modal 1.6.4.dev7__tar.gz → 1.6.4.dev9__tar.gz

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.6.4.dev7
+Version: 1.6.4.dev9
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal/_image.py

@@ -584,6 +584,7 @@ class _Image(_Object, type_prefix="im"):
     ]  # added as mounts on any container referencing the Image, see `def _mount_layers`
     _added_python_source_set: frozenset[str]  # used to warn about missing mounts during auto-mount deprecation
     _metadata: api_pb2.ImageMetadata | None = None  # set on hydration, private for now
+    _cache_hit: bool | None = None  # set when built, True if an existing build was reused
     _is_empty: bool
     _build_steps: list[api_pb2.ImageBuildStep] | None = None
     # A failed image ID is only queryable through the client that performed the build.
@@ -832,6 +833,7 @@ class _Image(_Object, type_prefix="im"):
             result: api_pb2.GenericResult
             metadata: api_pb2.ImageMetadata | None = None
 
+            self._cache_hit = bool(resp.result.status)
             if resp.result.status:
                 # image already built
                 result = resp.result

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal/cli/image.py

@@ -42,6 +42,26 @@ def _print_result_summary(count: int) -> None:
     OutputManager.get().print(f"Showing {count} {result_label}")
 
 
+async def _build_and_publish(image: _Image, image_ref: str, app: _App, env: str, name: Optional[str]) -> None:
+    built_image = await image.build(app)
+
+    output_mgr = OutputManager.get()
+    if built_image._cache_hit:
+        message = f"Used a cached pull of [bold]{image_ref}[/bold] as [bold]{built_image.object_id}[/bold]"
+        # A digest reference can't change in the registry, so pulling it again would be a no-op
+        if "@" not in image_ref:
+            message += " [dim](Pass --force-build to pull it from the registry again.)[/dim]"
+        output_mgr.step_completed(message)
+    else:
+        output_mgr.step_completed(f"Pulled [bold]{image_ref}[/bold] as [bold]{built_image.object_id}[/bold]")
+    if name:
+        upgraded_image_name = _upgrade_image_name(name, fallback_environment_name=env)
+        await built_image.publish(upgraded_image_name)
+        output_mgr.step_completed(f"Image published as [bold magenta]{upgraded_image_name}[/bold magenta]! 🎉")
+        output_mgr.print("\nUse it with:\n")
+        output_mgr.print(Syntax(f'modal.Image.from_name("{upgraded_image_name}")', "python"))
+
+
 async def _registry_secret(
     secret_name: Optional[str], secret_vars: Optional[str], env: str
 ) -> tuple[Optional[_Secret], set[str]]:
@@ -56,6 +76,15 @@ async def _registry_secret(
     return _Secret.from_local_environ(keys), set(keys)
 
 
+def _check_registry_host(image_ref: str) -> None:
+    first, sep, _ = image_ref.partition("/")
+    # A leading path component is a registry host only if it looks like one; otherwise it's a Docker Hub name
+    if not sep or ("." not in first and ":" not in first and first != "localhost"):
+        raise click.UsageError(
+            f"IMAGE_REF must start with the registry host, e.g. docker.io/{image_ref} for a Docker Hub image."
+        )
+
+
 @image_cli.command("build", no_args_is_help=True)
 @click.argument("context_dir", metavar="CONTEXT_DIR")
 @click.option(
@@ -154,6 +183,100 @@ async def build(
     output_mgr.print(Syntax(f'modal.Image.from_name("{tag}")', "python"))
 
