code-sandboxes 1.9.35__tar.gz → 1.9.37__tar.gz

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.35
+Version: 1.9.37
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.35"
+__version__ = "1.9.37"

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/code_sandboxes/environments/adapters/datalayer.py

@@ -76,6 +76,11 @@ from ..resolve import (
     WHEELHOUSE_PATH,
     apt_pins_in,
     apt_snapshot_in,
+    buildkit_proxy,
+    buildkit_proxy_options,
+    egress_findings,
+    egress_hosts_text,
+    egress_refused_hosts,
     locked_versions,
 )
 from ..resolve_conda import (
@@ -214,6 +219,11 @@ class Builder:
         importing this module needs no credentials.
     run
         How a subprocess is run, so a test can watch the argv without a daemon.
+    proxy
+        The build pool's egress proxy, as ``buildkitd`` reaches it (E1-06):
+        every step of the build goes through it. ``DATALAYER_BUILDKIT_PROXY``
+        by default; empty is a ``buildkitd`` whose steps reach the network
+        directly.
     """
 
     variant = "datalayer"
@@ -233,6 +243,7 @@ class Builder:
         run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
         max_build_seconds: int = DEFAULT_MAX_BUILD_SECONDS,
         resolve_secret: Callable[..., str] = resolve_build_secret,
+        proxy: str | None = None,
     ) -> None:
         self._log = log or (lambda _line: None)
         self._credential = credential
@@ -241,6 +252,8 @@ class Builder:
         self._tlscert = tlscert or os.environ.get("DATALAYER_BUILDKIT_TLSCERT", "").strip()
         self._tlskey = tlskey or os.environ.get("DATALAYER_BUILDKIT_TLSKEY", "").strip()
         self._tlscacert = tlscacert or os.environ.get("DATALAYER_BUILDKIT_TLSCACERT", "").strip()
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         self._region = region or os.environ.get("AWS_REGION", "us-east-1")
         self._ecr = ecr
         self._run = run or subprocess.run
@@ -530,11 +543,30 @@ class Builder:
                     "--metadata-file",
                     str(metadata),
                     *self._cache_options(request),
+                    *buildkit_proxy_options(self._proxy),
                     *secret_args,
                 ]
                 self._log(f"Building {reference} from {request.resolved_base}")
                 finished = self._invoke(command, timeout=self._max_build_seconds)
             if finished.returncode != 0:
+                refused = egress_refused_hosts(finished.stderr or "", proxy=self._proxy)
+                if refused:
+                    # The one failure a log line hid best: a host the build
+                    # pool may not reach, named as a finding (E2-19).
+                    raise EnvironmentsError(
+                        BUILD_FAILED,
+                        f"The build pool's egress proxy refused {egress_hosts_text(refused)}: "
+                        "a build reaches only the package indexes, mirrors and registries "
+                        "the build pool allows. Put what it fetches in the build, or ask "
+                        "for the host to be allowed",
+                        detail={
+                            "variant": self.variant,
+                            "reference": reference,
+                            "exit": finished.returncode,
+                            "refused_hosts": refused,
+                            "findings": egress_findings(refused),
+                        },
+                    )
                 raise EnvironmentsError(
                     BUILD_FAILED,
                     "The build failed; its log says where",

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/code_sandboxes/environments/adapters/modal.py

@@ -96,6 +96,15 @@ end and the container exited before that first real exec ever reached it.
 The entrypoint now execs `sleep infinity` when it is given no arguments,
 and `"$@"` when it is — correct either way a caller invokes it.
 
+**And a sandbox with no command is not given no arguments** (found live on
+2026-09-18): Modal keeps the base's own CMD, `start-jupyter.sh`, under the
+new ENTRYPOINT where Docker would reset it, so the main process was a
+Jupyter server, which exits within a minute and ends the sandbox. A smoke
+test's restarted sandbox, started warm, died between checks 8 and 9. The
+artifact now sets its CMD to `sleep infinity`, and `ModalSandbox` names the
+same command when it launches an artifact, which also covers the ones built
+before.
+
 **A GPU is a launch option on Modal, not part of the image** (section 11.4
 item 10, E2-17). A GPU version builds the same image any version does, on the
 CUDA base; the spec's `accelerator` names one of Modal's GPUs, checked at
@@ -206,6 +215,8 @@ _ENTRYPOINT_PATH = "/opt/datalayer/bin/entrypoint.sh"
 #: is given keeps it alive for that; `exec "$@"` still wins when something
 #: is, for a caller that does supply a command directly.
 _ENTRYPOINT_SCRIPT = '#!/bin/sh\nif [ "$#" -eq 0 ]; then exec sleep infinity; fi\nexec "$@"\n'
+#: The artifact's CMD: what a sandbox started with no command of its own runs.
+_KEEP_ALIVE_COMMAND = ("sleep", "infinity")
 
