modal 1.4.4.dev2__tar.gz → 1.4.4.dev4__tar.gz

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.4.4.dev2
+Version: 1.4.4.dev4
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal/_utils/task_command_router_client.py

@@ -193,18 +193,25 @@ class TaskCommandRouterClient:
     ) -> "TaskCommandRouterClient":
         """Build a connected client from a jwt and url."""
         o = urllib.parse.urlparse(url)
-        if o.scheme != "https":
+        is_localhost_client = server_client._is_localhost
+        if o.scheme == "http":
+            # plain http serving should only be used for unit tests
+            if not is_localhost_client:
+                raise ValueError(f"Task router URL must be https, got: {url}")
+            ssl_context = None
+        elif o.scheme == "https":
+            ssl_context = ssl.create_default_context()
+            if is_localhost_client:
+                # Allow insecure TLS when the Modal server client points to localhost
+                # This is typically triggered from local e2e testing
+                logger.warning("Using insecure TLS for task command router because server client points to localhost")
+                ssl_context.check_hostname = False
+                ssl_context.verify_mode = ssl.CERT_NONE
+        else:
             raise ValueError(f"Task router URL must be https, got: {url}")
 
         host, _, port_str = o.netloc.partition(":")
-        port = int(port_str) if port_str else 443
-        ssl_context = ssl.create_default_context()
-
-        # Allow insecure TLS when explicitly enabled via config.
-        if server_client._is_localhost:
-            logger.warning("Using insecure TLS for task command router because server client points to localhost")
-            ssl_context.check_hostname = False
-            ssl_context.verify_mode = ssl.CERT_NONE
+        port = int(port_str) if port_str else (443 if o.scheme == "https" else 80)
 
         channel = PermanentCloseableChannel(
             host,

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal/client.pyi

@@ -35,7 +35,7 @@ class _Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.4.4.dev2",
+        version: str = "1.4.4.dev4",
     ):
         """mdmd:hidden
         The Modal client object is not intended to be instantiated directly by users.
@@ -175,7 +175,7 @@ class Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.4.4.dev2",
+        version: str = "1.4.4.dev4",
     ):
         """mdmd:hidden
         The Modal client object is not intended to be instantiated directly by users.

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal/sandbox.py

@@ -696,6 +696,7 @@ class _Sandbox(_Object, type_prefix="sb"):
         block_network: bool = False,
         cidr_allowlist: Optional[Sequence[str]] = None,
         inbound_cidr_allowlist: Optional[Sequence[str]] = None,
+        volumes: dict[Union[str, os.PathLike], Union[_Volume, _CloudBucketMount]] = {},
         pty: bool = False,
         encrypted_ports: Sequence[int] = [],
         h2_ports: Sequence[int] = [],
@@ -707,11 +708,12 @@ class _Sandbox(_Object, type_prefix="sb"):
         """Create a sandbox using the V2 backend.
 
         Supported features include exec, encrypted tunnels, wait/poll/terminate,
-        CPU and memory configuration, region placement,
-        and filesystem snapshots.
+        CPU and memory configuration, region placement, volumes, cloud bucket mounts
+        (with static credentials via `secret=...`), and filesystem snapshots.
 
-        Features like tags, memory snapshots, volumes, network file systems, GPUs,
-        custom domains, OIDC identity tokens, and proxies are not supported.
+        Features like tags, memory snapshots, network file systems, GPUs, custom
+        domains, OIDC identity tokens (including `oidc_auth_role_arn` on a
+        CloudBucketMount), and proxies are not supported.
 
         V2 sandboxes created with this method are not currently returned by
         `Sandbox.list()` and cannot be looked up with `Sandbox.from_name()`.
@@ -730,6 +732,24 @@ class _Sandbox(_Object, type_prefix="sb"):
         if block_network and (encrypted_ports or h2_ports or unencrypted_ports):
             raise InvalidError("Cannot specify open ports when `block_network` is enabled")
 
+        validated_volumes = validate_volumes(volumes)
+        cloud_bucket_mounts = [(k, v) for k, v in validated_volumes if isinstance(v, _CloudBucketMount)]
+        validated_volumes = [(k, v) for k, v in validated_volumes if isinstance(v, _Volume)]
+
+        # The V2 backend does not yet propagate `oidc_identity_token` from server to worker - it is silently dropped
+        # TODO(akshay) add support for OIDC tokens
+        if include_oidc_identity_token:
+            raise InvalidError(
+                "Sandbox._experimental_create does not support include_oidc_identity_token=True. "
+                "Use Sandbox.create instead."
+            )
+        for path, cbm in cloud_bucket_mounts:
+            if cbm.oidc_auth_role_arn:
+                raise InvalidError(
+                    "Sandbox._experimental_create does not support CloudBucketMount with oidc_auth_role_arn "
+                    f"(at mount path {path!r}). Use static credentials via `secret=...`, or use Sandbox.create."
+                )
+
         secrets = secrets or []
         if env:
             secrets = [*secrets, _Secret.from_dict(env)]
@@ -777,9 +797,18 @@ class _Sandbox(_Object, type_prefix="sb"):
                 dep_tasks.append(resolver.load(image, load_context))
             for secret in secrets:
                 dep_tasks.append(resolver.load(secret, load_context))
+            for _, vol in validated_volumes:
+                dep_tasks.append(resolver.load(vol, load_context))
+            for _, cloud_bucket_mount in cloud_bucket_mounts:
+                if cloud_bucket_mount.secret:
+                    dep_tasks.append(resolver.load(cloud_bucket_mount.secret, load_context))
             if dep_tasks:
                 await asyncio.gather(*dep_tasks)
 
