: gives them nowhere else to go (E1-06): an HTTP proxy that allows only the
+#: package indexes, the snapshot mirrors and the registries. The address is
+#: the one `buildkitd` itself sees, since a step runs in its network.
+BUILDKIT_PROXY_ENV = "DATALAYER_BUILDKIT_PROXY"
+_PROXY_URL = re.compile(r"^http://[A-Za-z0-9.\-]+:\d{1,5}$")
+
+
+def buildkit_proxy(proxy: str | None = None) -> str:
+    """The proxy a build's steps go through: ``proxy``, or the environment's.
+
+    Empty is no proxy, which is what a `buildkitd` with open egress needs
+    (`plane local`'s own). Anything that is not ``http://host:port`` is
+    refused rather than handed to every package manager of every build.
+    """
+    value = (os.environ.get(BUILDKIT_PROXY_ENV, "") if proxy is None else proxy).strip()
+    if value and not _PROXY_URL.match(value):
+        raise ValueError(f"{BUILDKIT_PROXY_ENV} must be http://host:port, not {value!r}")
+    return value
+
+
+def buildkit_proxy_options(proxy: str) -> list[str]:
+    """The ``buildctl`` options that send a build's steps through ``proxy``.
+
+    The Dockerfile frontend predefines these build args: a ``RUN`` step sees
+    them without an ``ARG``, they never reach the image's config or history,
+    and they do not change a cache key. Both spellings, since ``apt`` and
+    ``curl`` read only the lower-case one for plain HTTP and ``uv``, ``pip``
+    and ``micromamba`` read either.
+    """
+    if not proxy:
+        return []
+    options: list[str] = []
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+        options += ["--opt", f"build-arg:{name}={proxy}"]
+    for name in ("NO_PROXY", "no_proxy"):
+        options += ["--opt", f"build-arg:{name}=127.0.0.1,localhost"]
+    return options
+
+
 #: How a protected pin is recorded in the lock.
 PROTECTED_PIN_PREFIX = "# datalayer-protected: "
 
@@ -623,8 +666,11 @@ class BuildkitResolveRunner:
         tlscacert: str | None = None,
         apt_snapshot: str = "",
         timeout: float = 900.0,
+        proxy: str | None = None,
     ) -> None:
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         #: The build pool's `buildkitd` takes mTLS connections only
         #: (PLAN_ENV.md E1-06); a plain-socket one, such as `plane local`'s
         #: own ephemeral daemon, needs none of these three. All or nothing,
@@ -761,6 +807,7 @@ class BuildkitResolveRunner:
                 f"dockerfile={root}",
                 "--output",
                 f"type=local,dest={out}",
+                *buildkit_proxy_options(self._proxy),
             ]
             say(f"Solving the lock in {request.base_reference}")
             try:

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/code_sandboxes/environments/resolve_conda.py

@@ -68,6 +68,8 @@ from .resolve import (
     WHEELHOUSE_PATH,
     MergedRequirements,
     ProtectedPin,
+    buildkit_proxy,
+    buildkit_proxy_options,
     merge_requirements,
 )
 
@@ -684,8 +686,11 @@ class BuildkitCondaResolveRunner:
         tlskey: str | None = None,
         tlscacert: str | None = None,
         timeout: float = 1200.0,
+        proxy: str | None = None,
     ) -> None:
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         self._tlscert = tlscert or ""
         self._tlskey = tlskey or ""
         self._tlscacert = tlscacert or ""
@@ -778,6 +783,7 @@ class BuildkitCondaResolveRunner:
                 f"dockerfile={root}",
                 "--output",
                 f"type=local,dest={out}",
+                *buildkit_proxy_options(self._proxy),
             ]
             say(f"Solving the conda lock in {request.base_reference}")
             try:

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/code_sandboxes/modal_sandbox.py

@@ -441,7 +441,16 @@ class ModalSandbox(Sandbox):
                 for mount_path, volume_id in self._volume_mounts.requested.items()
             }
 
-        self._sandbox = modal.Sandbox.create(**create_kwargs)
+        # An Environments artifact's main process only holds the container:
+        # everything this class runs in it is an exec, Jupyter included
+        # (`prepare_jupyter_server`). Named here rather than left to the
+        # image, since an artifact built before code-sandboxes 1.9.36 carries
+        # its base's `start-jupyter.sh` as its CMD, which Modal runs under the
+        # entrypoint; that server exits within a minute and ends the sandbox
+        # (found live on 2026-09-18: a smoke test's restarted sandbox died
+        # between checks 8 and 9).
+        command = ("sleep", "infinity") if self._image_id else ()
+        self._sandbox = modal.Sandbox.create(*command, **create_kwargs)
         self._volume_mounts.created()
         self._start_driver()
 