 
 def _modal_sdk() -> Any:
@@ -498,7 +509,19 @@ class Builder(ManagedBuilder):
                 for command in files_step(request.environment, variant=self.variant):
                     image = image.run_commands(command)
                 image = _post_install(image, spec.commands.post_install, declared, step_secrets)
-                image = image.workdir(_CONTENT_DIR).entrypoint([_ENTRYPOINT_PATH])
+                # The base's own CMD is `start-jupyter.sh`, and Modal keeps
+                # it under a new ENTRYPOINT where Docker would reset it: a
+                # sandbox started with no command ran a Jupyter server as its
+                # main process, which exits within a minute and takes the
+                # sandbox with it (found live on 2026-09-18, the restarted
+                # sandbox of a smoke test dying mid-tier). What holds the
+                # container is `sleep`; Jupyter is started by exec, when
+                # asked (`ModalSandbox.prepare_jupyter_server`).
+                image = (
+                    image.workdir(_CONTENT_DIR)
+                    .entrypoint([_ENTRYPOINT_PATH])
+                    .cmd(list(_KEEP_ALIVE_COMMAND))
+                )
 
                 logged: list[str] = []
                 buffer = io.StringIO()

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/code_sandboxes/environments/resolve.py

@@ -83,6 +83,7 @@ if TYPE_CHECKING:
 __all__ = [
     "APT_PIN_PREFIX",
     "APT_SNAPSHOT_PREFIX",
+    "BUILDKIT_PROXY_ENV",
     "CONSTRAINTS_PATH",
     "COVERAGE_PREFIX",
     "DOCKERFILE_COVERAGE",
@@ -98,6 +99,9 @@ __all__ = [
     "apt_pins",
     "apt_pins_in",
     "apt_snapshot_in",
+    "buildkit_proxy",
+    "buildkit_proxy_options",
+    "egress_refused_hosts",
     "lock_document",
     "locked_versions",
     "merge_requirements",
@@ -145,6 +149,114 @@ DOCKERFILE_COVERAGE = (
 APT_SNAPSHOT_PREFIX = "# datalayer-apt-snapshot: "
 _SNAPSHOT_ID = re.compile(r"^\d{8}T\d{6}Z$")
 