 
+@image_cli.command("pull", no_args_is_help=True)
+@click.argument("image_ref")
+@click.option(
+    "--name",
+    "name",
+    metavar="[ENV/]NAME[:TAG]",
+    help="Publish the pulled Image under this name. An ENV/ prefix publishes it to that Environment.",
+)
+@click.option(
+    "--registry-secret",
+    "registry_secret_name",
+    default=None,
+    help="Name of a modal.Secret holding registry credentials.",
+)
+@click.option(
+    "--registry-secret-from-env",
+    "registry_secret_vars",
+    default=None,
+    metavar="VAR[,VAR...]",
+    help=(
+        "Comma-separated local environment variable names holding registry credentials. "
+        "Cannot be combined with --registry-secret."
+    ),
+)
+@click.option(
+    "--force-build",
+    is_flag=True,
+    help="Pull the image from the registry again, replacing a cached Image.",
+)
+@env_option
+@synchronizer.create_blocking
+async def pull(
+    image_ref: str,
+    *,
+    name: Optional[str] = None,
+    registry_secret_name: Optional[str] = None,
+    registry_secret_vars: Optional[str] = None,
+    force_build: bool = False,
+    env: Optional[str] = None,
+) -> None:
+    """Pull an Image from a container registry into Modal.
+
+    The `image_ref` is a registry image name (and optional tag), as passed to `modal.Image.from_registry`.
+    It must start with the registry host, e.g. `docker.io/node:20` for a Docker Hub image.
+    If `--name` is provided, the Modal Image will also be published under that name.
+    Use `ENV/NAME` to publish to another Environment; `--env` still selects the Environment
+    used for the pull and for looking up `--registry-secret`.
+
+    Examples:
+
+    ```bash
+    modal image pull docker.io/node:20
+    modal image pull nvcr.io/nvidia/pytorch:25.01-py3 --name pytorch:25
+    modal image pull docker.io/node:20 --name prod/node:20
+    ```
+
+    Pass `--force-build` to pull a tag again after it changes in the registry, e.g. `latest`.
+
+    Private registries need credentials from a `modal.Secret`, either one that already exists
+    (`--registry-secret`) or one assembled from local environment variables (`--registry-secret-from-env`).
+    The kind of authentication follows from the keys in the credentials:
+
+    - AWS: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_REGION` (optionally `AWS_SESSION_TOKEN`),
+      or `AWS_ROLE_ARN` and `AWS_REGION` to assume a role with OIDC
+    - GCP: `SERVICE_ACCOUNT_JSON`, holding the service account key's JSON
+    - Username and password: `REGISTRY_USERNAME` and `REGISTRY_PASSWORD`
+
+    ```bash
+    # Authenticate with a named Secret
+    modal image pull ghcr.io/my-org/my-image --registry-secret my-registry-secret
+
+    # Authenticate with credentials in environment variables
+    modal image pull $AWS_ECR_URL/my-image \\
+        --registry-secret-from-env AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION
+    ```
+
+    """
+    _check_registry_host(image_ref)
+    env = ensure_env(env)
+    secret, keys = await _registry_secret(registry_secret_name, registry_secret_vars, env)
+    if secret is not None:
+        # Fail before creating the app; from_registry runs the same check during the build
+        try:
+            _infer_registry_auth_type(keys)
+        except InvalidError as exc:
+            raise click.UsageError(str(exc)) from exc
+    image = _Image.from_registry(image_ref, secret, force_build=force_build)
+
+    app = _App("modal-image-pull")
+    async with _run_app(app, environment_name=env, stream_output=False):
+        OutputManager.get().print(f"Pulling [bold]{image_ref}[/bold]")
+        await _build_and_publish(image, image_ref, app, env, name)
+
+
 @image_cli.command("logs", no_args_is_help=True)
 @click.argument("image_id")
 @click.option(

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal/client.pyi

@@ -87,7 +87,7 @@ class _Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.6.4.dev7",
+        version: str = "1.6.4.dev9",
         *,
         oauth_credentials: typing.Optional[_OAuthCredentials] = None,
     ):
@@ -304,7 +304,7 @@ class Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.6.4.dev7",
+        version: str = "1.6.4.dev9",
         *,
         oauth_credentials: typing.Optional[_OAuthCredentials] = None,
     ):

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal/functions.pyi

@@ -619,7 +619,7 @@ class Function(
 
     _call_generator: ___call_generator_spec
 
-    class __remote_spec(typing_extensions.Protocol[P_INNER, ReturnType_INNER]):
+    class __remote_spec(typing_extensions.Protocol[ReturnType_INNER, P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> ReturnType_INNER:
             """Calls the function remotely, executing it with the given arguments and returning the execution's result.
 
