nemo_gym.sandbox.providers.opensandbox.provider
nemo_gym.sandbox.providers.opensandbox.provider
OpenSandbox provider implementation.
Module Contents
Classes
Functions
Data
IMAGE_PULL_POLICY_ANNOTATION_EXTENSION_KEY
IMAGE_PULL_POLICY_EXTENSION_KEY
API
OpenSandbox server connection settings.
With the legacy httpx backend, keepalive_expiry_s must stay below the
server’s own keep-alive idle timeout (uvicorn defaults to 5s), or sockets are reused after the
server has closed them; null falls back to the SDK’s default transport only
when certificate verification is enabled and pooling is not disabled.
transport_backend=aiohttp uses Gym’s global client and connector limits;
provider-local pooling settings apply only to transport_backend=httpx.
With the explicit legacy combination transport_backend=httpx,
keepalive_expiry_s=None and tls_verify=True (pooling enabled), the
SDK owns its default transport. SDK 0.1.15 then discards command-status 410
bodies; lifecycle evidence remains available independently of that response.
tls_verify applies to every connection the provider opens (SDK transport
and PTY sockets) and is off by
default; set it for endpoints whose certificate the client can verify.
domain may carry its scheme (https://sandbox.example). The scheme is
moved into protocol and takes precedence over a configured protocol,
so every URL the provider builds itself (the PTY WebSocket target) agrees
with the SDK’s base URL; the SDK receives the host plus any path prefix
(sandbox.example:8080/prefix). The SDK would accept a scheme in
domain on its own, but the provider reads protocol directly, hence
the normalization here. Only scheme://host[:port][/path-prefix] is
accepted: a query string or fragment is a configuration error.
OpenSandbox create/reconnect retry settings.
Bases: OpenSandboxOutcomePolicy
Create/reconnect defaults; pending fail-fast remains an explicit execution constraint.
Optional control-plane checks after a command loses backend status.
Background status recovery shares timeout_s across diagnostic I/O only;
status requests and polling delays do not spend that diagnostic budget.
Every lookup also stays within the original status-recovery deadline.
Operator image policy for every sandbox this provider creates.
rewrites are ordered {from, to} prefix rules (a mirror, or a derived image that adds what a
deployment needs); auth maps an image prefix to {username, password}, longest prefix wins.
Tasks and servers keep naming the published image; the deployment decides what is pulled.
Operator assertion that direct sandbox IPs are mutually reachable.
Retry and timeout settings for SDK operations after create.
Bases: OutcomePolicyConfig
Runtime request policy; execution separately enforces replay safety and budgets.
Post-create probe settings.
Provider backed by the OpenSandbox SDK/server API.
Use Gym’s global HTTP pool, or the explicitly selected legacy backend.
Reconnect after SDK create so follow-up calls use a fresh SDK handle.
Opt-in OpenSandbox 1.1.0 text fallback; no supported structured equivalent is assumed.
The per-attempt budget and the SDK request timeout for one create of spec.
The create request blocks until the pod is allocated, so a configured request timeout
(create.request_timeout_s, else connection.request_timeout_s) is capped at the spec’s ready
timeout: an unschedulable pod then fails within one ready timeout instead of the full request
timeout. When none is configured the SDK’s own default stays, as the connection config the create
is given lives on the handle for the sandbox’s life.
The SDK’s readiness wait starts only once the request returns, so the attempt budget must hold the
request bound plus ready_timeout_s. A configured create.timeout_s is respected as is (a
warning names it when it is below that sum); otherwise the budget is that sum plus a slack.
Create a sandbox through opensandbox.Sandbox.create.
Run a command inside an OpenSandbox sandbox.
Run a command as a background execution polled via short requests.
The logs endpoint returns one combined stream, so unlike the foreground
path stdout carries both streams and stderr is set only when the
sandbox itself reports an error.
Gym enforces total_timeout_s itself: once its own deadline passes
while the command is still running, it interrupts the command and
returns the timeout result, as the session path does. execd reports its
own timeout kill only as a signal death, so its timer is moved past
Gym’s deadline and serves as a backstop.