+#: Where a build's own steps reach the network through, when the build pool
+#: gives them nowhere else to go (E1-06): an HTTP proxy that allows only the
+#: package indexes, the snapshot mirrors and the registries. The address is
+#: the one `buildkitd` itself sees, since a step runs in its network.
+BUILDKIT_PROXY_ENV = "DATALAYER_BUILDKIT_PROXY"
+_PROXY_URL = re.compile(r"^http://[A-Za-z0-9.\-]+:\d{1,5}$")
+
+
+def buildkit_proxy(proxy: str | None = None) -> str:
+    """The proxy a build's steps go through: ``proxy``, or the environment's.
+
+    Empty is no proxy, which is what a `buildkitd` with open egress needs
+    (`plane local`'s own). Anything that is not ``http://host:port`` is
+    refused rather than handed to every package manager of every build.
+    """
+    value = (os.environ.get(BUILDKIT_PROXY_ENV, "") if proxy is None else proxy).strip()
+    if value and not _PROXY_URL.match(value):
+        raise ValueError(f"{BUILDKIT_PROXY_ENV} must be http://host:port, not {value!r}")
+    return value
+
+
+def buildkit_proxy_options(proxy: str) -> list[str]:
+    """The ``buildctl`` options that send a build's steps through ``proxy``.
+
+    The Dockerfile frontend predefines these build args: a ``RUN`` step sees
+    them without an ``ARG``, they never reach the image's config or history,
+    and they do not change a cache key. Both spellings, since ``apt`` and
+    ``curl`` read only the lower-case one for plain HTTP and ``uv``, ``pip``
+    and ``micromamba`` read either.
+    """
+    if not proxy:
+        return []
+    options: list[str] = []
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+        options += ["--opt", f"build-arg:{name}={proxy}"]
+    for name in ("NO_PROXY", "no_proxy"):
+        options += ["--opt", f"build-arg:{name}=127.0.0.1,localhost"]
+    return options
+
+
+#: What each tool writes when the build pool's egress proxy refuses it a
+#: tunnel (E2-19). Read from the tools themselves, through the chart's own
+#: Squid refusing every host, on 2026-09-19: pip, uv 0.12, micromamba 2.3,
+#: git, curl 8 without `-f`, wget, and a Go client — `buildkitd`'s own pulls.
+#: Each is a refused CONNECT and nothing else: a host that answered 403 over
+#: its own TLS says so differently. `curl -f` ("The requested URL returned
+#: error: 403"), `wget -q` (nothing) and `apt` over plain HTTP ("403
+#: Forbidden [IP: proxy]") cannot be told from the host's own 403, and are
+#: left to the log.
+_EGRESS_REFUSED = re.compile(
+    r"Tunnel connection failed: 403"  # pip, requests, urllib3
+    r"|tunnel error: unsuccessful"  # uv
+    r"|CONNECT tunnel failed, response 403"  # curl, git, micromamba
+    r"|Proxy tunneling failed: Forbidden"  # wget
+    r'|"https?://[^"\s]+": Forbidden'  # Go: buildkitd, containerd
+)
+#: A host a line names: urllib3's `host='…'`, or the host of a URL.
+_NAMED_HOST = re.compile(r"host='(?P<pool>[A-Za-z0-9.\-]+)'|https?://(?P<url>[A-Za-z0-9.\-]+)")
+#: `buildctl`'s plain progress: `#12 0.874 <what the step wrote>`. Steps run
+#: side by side, so a line is read against the lines of its own step.
+_BUILDKIT_LINE = re.compile(r"^#(?P<step>\d+) (?:\d+\.\d+ )?(?P<text>.*)$")
+
+
+def egress_refused_hosts(log: str, *, proxy: str = "", limit: int = 10) -> list[str]:
+    """The hosts the build pool's egress proxy refused, as a build's log shows them (E2-19).
+
+    A refusal is found by what the tool writes (`_EGRESS_REFUSED`), and its
+    host is the one the same line names — pip's `host='files.pythonhosted.org'`,
+    git's URL — or else the last one its step named before it: uv and
+    micromamba write the URL a line or four above the refusal, wget and a
+    silent `curl` only in the `RUN` line. The proxy's own address is never a
+    host it refused. In the order they were first refused, at most ``limit``.
+    """
+    own = {"127.0.0.1", "localhost"}
+    if proxy:
+        own.add(proxy.split("://", 1)[-1].rsplit(":", 1)[0])
+    hosts: list[str] = []
+    last: dict[str, str] = {}
+    for raw in log.splitlines():
+        line = _BUILDKIT_LINE.match(raw)
+        step, text = (line.group("step"), line.group("text")) if line else ("", raw)
+        named = [
+            host.lower().rstrip(".")
+            for match in _NAMED_HOST.finditer(text)
+            for host in (match.group("pool") or match.group("url"),)
+            if host and host.lower().rstrip(".") not in own
+        ]
+        if _EGRESS_REFUSED.search(text):
+            host = named[0] if named else last.get(step, "")
+            if host and host not in hosts:
+                hosts.append(host)
+                if len(hosts) >= limit:
+                    break
+        if named:
+            last[step] = named[-1]
+    return hosts
+
+
+def egress_findings(hosts: Sequence[str]) -> list[dict[str, str]]:
+    """The refused hosts as a failure's findings: what a page lists, not the log."""
+    return [{"kind": "egress_refused", "subject": host} for host in hosts]
+
+
+def egress_hosts_text(hosts: Sequence[str]) -> str:
+    quoted = [f"`{host}`" for host in hosts]
+    return quoted[0] if len(quoted) == 1 else ", ".join(quoted[:-1]) + " and " + quoted[-1]
+
+
 #: How a protected pin is recorded in the lock.
 PROTECTED_PIN_PREFIX = "# datalayer-protected: "
 
@@ -478,6 +590,19 @@ def parse_resolver_failure(
                 },
             )
 