@@ -644,7 +644,7 @@ class Function(
             """
             ...
 
-    remote: __remote_spec[modal._functions.P, modal._functions.ReturnType]
+    remote: __remote_spec[modal._functions.ReturnType, modal._functions.P]
 
     class __remote_gen_spec(typing_extensions.Protocol):
         def __call__(self, /, *args, **kwargs) -> typing.Generator[typing.Any, None, None]:
@@ -694,7 +694,7 @@ class Function(
         """
         ...
 
-    class ___experimental_spawn_spec(typing_extensions.Protocol[P_INNER, ReturnType_INNER]):
+    class ___experimental_spawn_spec(typing_extensions.Protocol[ReturnType_INNER, P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> FunctionCall[ReturnType_INNER]:
             """[Experimental] Calls the function with the given arguments, without waiting for the results.
 
@@ -727,7 +727,7 @@ class Function(
             """
             ...
 
-    _experimental_spawn: ___experimental_spawn_spec[modal._functions.P, modal._functions.ReturnType]
+    _experimental_spawn: ___experimental_spawn_spec[modal._functions.ReturnType, modal._functions.P]
 
     class ___spawn_map_inner_spec(typing_extensions.Protocol[P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> None: ...
@@ -735,7 +735,7 @@ class Function(
 
     _spawn_map_inner: ___spawn_map_inner_spec[modal._functions.P]
 
-    class __spawn_spec(typing_extensions.Protocol[P_INNER, ReturnType_INNER]):
+    class __spawn_spec(typing_extensions.Protocol[ReturnType_INNER, P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> FunctionCall[ReturnType_INNER]:
             """Calls the function with the given arguments, without waiting for the results.
 
@@ -768,7 +768,7 @@ class Function(
             """
             ...
 
-    spawn: __spawn_spec[modal._functions.P, modal._functions.ReturnType]
+    spawn: __spawn_spec[modal._functions.ReturnType, modal._functions.P]
 
     @property
     def _raw_f_(self) -> collections.abc.Callable[..., typing.Any]: ...

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal/image.pyi

@@ -32,6 +32,7 @@ class Image(modal.object.Object):
     _deferred_mounts: collections.abc.Sequence[modal.mount.Mount]
     _added_python_source_set: frozenset[str]
     _metadata: typing.Optional[modal_proto.api_pb2.ImageMetadata]
+    _cache_hit: typing.Optional[bool]
     _is_empty: bool
     _build_steps: typing.Optional[list[modal_proto.api_pb2.ImageBuildStep]]
     _failed_build_attempt: typing.Optional[modal._image._FailedBuildAttempt]

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal/sandbox/_task_command_router_client.py

@@ -55,6 +55,36 @@ _STREAMING_STDIN_RESUMABLE_EXCEPTIONS = (
 )
 
 
+_shared_verifying_ssl_context_instance: ssl.SSLContext | None = None
+
+
+def _shared_verifying_ssl_context() -> ssl.SSLContext:
+    """Process-wide TLS context that verifies certificates against the system CAs.
+
+    Creating a context parses the system CA bundle while holding the GIL, so one
+    per channel blocks the event loop when many Sandboxes connect at once. Every
+    Sandbox's command router channel shares this context, so it must never be
+    modified; a change would apply to every connection in the process.
+    """
+    global _shared_verifying_ssl_context_instance
+    if _shared_verifying_ssl_context_instance is None:
+        _shared_verifying_ssl_context_instance = ssl.create_default_context()
+    return _shared_verifying_ssl_context_instance
+
+
+def _unverified_ssl_context() -> ssl.SSLContext:
+    """New TLS context that skips certificate and hostname checks.
+
+    Only for local e2e servers on localhost, which use self-signed certificates.
+    Built per call so that turning verification off cannot reach the shared
+    verifying context.
+    """
+    ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ssl_context.check_hostname = False
+    ssl_context.verify_mode = ssl.CERT_NONE
+    return ssl_context
+
+
 @retry(n_attempts=34, base_delay=1, max_delay=10, attempt_timeout=10, total_timeout=310)
 async def _connect_channel(channel: grpclib.client.Channel):
     """Connect to the command router channel.
@@ -320,13 +350,11 @@ class TaskCommandRouterClient:
                 raise ValueError(f"Task router URL must be https, got: {url}")
             ssl_context = None
         elif o.scheme == "https":
-            ssl_context = ssl.create_default_context()
             if is_localhost_client:
-                # Allow insecure TLS when the Modal server client points to localhost
-                # This is typically triggered from local e2e testing
                 logger.warning("Using insecure TLS for task command router because server client points to localhost")
-                ssl_context.check_hostname = False
-                ssl_context.verify_mode = ssl.CERT_NONE
+                ssl_context = _unverified_ssl_context()
+            else:
+                ssl_context = _shared_verifying_ssl_context()
         else:
             raise ValueError(f"Task router URL must be https, got: {url}")
 