One setup.commands entry as root, or as the image’s own user when the sandbox cannot switch
identity.
An image with a non-root USER on a cell that drops CAP_SETUID refuses the switch before the command
runs (nemo_gym.sandbox.transfer.exec_as_root degrades the same way), so a command written to no-op where
it does not apply gets to no-op, and one that needs root there fails on its own result, as before.
Return the provider-owned shared transport, building it on first use.
Interrupt a background command still running at Gym’s deadline; whether the interrupt was accepted.
Apply the same idempotent deletion and permission guards to handles and orphan cleanup.
Return the aiohttp client for one PTY session (same tls_verify as the SDK transport).
True only when execd itself reports the PTY session does not exist.
A proxy 404 (route not registered yet) lacks execd’s error code, and a failed check is treated as unknown so the attach proceeds as before.
Resolve the sandbox’s execd base URL, headers and request timeout.
Reap what a timed-out create left behind and raise the error that describes it.
Report provider_create_pending only for an observed Pending sandbox; otherwise report provider_create_timeout. The create policy chooses retry, with fail_fast_on_pending preventing another attempt for a Pending sandbox when configured.
Find and delete the sandbox a timed-out create request left behind; return what was found.
The request never returned, so the client holds no sandbox id: the sandbox is found through the
run’s attribution metadata and this attempt’s unique key. Each match is deleted and described
(id, state, reason, message) so the caller can tell a pod that never left
PENDING from one that was merely slow. Failures are logged, never raised: the create’s own
timeout error is the one the caller must see.
Add the configured default image pull policy to SDK create extensions.
Release sessions that ended on their own; their aiohttp client is
only freed by close(). Called from create/attach so the tracking
set cannot grow without bound.
One evidence path for exec and PTY, bounded by the caller’s existing deadline.
Lifecycle reasons do not identify the affected container, so even OOMKilled establishes only unavailability. A recognized control-plane container report or optional inspect can confirm OOM for the current user container.
Submit once unless the request never left the client.
Neither a 502 nor a timeout proves non-delivery, and command retry settings cannot
override that: the provider has no idempotency key or authoritative non-delivery
receipt. A connection that never opened is that receipt, so such a failure, and only
such a failure, is sent again within operations.retries.
Write one file into an OpenSandbox sandbox.
Close provider-owned resources.
Re-attach to an existing execd PTY session by id.
Terminate the sandbox and close local SDK resources.
Probe capabilities and verify the shared memory allocated at creation.
Rebuild a live handle from an OpenSandbox sandbox id via the SDK.
Running sandboxes are health-checked unless the caller opts out. A paused sandbox has no exec daemon to check; resume rebuilds its endpoints and performs the health check instead.
Create one sandbox through the configured OpenSandbox path.
Job attribution keys (team / user / workload / run) are merged into the
spec’s metadata (explicit spec keys win) so every sandbox is attributable via its labels.
Open an interactive execd PTY session inside a sandbox.
Download one file from an OpenSandbox sandbox, streamed to disk in chunks.
Resolve one client-reachable direct or server-proxied service URL.
Run a command inside an OpenSandbox sandbox.
Preserve background services that redirect their stdout and stderr.
Run loopback listeners in a foreground command owned by the collection.
Resolve a direct container IP, independently of client proxy mode.
Pause a sandbox and wait until it reports paused.
Local PTY clients are detached first, while execd can still answer the close handshake; server sessions are never deleted, so they remain attachable if the pause request fails. After resume, the Kubernetes backend has replaced the runtime (open a new PTY); the Docker backend thawed it (re-attach by id).
Compose’s pull_policy as the per-sandbox image pull policy extension (_resolve_extensions lets a
per-sandbox value win over the deployment default).
Read effective requests and limits from the deployment’s inspection endpoint.
Read execd’s existing snapshot; preserve its timestamp and measurement names.
Resume a paused sandbox and rebuild its SDK clients and endpoints.
One pause_resume_timeout_s deadline covers the request, endpoint
rebuild and readiness check. On timeout the server-side state is
unknown: reconnect and check status() before retrying. See
pause() for what happens to PTY sessions.