+    # An index the build pool may not reach is not an outage: resolving again
+    # is refused again, so it is said with the host rather than retried.
+    refused = egress_refused_hosts(output)
+    if refused and "No solution found" not in text:
+        return EnvironmentsError(
+            PACKAGE_NOT_FOUND,
+            f"The build pool's egress proxy refused {egress_hosts_text(refused)}: a version "
+            "resolves only against the indexes the build pool allows. Use one of them, or "
+            "ask for the host to be allowed",
+            detail={**detail, "refused_hosts": refused, "findings": egress_findings(refused)},
+            retryable=False,
+        )
+
     pair = _conflicting_pair(mentions) if "No solution found" in text else None
     if pair:
         return EnvironmentsError(
@@ -623,8 +748,11 @@ class BuildkitResolveRunner:
         tlscacert: str | None = None,
         apt_snapshot: str = "",
         timeout: float = 900.0,
+        proxy: str | None = None,
     ) -> None:
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         #: The build pool's `buildkitd` takes mTLS connections only
         #: (PLAN_ENV.md E1-06); a plain-socket one, such as `plane local`'s
         #: own ephemeral daemon, needs none of these three. All or nothing,
@@ -761,6 +889,7 @@ class BuildkitResolveRunner:
                 f"dockerfile={root}",
                 "--output",
                 f"type=local,dest={out}",
+                *buildkit_proxy_options(self._proxy),
             ]
             say(f"Solving the lock in {request.base_reference}")
             try:

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/code_sandboxes/environments/resolve_conda.py

@@ -68,6 +68,11 @@ from .resolve import (
     WHEELHOUSE_PATH,
     MergedRequirements,
     ProtectedPin,
+    buildkit_proxy,
+    buildkit_proxy_options,
+    egress_findings,
+    egress_hosts_text,
+    egress_refused_hosts,
     merge_requirements,
 )
 
@@ -527,6 +532,18 @@ def parse_conda_failure(output: str) -> EnvironmentsError:
             f"`{name}` is not in any channel this environment may read",
             detail={**detail, "package": name},
         )
+    # A channel the build pool may not reach: solving again is refused again,
+    # so it is said with the host rather than retried (E2-19).
+    refused = egress_refused_hosts(output)
+    if refused:
+        return EnvironmentsError(
+            PACKAGE_NOT_FOUND,
+            f"The build pool's egress proxy refused {egress_hosts_text(refused)}: a version "
+            "solves only against the channels the build pool allows. Use one of them, or "
+            "ask for the host to be allowed",
+            detail={**detail, "refused_hosts": refused, "findings": egress_findings(refused)},
+            retryable=False,
+        )
     lowered = text.lower()
     if (
         "could not solve" in lowered
@@ -684,8 +701,11 @@ class BuildkitCondaResolveRunner:
         tlskey: str | None = None,
         tlscacert: str | None = None,
         timeout: float = 1200.0,
+        proxy: str | None = None,
     ) -> None:
         self._buildctl = (shutil.which("buildctl") or "") if buildctl is None else buildctl
+        #: The build pool's egress proxy (E1-06), or `DATALAYER_BUILDKIT_PROXY`.
+        self._proxy = buildkit_proxy(proxy)
         self._tlscert = tlscert or ""
         self._tlskey = tlskey or ""
         self._tlscacert = tlscacert or ""
@@ -778,6 +798,7 @@ class BuildkitCondaResolveRunner:
                 f"dockerfile={root}",
                 "--output",
                 f"type=local,dest={out}",
+                *buildkit_proxy_options(self._proxy),
             ]
             say(f"Solving the conda lock in {request.base_reference}")
             try:

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/code_sandboxes/modal_sandbox.py

@@ -441,7 +441,16 @@ class ModalSandbox(Sandbox):
                 for mount_path, volume_id in self._volume_mounts.requested.items()
             }
 
-        self._sandbox = modal.Sandbox.create(**create_kwargs)
+        # An Environments artifact's main process only holds the container:
+        # everything this class runs in it is an exec, Jupyter included
+        # (`prepare_jupyter_server`). Named here rather than left to the
+        # image, since an artifact built before code-sandboxes 1.9.36 carries
+        # its base's `start-jupyter.sh` as its CMD, which Modal runs under the
+        # entrypoint; that server exits within a minute and ends the sandbox
+        # (found live on 2026-09-18: a smoke test's restarted sandbox died
+        # between checks 8 and 9).
+        command = ("sleep", "infinity") if self._image_id else ()
+        self._sandbox = modal.Sandbox.create(*command, **create_kwargs)
         self._volume_mounts.created()
         self._start_driver()
 