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.6.4.dev7
+Version: 1.6.4.dev9
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0

{modal-1.6.4.dev7 → modal-1.6.4.dev9}/modal_proto/api_grpc.py

@@ -719,6 +719,14 @@ class ModalClientBase(abc.ABC):
     async def SandboxGetResourceUsage(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.SandboxGetResourceUsageRequest, modal_proto.api_pb2.SandboxGetResourceUsageResponse]') -> None:
         pass
 
+    @abc.abstractmethod
+    async def SandboxGetStats(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.SandboxGetStatsRequest, modal_proto.api_pb2.SandboxGetStatsResponse]') -> None:
+        pass
+
+    @abc.abstractmethod
+    async def SandboxGetStatsV2(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.SandboxGetStatsRequest, modal_proto.api_pb2.SandboxGetStatsResponse]') -> None:
+        pass
+
     @abc.abstractmethod
     async def SandboxGetTaskId(self, stream: 'grpclib.server.Stream[modal_proto.api_pb2.SandboxGetTaskIdRequest, modal_proto.api_pb2.SandboxGetTaskIdResponse]') -> None:
         pass
@@ -2175,6 +2183,18 @@ class ModalClientBase(abc.ABC):
                 modal_proto.api_pb2.SandboxGetResourceUsageRequest,
                 modal_proto.api_pb2.SandboxGetResourceUsageResponse,
             ),
+            '/modal.client.ModalClient/SandboxGetStats': grpclib.const.Handler(
+                self.SandboxGetStats,
+                grpclib.const.Cardinality.UNARY_UNARY,
+                modal_proto.api_pb2.SandboxGetStatsRequest,
+                modal_proto.api_pb2.SandboxGetStatsResponse,
+            ),
+            '/modal.client.ModalClient/SandboxGetStatsV2': grpclib.const.Handler(
+                self.SandboxGetStatsV2,
+                grpclib.const.Cardinality.UNARY_UNARY,
+                modal_proto.api_pb2.SandboxGetStatsRequest,
+                modal_proto.api_pb2.SandboxGetStatsResponse,
+            ),
             '/modal.client.ModalClient/SandboxGetTaskId': grpclib.const.Handler(
                 self.SandboxGetTaskId,
                 grpclib.const.Cardinality.UNARY_UNARY,
@@ -3837,6 +3857,18 @@ class ModalClientStub:
             modal_proto.api_pb2.SandboxGetResourceUsageRequest,
             modal_proto.api_pb2.SandboxGetResourceUsageResponse,
         )
+        self.SandboxGetStats = grpclib.client.UnaryUnaryMethod(
+            channel,
+            '/modal.client.ModalClient/SandboxGetStats',
+            modal_proto.api_pb2.SandboxGetStatsRequest,
+            modal_proto.api_pb2.SandboxGetStatsResponse,
+        )
+        self.SandboxGetStatsV2 = grpclib.client.UnaryUnaryMethod(
+            channel,
+            '/modal.client.ModalClient/SandboxGetStatsV2',
+            modal_proto.api_pb2.SandboxGetStatsRequest,
+            modal_proto.api_pb2.SandboxGetStatsResponse,
+        )
         self.SandboxGetTaskId = grpclib.client.UnaryUnaryMethod(
             channel,
             '/modal.client.ModalClient/SandboxGetTaskId',