Return a descriptor for reattaching to this sandbox by id.
OpenSandbox sandboxes are reachable by id from any process that has the
connection config, so the id alone is enough to reconnect and no sandbox
server is needed to share one. scope is ignored: OpenSandbox has no
lease concept of its own.
Append validated peer aliases to the sandbox hosts file.
Return placement metadata required by the configured shared storage.
Mount a project directory, or the shared root for bootstrap when source is None.
Return the current OpenSandbox lifecycle status.
Upload one local file into an OpenSandbox sandbox.
A foreground command holds one of the shared HTTP pool’s connections for as long as it runs, so
max_connections running commands leave an upload none; a background command is polled and holds none.
Require explicit deployment support for inter-sandbox networking.
Require explicit deployment support for loopback TCP listeners.
Reject requirements without an operator-configured implementation.
Recognized per-sandbox create options read from SandboxSpec.provider_options.
image_auth, network_policy, platform, and volumes entries are passed through to the
OpenSandbox SDK, so their inner fields are validated by the SDK rather than here.
Operator-supplied capability probes and create-time runtime metadata.
Commands run as root in every new sandbox before it is handed out.
For repairs the deployment owns rather than the task: an end-of-life distro pointed at its archive, a tool the platform needs in every image. A failing command fails the create.
Shared host mount and optional deployment-specific placement metadata.
Bases: Filter
Hide the SDK warning emitted when terminate reaches its desired state.
Map a streamed SDK execution to (return_code, error_type, stderr_note).
The SDK fills in exit_code=0 itself once execd sends its completion
event. A stream that ends without a terminal event has an unknown outcome,
even if it contains partial logs or an error without an exit status.
Read only the current user container state from OpenSandbox inspect text.
Return whether a log read failed because execd’s output file for the command is gone.
execd keeps background output under os.TempDir() (/tmp unless TMPDIR is set), so
any command that empties /tmp deletes it, and the read fails with “error open combined
output file for command <id>: … no such file or directory”. Rereading cannot bring it back.
Match kill errors meaning the sandbox is already gone (terminate’s goal state).
Only the terminate path may treat this as success; other operations must keep failing loudly on not-found.
Whether an SDK create failure is the transport’s request timeout on the create request itself.
The request outlived the SDK’s request timeout, so the sandbox it asked for may exist without the
client ever learning its id, exactly as when the provider’s own attempt budget fires. The SDK wraps
transport errors (SandboxInternalException with the httpx timeout as its cause; newer SDKs raise a
SandboxTimeoutException), so the cause chain is inspected. A connect or pool timeout sent no request
and leaves nothing behind; a readiness timeout is raised with the id known and the sandbox already killed.
Select create recovery from observed facts and explicit boundary policy.
Read the known controller’s persisted current-container report from the control plane.
Command-status 410 bodies can come from the sandbox’s exec daemon, even through the server proxy. Only GET /sandboxes/{id} supplies this lifecycle evidence. Unknown layouts, mismatched identities and ambiguous container reports fail closed.
Whether the transport failed before the request left the client, so sending it again cannot run it twice.
The innermost transport error in the cause chain decides, as in the SWE-bench Pro patch capture. The SDK wraps
its client’s error, and Gym’s aiohttp transport re-raises every aiohttp connection error as
httpx.ConnectError, a reset after the request was written included; the aiohttp error underneath says
whether the connection ever opened. httpx raises ConnectError and ConnectTimeout only while it opens a
connection, and PoolTimeout while it waits for one.
The SDK’s management-API pieces that work without a sandbox handle: list and delete.
Bound this request’s Retry-After without searching other failure events’ causes.
Recognize execd’s pre-launch refusal, never user stdout/stderr or exception prose.
Split a configured OpenSandbox domain into (domain, scheme).
"https://sandbox.example:8080/prefix/" -> ("sandbox.example:8080/prefix", "https");
a bare host is returned unchanged with scheme None. Surrounding whitespace
is stripped either way. Only scheme://host[:port][/path-prefix] is accepted:
other schemes, a missing host, or a query string / fragment raise ValueError.
Validate a Kubernetes-compatible container image pull policy.