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/docs/docs/environments/specification.mdx

@@ -37,7 +37,7 @@ A document is refused with `DL_ENV_SPEC_INVALID` when a field is wrong, and with
 | `commands.postInstall` | none | At most 32 non-empty commands, run after the packages are installed. |
 | `buildSecrets` | none | `id` is a Datalayer secret id, `dlsec_...`; `mountAs` is `env` or `file`; `name` is the variable or file name. Ids and names are unique. Secrets are injected into the build step that needs them and never written into the artifact. |
 | `resources.sizeClass` | `small` | `small`, `medium`, `large`, `gpu-small` or `gpu-large`. A GPU class needs an accelerator and a CUDA base; an accelerator needs a GPU class. Datalayer runs no GPU nodes yet, so a GPU class is built for Modal and Daytona, which bring their own GPUs; E2B has none. |
-| `resources.accelerator` | `none` | `none`, or `type`, `count` and `cuda`. `type` is the provider's own name for the GPU (Daytona: `H100`, `H200`, `RTX-PRO-6000`, `RTX-4090`, `RTX-5090`), and a GPU a variant does not offer is refused for it at `validate`. `cuda` is the base's toolkit: `datalayer/python-cuda:2026.09` carries 12.8, and another version is refused. |
+| `resources.accelerator` | `none` | `none`, or `type`, `count` and `cuda`. `type` is the provider's own name for the GPU (Modal: `T4`, `L4`, `A10G`, `L40S`, `A100`, `A100-40GB`, `A100-80GB`, `H100`, `H200`, `B200`; Daytona: `H100`, `H200`, `RTX-PRO-6000`, `RTX-4090`, `RTX-5090`), and a GPU a variant does not offer is refused for it at `validate`. `cuda` is the base's toolkit: `datalayer/python-cuda:2026.09` carries 12.8, and another version is refused. |
 | `resources.hints` | none | `cpu`, `memoryGi`, `diskGi`: positive numbers, within the size class. |
 | `compatibility.variants.required` | `[datalayer]` | At least one of `datalayer`, `e2b`, `daytona`, `modal`. |
 | `compatibility.variants.optional` | none | The same variants, none of them also required. |

{code_sandboxes-1.9.35 → code_sandboxes-1.9.37}/docs/docs/providers/modal.mdx

@@ -77,9 +77,11 @@ with Sandbox.create(
 An [Environment](/environments) built for Modal is an **image id**,
 `im-…` — pulled `from_aws_ecr` off the approved Datalayer base, with your
 lock installed by `uv pip sync --require-hashes` on top. A published name
-is worth having for operability, but a launch always pins the id: each
-build gets a fresh credential, so no layer cache survives between builds,
-and the id is the only reference that names one build and not another.
+is worth having for operability, but a launch always pins the id: a name
+moves when the same build is published again, and the id is the only
+reference that names one build's image. Modal answers an identical image
+definition with the image it already has, so two builds of the same lock
+can share one id.
 
 **Bring your own account:** a build runs in the environment owner's own
 Modal workspace, from the same `MODAL_TOKEN_ID`/`MODAL_TOKEN_SECRET` pair
@@ -96,8 +98,22 @@ with no image id — general Modal sandbox usage here is unaffected).
 Confirmed live: a launched sandbox's identity check now passes, where it
 used to report `uid: 0`.
 
-**A known, open gap:** two of the core tier's checks — imports and
-filesystem — still fail on a launched Environment sandbox, for a reason
-not yet root-caused: reproduced on a real, contract-built image, not on a
-plain `ModalSandbox`, so it is specific to something about that image
-under repeated `exec`, not the identity fix above.
+**The sandbox is held by `sleep infinity`, not the base's Jupyter.**
+Modal keeps the base image's CMD, `start-jupyter.sh`, under the builder's
+`ENTRYPOINT`, where Docker would reset it, so a sandbox started with no
+command ran a Jupyter server as its main process. That server exits
+within a minute and the sandbox ends with it: "Modal Sandbox is shutting
+down", a few commands in. Since 1.9.36 the artifact's CMD is
+`sleep infinity`, and `ModalSandbox` names `sleep infinity` when it
+launches an artifact, which covers images built by earlier releases too.
+Jupyter is started by exec when it is asked for
+(`prepare_jupyter_server`).
+
+**GPU versions.** On Modal a GPU is a launch option, not part of the
+image: a GPU version's image builds like any other on the CUDA base, and
+its sandboxes start on the GPU the version names. The build's smoke test
+does that (`gpu="L4"`, or `"H100:2"` for two) and adds the contract's
+check 11: the GPUs asked for are visible, and the image's CUDA is the
+version's. A GPU Modal does not offer — it offers `T4`, `L4`, `A10G`,
+`L40S`, `A100`, `A100-40GB`, `A100-80GB`, `H100`, `H200`, `B200` — is
+refused at `validate`, before anything is built.