+            validate_volumes_by_object_id(validated_volumes)
+
+            volume_mounts = [_volume_to_mount_proto(path, volume) for path, volume in validated_volumes]
+
             definition = api_pb2.Sandbox(
                 entrypoint_args=args,
                 image_id=image.object_id,
@@ -801,6 +830,8 @@ class _Sandbox(_Object, type_prefix="sb"):
                 name=name,
                 include_oidc_identity_token=include_oidc_identity_token,
                 inbound_cidr_allowlist=list(inbound_cidr_allowlist) if inbound_cidr_allowlist is not None else [],
+                volume_mounts=volume_mounts,
+                cloud_bucket_mounts=cloud_bucket_mounts_to_proto(cloud_bucket_mounts),
             )
 
             create_req = api_pb2.SandboxCreateV2Request(app_id=load_context.app_id, definition=definition)

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal/sandbox.pyi

@@ -325,6 +325,10 @@ class _Sandbox(modal._object._Object):
         block_network: bool = False,
         cidr_allowlist: typing.Optional[collections.abc.Sequence[str]] = None,
         inbound_cidr_allowlist: typing.Optional[collections.abc.Sequence[str]] = None,
+        volumes: dict[
+            typing.Union[str, os.PathLike],
+            typing.Union[modal.volume._Volume, modal.cloud_bucket_mount._CloudBucketMount],
+        ] = {},
         pty: bool = False,
         encrypted_ports: collections.abc.Sequence[int] = [],
         h2_ports: collections.abc.Sequence[int] = [],
@@ -336,11 +340,12 @@ class _Sandbox(modal._object._Object):
         """Create a sandbox using the V2 backend.
 
         Supported features include exec, encrypted tunnels, wait/poll/terminate,
-        CPU and memory configuration, region placement,
-        and filesystem snapshots.
+        CPU and memory configuration, region placement, volumes, cloud bucket mounts
+        (with static credentials via `secret=...`), and filesystem snapshots.
 
-        Features like tags, memory snapshots, volumes, network file systems, GPUs,
-        custom domains, OIDC identity tokens, and proxies are not supported.
+        Features like tags, memory snapshots, network file systems, GPUs, custom
+        domains, OIDC identity tokens (including `oidc_auth_role_arn` on a
+        CloudBucketMount), and proxies are not supported.
 
         V2 sandboxes created with this method are not currently returned by
         `Sandbox.list()` and cannot be looked up with `Sandbox.from_name()`.
@@ -1216,6 +1221,10 @@ class Sandbox(modal.object.Object):
             block_network: bool = False,
             cidr_allowlist: typing.Optional[collections.abc.Sequence[str]] = None,
             inbound_cidr_allowlist: typing.Optional[collections.abc.Sequence[str]] = None,
+            volumes: dict[
+                typing.Union[str, os.PathLike],
+                typing.Union[modal.volume.Volume, modal.cloud_bucket_mount.CloudBucketMount],
+            ] = {},
             pty: bool = False,
             encrypted_ports: collections.abc.Sequence[int] = [],
             h2_ports: collections.abc.Sequence[int] = [],
@@ -1227,11 +1236,12 @@ class Sandbox(modal.object.Object):
             """Create a sandbox using the V2 backend.
 
             Supported features include exec, encrypted tunnels, wait/poll/terminate,
-            CPU and memory configuration, region placement,
-            and filesystem snapshots.
+            CPU and memory configuration, region placement, volumes, cloud bucket mounts
+            (with static credentials via `secret=...`), and filesystem snapshots.
 
-            Features like tags, memory snapshots, volumes, network file systems, GPUs,
-            custom domains, OIDC identity tokens, and proxies are not supported.
+            Features like tags, memory snapshots, network file systems, GPUs, custom
+            domains, OIDC identity tokens (including `oidc_auth_role_arn` on a
+            CloudBucketMount), and proxies are not supported.
 
             V2 sandboxes created with this method are not currently returned by
             `Sandbox.list()` and cannot be looked up with `Sandbox.from_name()`.
@@ -1259,6 +1269,10 @@ class Sandbox(modal.object.Object):
             block_network: bool = False,
             cidr_allowlist: typing.Optional[collections.abc.Sequence[str]] = None,
             inbound_cidr_allowlist: typing.Optional[collections.abc.Sequence[str]] = None,
+            volumes: dict[
+                typing.Union[str, os.PathLike],
+                typing.Union[modal.volume.Volume, modal.cloud_bucket_mount.CloudBucketMount],
+            ] = {},
             pty: bool = False,
             encrypted_ports: collections.abc.Sequence[int] = [],
             h2_ports: collections.abc.Sequence[int] = [],
@@ -1270,11 +1284,12 @@ class Sandbox(modal.object.Object):
             """Create a sandbox using the V2 backend.
 