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/tests/test_environment_datalayer_builder.py

@@ -726,6 +726,27 @@ class TestBuildingAndPushing:
         a_builder(run=buildctl, tlscert="/certs/client/tls.crt").build(a_request())
         assert not any(arg.startswith("--tls") for arg in buildctl.argv)
 
+    def test_the_steps_go_through_the_pools_proxy(self, monkeypatch) -> None:
+        """The build pool lets a step reach the network only through its
+        proxy (E1-06), so every step is handed it, in both spellings."""
+        monkeypatch.setenv("DATALAYER_BUILDKIT_PROXY", "http://127.0.0.1:3128")
+        buildctl = Buildctl()
+        a_builder(run=buildctl).build(a_request())
+        for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+            assert f"build-arg:{name}=http://127.0.0.1:3128" in buildctl.argv
+        assert "build-arg:NO_PROXY=127.0.0.1,localhost" in buildctl.argv
+
+    def test_no_proxy_when_none_is_set(self, monkeypatch) -> None:
+        """A `buildkitd` whose steps reach the network directly needs none."""
+        monkeypatch.delenv("DATALAYER_BUILDKIT_PROXY", raising=False)
+        buildctl = Buildctl()
+        a_builder(run=buildctl).build(a_request())
+        assert not any("proxy" in arg.lower() for arg in buildctl.argv)
+
+    def test_a_proxy_that_is_not_http_host_port_is_refused(self) -> None:
+        with pytest.raises(ValueError, match="DATALAYER_BUILDKIT_PROXY"):
+            a_builder(proxy="socks5://127.0.0.1:1080")
+
     def test_the_docker_config_does_not_outlive_the_build(self) -> None:
         """A registry password base64'd into a file the worker keeps forever
         is a credential leak on disk, whichever way the build ends (found on

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/tests/test_environment_modal_builder.py

@@ -166,6 +166,10 @@ class FakeImage:
         self.calls.append(Call("entrypoint", (commands,)))
         return self
 
+    def cmd(self, command: list[str]) -> FakeImage:
+        self.calls.append(Call("cmd", (command,)))
+        return self
+
     def build(self, app: Any) -> FakeImage:
         self.calls.append(Call("build", (app,)))
         # Simulates Modal's own `enable_output()` printing straight to
@@ -601,14 +605,24 @@ class TestBuildingAnImage:
         [image] = modal.Image.created
         assert not any("doctor" in call.args[0] for call in calls_named(image, "run_commands"))
 
-    def test_the_chain_ends_with_workdir_then_entrypoint(self) -> None:
+    def test_the_chain_ends_with_workdir_entrypoint_and_cmd(self) -> None:
         modal = FakeModalModule()
         a_builder(modal=modal).build(a_request())
         [image] = modal.Image.created
-        # `build` is appended by `FakeImage.build` itself; the two before it
-        # are the chain's own last words.
+        # `build` is appended by `FakeImage.build` itself; the three before
+        # it are the chain's own last words.
         names = [call.name for call in image.calls]
-        assert names[-3:] == ["workdir", "entrypoint", "build"]
+        assert names[-4:] == ["workdir", "entrypoint", "cmd", "build"]
+
+    def test_the_bases_jupyter_cmd_is_replaced_by_sleep(self) -> None:
+        """Modal keeps the base's `start-jupyter.sh` under a new ENTRYPOINT,
+        and a Jupyter server as the main process exits and ends the sandbox
+        (found live on 2026-09-18). The artifact says what holds it."""
+        modal = FakeModalModule()
+        a_builder(modal=modal).build(a_request())
+        [image] = modal.Image.created
+        [cmd_call] = calls_named(image, "cmd")
+        assert cmd_call.args[0] == ["sleep", "infinity"]
 
     def test_the_entrypoint_execs_its_arguments(self) -> None:
         """A bare script path, nothing for `entrypoint()`'s own Dockerfile

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/tests/test_environment_resolve.py

@@ -1315,6 +1315,34 @@ class TestTheBuildkitRunner:
             )
         assert not any(arg.startswith("--tls") for arg in seen["argv"])
 