code_sandboxes-1.9.37/tests/egress_logs/buildctl-base.log

@@ -0,0 +1,16 @@
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 80B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for ghcr.io/astral-sh/uv:0.12.11
+#2 ERROR: failed to do request: Head "https://ghcr.io/v2/astral-sh/uv/manifests/0.12.11": Forbidden
+------
+ > [internal] load metadata for ghcr.io/astral-sh/uv:0.12.11:
+------
+Dockerfile:1
+--------------------
+   1 | >>> FROM ghcr.io/astral-sh/uv:0.12.11
+   2 |     RUN true
+   3 |
+--------------------
+error: failed to solve: ghcr.io/astral-sh/uv:0.12.11: failed to resolve source metadata for ghcr.io/astral-sh/uv:0.12.11: failed to do request: Head "https://ghcr.io/v2/astral-sh/uv/manifests/0.12.11": Forbidden

code_sandboxes-1.9.37/tests/egress_logs/buildctl-curl.log

@@ -0,0 +1,41 @@
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 325B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/buildpack-deps:bookworm-scm
+#2 DONE 0.2s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/4] FROM docker.io/library/buildpack-deps:bookworm-scm@sha256:bb8654d03bd8341e702f1ae30adca91a11f4164da2d37dbe7a0bf49e4901bd03
+#4 CACHED
+
+#5 [2/4] RUN git clone -q https://github.com/psf/requests.git /tmp/r || true
+#5 0.063 fatal: unable to access 'https://github.com/psf/requests.git/': CONNECT tunnel failed, response 403
+#5 DONE 0.1s
+
+#6 [3/4] RUN curl -fsSL https://raw.githubusercontent.com/psf/requests/main/README.md -o /dev/null || true
+#6 0.065 curl: (22) The requested URL returned error: 403
+#6 DONE 0.1s
+
+#7 [4/4] RUN wget https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz -O /dev/null
+#7 0.060 --2026-09-19 08:44:09--  https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz
+#7 0.066 Connecting to 172.18.0.2:3128... connected.
+#7 0.067 Proxy tunneling failed: ForbiddenUnable to establish SSL connection.
+#7 ERROR: process "/bin/sh -c wget https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz -O /dev/null" did not complete successfully: exit code: 4
+------
+ > [4/4] RUN wget https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz -O /dev/null:
+0.060 --2026-09-19 08:44:09--  https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz
+0.066 Connecting to 172.18.0.2:3128... connected.
+0.067 Proxy tunneling failed: ForbiddenUnable to establish SSL connection.
+------
+Dockerfile:4
+--------------------
+   2 |     RUN git clone -q https://github.com/psf/requests.git /tmp/r || true
+   3 |     RUN curl -fsSL https://raw.githubusercontent.com/psf/requests/main/README.md -o /dev/null || true
+   4 | >>> RUN wget https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz -O /dev/null
+   5 |
+--------------------
+error: failed to solve: process "/bin/sh -c wget https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz -O /dev/null" did not complete successfully: exit code: 4