             Supported features include exec, encrypted tunnels, wait/poll/terminate,
-            CPU and memory configuration, region placement,
-            and filesystem snapshots.
+            CPU and memory configuration, region placement, volumes, cloud bucket mounts
+            (with static credentials via `secret=...`), and filesystem snapshots.
 
-            Features like tags, memory snapshots, volumes, network file systems, GPUs,
-            custom domains, OIDC identity tokens, and proxies are not supported.
+            Features like tags, memory snapshots, network file systems, GPUs, custom
+            domains, OIDC identity tokens (including `oidc_auth_role_arn` on a
+            CloudBucketMount), and proxies are not supported.
 
             V2 sandboxes created with this method are not currently returned by
             `Sandbox.list()` and cannot be looked up with `Sandbox.from_name()`.

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal/volume.py

@@ -471,8 +471,8 @@ class _Volume(_Object, type_prefix="vo"):
         Note that these options are not properties stored with the Volume itself - they can be individually configured
         for each Volume - container association.
 
-        read_only: bool (optional) - set this to True to make the Volume read only from within containers
-        sub_path: str | PurePosixPath (optional) - only mount this sub_path directory from the Volume.
+        `read_only`: bool (optional) - set this to True to make the Volume read only from within containers
+        `sub_path`: str | PurePosixPath (optional) - only mount this sub_path directory from the Volume.
             If the directory doesn't exist in the Volume, it will be created when the container starts up
 
 

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal/volume.pyi

@@ -519,8 +519,8 @@ class _Volume(modal._object._Object):
         Note that these options are not properties stored with the Volume itself - they can be individually configured
         for each Volume - container association.
 
-        read_only: bool (optional) - set this to True to make the Volume read only from within containers
-        sub_path: str | PurePosixPath (optional) - only mount this sub_path directory from the Volume.
+        `read_only`: bool (optional) - set this to True to make the Volume read only from within containers
+        `sub_path`: str | PurePosixPath (optional) - only mount this sub_path directory from the Volume.
             If the directory doesn't exist in the Volume, it will be created when the container starts up
 
 
@@ -879,8 +879,8 @@ class Volume(modal.object.Object):
         Note that these options are not properties stored with the Volume itself - they can be individually configured
         for each Volume - container association.
 
-        read_only: bool (optional) - set this to True to make the Volume read only from within containers
-        sub_path: str | PurePosixPath (optional) - only mount this sub_path directory from the Volume.
+        `read_only`: bool (optional) - set this to True to make the Volume read only from within containers
+        `sub_path`: str | PurePosixPath (optional) - only mount this sub_path directory from the Volume.
             If the directory doesn't exist in the Volume, it will be created when the container starts up
 
 

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.4.4.dev2
+Version: 1.4.4.dev4
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0

{modal-1.4.4.dev2 → modal-1.4.4.dev4}/modal_proto/api_grpc.py

@@ -267,6 +267,10 @@ class ModalClientBase(abc.ABC):
     async def EndpointList(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.EndpointListRequest, modal_proto.api_pb2.EndpointListResponse]') -> None:
         pass
 
+    @abc.abstractmethod
+    async def EndpointStop(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.EndpointStopRequest, modal_proto.api_pb2.EndpointStopResponse]') -> None:
+        pass
+
     @abc.abstractmethod
     async def EnvironmentCreate(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.EnvironmentCreateRequest, google.protobuf.empty_pb2.Empty]') -> None:
         pass
@@ -1193,6 +1197,12 @@ class ModalClientBase(abc.ABC):
                 modal_proto.api_pb2.EndpointListRequest,
                 modal_proto.api_pb2.EndpointListResponse,
             ),
+            '/modal.client.ModalClient/EndpointStop': grpclib.const.Handler(
+                self.EndpointStop,
+                grpclib.const.Cardinality.UNARY_UNARY,
+                modal_proto.api_pb2.EndpointStopRequest,
+                modal_proto.api_pb2.EndpointStopResponse,
+            ),
             '/modal.client.ModalClient/EnvironmentCreate': grpclib.const.Handler(
                 self.EnvironmentCreate,
                 grpclib.const.Cardinality.UNARY_UNARY,
@@ -2399,6 +2409,12 @@ class ModalClientStub:
             modal_proto.api_pb2.EndpointListRequest,
             modal_proto.api_pb2.EndpointListResponse,
         )
+        self.EndpointStop = grpclib.client.UnaryUnaryMethod(
+            channel,
+            '/modal.client.ModalClient/EndpointStop',
+            modal_proto.api_pb2.EndpointStopRequest,
+            modal_proto.api_pb2.EndpointStopResponse,
+        )
         self.EnvironmentCreate = grpclib.client.UnaryUnaryMethod(
             channel,
             '/modal.client.ModalClient/EnvironmentCreate',