+    def test_the_solve_goes_through_the_pools_proxy(self, monkeypatch) -> None:
+        """The solve reaches the index the way a build does, through the
+        build pool's proxy (E1-06)."""
+        import subprocess as subprocess_module
+
+        from code_sandboxes.environments import resolve as resolve_module
+        from code_sandboxes.environments.resolve import BuildkitResolveRunner
+
+        seen: dict[str, list[str]] = {}
+
+        def fake_run(command, **kwargs):
+            seen["argv"] = list(command)
+            return subprocess_module.CompletedProcess(command, 1, "", "boom")
+
+        monkeypatch.setattr(resolve_module.subprocess, "run", fake_run)
+        with pytest.raises(EnvironmentsError):
+            BuildkitResolveRunner(buildctl="/usr/bin/true", proxy="http://127.0.0.1:3128").solve(
+                ResolveRequest(
+                    python_version="3.13",
+                    requirements=("ipykernel==7.3.0",),
+                    constraints=(),
+                    indexes=(),
+                    base_reference="environments/base/python-cpu@sha256:" + "11" * 32,
+                )
+            )
+        assert "build-arg:HTTPS_PROXY=http://127.0.0.1:3128" in seen["argv"]
+        assert "build-arg:https_proxy=http://127.0.0.1:3128" in seen["argv"]
+
     def test_it_refuses_a_base_that_is_not_pinned_by_digest(self) -> None:
         from code_sandboxes.environments.resolve import BuildkitResolveRunner
 

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/tests/test_environment_resolve_conda.py

@@ -370,6 +370,30 @@ class TestTheRunners:
             )
         assert caught.value.code.code == "DL_ENV_CAPABILITY_UNSUPPORTED"
 
+    def test_the_buildkit_runner_goes_through_the_pools_proxy(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        # The conda solve reaches its channels the way a build does, through
+        # the build pool's proxy (E1-06).
+        seen: dict[str, list[str]] = {}
+
+        def fake_run(argv: list[str], **kwargs: object) -> subprocess.CompletedProcess[str]:
+            seen["argv"] = list(argv)
+            return subprocess.CompletedProcess(argv, 1, stdout="", stderr="boom")
+
+        monkeypatch.setenv("DATALAYER_BUILDKIT_PROXY", "http://127.0.0.1:3128")
+        monkeypatch.setattr("code_sandboxes.environments.resolve_conda.subprocess.run", fake_run)
+        runner = BuildkitCondaResolveRunner(buildctl="/usr/bin/buildctl")
+        with pytest.raises(EnvironmentsError):
+            runner.solve(
+                CondaResolveRequest(
+                    environment_yml=A_YAML,
+                    python_version="3.13",
+                    base_reference="base@sha256:" + "11" * 32,
+                )
+            )
+        assert "build-arg:https_proxy=http://127.0.0.1:3128" in seen["argv"]
+
     def test_the_buildkit_runner_refuses_an_unpinned_base(self) -> None:
         runner = BuildkitCondaResolveRunner(buildctl="/usr/bin/buildctl")
         with pytest.raises(EnvironmentsError) as caught:

{code_sandboxes-1.9.35 → code_sandboxes-1.9.36}/tests/test_modal_google_colab_sandbox.py

@@ -493,6 +493,57 @@ def test_modal_start_forwards_gpu_flavor(monkeypatch):
     sandbox.stop()
 
 
+def test_an_environments_artifact_is_held_by_sleep_not_its_cmd(monkeypatch):
+    """An artifact's CMD may be its base's `start-jupyter.sh`, which exits and
+    ends the sandbox (found live on 2026-09-18): the launch names the command
+    that holds the container, and Jupyter is started by exec when asked."""
+
+    class _FakeApp:
+        pass
+
+    class _FakeSandboxObj:
+        object_id = "modal-object-id"
+
+        def exec(self, *_args, **_kwargs):
+            raise RuntimeError("no driver in this test")
+
+        def terminate(self):
+            return None
+
+        def detach(self):
+            return None
+
+    captured: dict = {}
+
+    class _FakeModal:
+        class App:
+            @staticmethod
+            def lookup(_name, create_if_missing=False):
+                return _FakeApp()
+
+        class Image:
+            @staticmethod
+            def from_id(image_id):
+                captured["image_id"] = image_id
+                return object()
+
+        class Sandbox:
+            @staticmethod
+            def create(*args, **kwargs):
+                captured["args"] = args
+                return _FakeSandboxObj()
+
+    monkeypatch.setitem(sys.modules, "modal", _FakeModal)
+
+    sandbox = ModalSandbox(config=SandboxConfig(timeout=10.0), image_id="im-artifact")
+    sandbox.start()
+
+    assert captured["image_id"] == "im-artifact"
+    assert captured["args"] == ("sleep", "infinity")
+
+    sandbox.stop()
+
+
 class _FakeExecSandbox:
     """Records what `_start_driver` asks `sandbox.exec` for, nothing more."""