code_sandboxes-1.9.37/tests/egress_logs/buildctl-pip.log

@@ -0,0 +1,43 @@
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 192B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/python:3.12-slim
+#2 DONE 0.2s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/3] FROM docker.io/library/python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9
+#4 CACHED
+
+#5 [2/3] RUN pip install --no-cache-dir --index-url https://pypi.example-private.io/simple requests
+#5 0.887 Looking in indexes: https://pypi.example-private.io/simple
+#5 0.890 WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+#5 1.391 WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+#5 2.393 WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+#5 4.395 WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+#5 8.397 WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+#5 8.401 ERROR: Could not find a version that satisfies the requirement requests (from versions: none)
+#5 8.413 ERROR: No matching distribution found for requests
+#5 ERROR: process "/bin/sh -c pip install --no-cache-dir --index-url https://pypi.example-private.io/simple requests" did not complete successfully: exit code: 1
+------
+ > [2/3] RUN pip install --no-cache-dir --index-url https://pypi.example-private.io/simple requests:
+0.887 Looking in indexes: https://pypi.example-private.io/simple
+0.890 WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+1.391 WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+2.393 WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+4.395 WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+8.397 WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden'))': /simple/requests/
+8.401 ERROR: Could not find a version that satisfies the requirement requests (from versions: none)
+8.413 ERROR: No matching distribution found for requests
+------
+Dockerfile:2
+--------------------
+   1 |     FROM python:3.12-slim
+   2 | >>> RUN pip install --no-cache-dir --index-url https://pypi.example-private.io/simple requests
+   3 |     RUN pip install --no-cache-dir requests
+   4 |
+--------------------
+error: failed to solve: process "/bin/sh -c pip install --no-cache-dir --index-url https://pypi.example-private.io/simple requests" did not complete successfully: exit code: 1

code_sandboxes-1.9.37/tests/egress_logs/buildctl-uv.log

@@ -0,0 +1,54 @@
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 193B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/python:3.12-slim
+#2 DONE 0.2s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/3] FROM docker.io/library/python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9
+#4 DONE 0.0s
+
+#5 [internal] load build context
+#5 transferring context: 26B done
+#5 DONE 0.0s
+
+#6 [2/3] COPY uv /usr/local/bin/uv
+#6 CACHED
+
+#7 [3/3] RUN uv pip install --system "requests @ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz"
+#7 0.175 Using Python 3.12.14 environment at: /usr/local
+#7 9.090   × Failed to download and build `requests @
+#7 9.090   │ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz`
+#7 9.090   ├─▶ Request failed after 3 retries in 8.9s
+#7 9.090   ├─▶ Failed to fetch:
+#7 9.090   │   `https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz`
+#7 9.090   ├─▶ error sending request for url
+#7 9.090   │   (https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz)
+#7 9.090   ├─▶ client error (Connect)
+#7 9.090   ╰─▶ tunnel error: unsuccessful
+#7 ERROR: process "/bin/sh -c uv pip install --system \"requests @ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz\"" did not complete successfully: exit code: 1
+------
+ > [3/3] RUN uv pip install --system "requests @ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz":
+0.175 Using Python 3.12.14 environment at: /usr/local
+9.090   × Failed to download and build `requests @
+9.090   │ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz`
+9.090   ├─▶ Request failed after 3 retries in 8.9s
+9.090   ├─▶ Failed to fetch:
+9.090   │   `https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz`
+9.090   ├─▶ error sending request for url
+9.090   │   (https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz)
+9.090   ├─▶ client error (Connect)
+9.090   ╰─▶ tunnel error: unsuccessful
+------
+Dockerfile:3
+--------------------
+   1 |     FROM python:3.12-slim
+   2 |     COPY uv /usr/local/bin/uv
+   3 | >>> RUN uv pip install --system "requests @ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz"
+   4 |
+--------------------
+error: failed to solve: process "/bin/sh -c uv pip install --system \"requests @ https://github.com/psf/requests/archive/refs/tags/v2.32.3.tar.gz\"" did not complete successfully: exit code: 1

code_sandboxes-1.9.37/tests/egress_logs/micromamba.log

@@ -0,0 +1,30 @@
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/noarch/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/linux-64/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/noarch/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/linux-64/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/noarch/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/linux-64/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+warning  libmamba Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/noarch/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+warning  libmamba Retrying in 2 seconds
+critical libmamba Multiple errors occurred:
+    Download error (56) Failure when receiving data from the peer [https://conda.anaconda.org/conda-forge/noarch/repodata.json.zst]
+    CONNECT tunnel failed, response 403
+    Subdir conda-forge/noarch not loaded!
+    If you run into this error repeatedly, your package cache may be corrupted.
+    Please try running `mamba clean -a` to remove this cache before retrying the operation.
+
+    If you still are having issues, please report the error on `mamba-org/mamba`'s issue tracker:
+    https://github.com/mamba-org/mamba/issues/new?assignees=&labels=&projects=&template=bug.yml