nemo_gym.sandbox.providers.ecs_fargate.engine
nemo_gym.sandbox.providers.ecs_fargate.engine
ECS Fargate sandbox engine.
Runs each sandbox as an ECS Fargate task behind an SSH sidecar. Defines the host-protocol
types (ExecResult, OutsideEndpoint, SandboxSpec) and the engine; the Gym-facing
provider adapter lives in provider.py.
Module Contents
Classes
Functions
Data
API
Configuration for the ECS Fargate sandbox.
ECS Fargate sandbox — async :class:Sandbox protocol.
Build EFS volume defs + mount points from spec.volumes.
A volume may name its own filesystem/access point or inherit the provider-level
efs_filesystem_id / efs_access_point_id defaults.
Synchronous stop for emergency cleanup (atexit handler).
Async HTTP client for the exec server (through the SSH tunnel).
Methods are coroutines so concurrent requests occupy event-loop slots rather than executor threads, scaling past asyncio’s default thread-pool cap.
Result of executing a command inside a sandbox.
Build Docker images via CodeBuild → ECR with content-hash caching.
Extract the region from an ECR repo URL like ‘123.dkr.ecr.us-west-2.amazonaws.com/repo’.
Run build for tag at most once across threads, returning the ECR image_url.
Concurrent callers wait on a shared in-flight event outside cls._lock (so one waiter
can’t stall other tags’ builds), then confirm via ECR — a failed build also sets the event.
Tag a local Docker image and push it to ECR. Returns the ECR URL.
Authenticate the local Docker daemon against an ECR registry.
Ensure src_image is present in the ECR mirror tag, mirroring it on demand if not.
Mirrors via a self-contained CodeBuild job (privileged DinD: login, pull, retag, push).
Concurrent callers dedup on a shared in-flight event, like :meth:ensure_image_built.
Return all image tags present in an ECR repository (paginated list_images).
Run a self-contained buildspec via CodeBuild (privileged DinD, NO_SOURCE).
A host-side URL that must be reachable from inside the sandbox.
The sandbox rewrites url for its network topology and exposes the resolved address as the environment variable env_var inside the container.
Per-problem sandbox requirements.
SSH sidecar container configuration.
exec_server_port set → exec-server mode (one-way tunnel). exec_server_port None → agent-server mode (two-way tunnel).
Manages an ssh -N subprocess with -L / -R tunnels.
EFS mount (ECS Fargate). Host bind mounts are unused on Fargate.
Best-effort delete of a transient S3 staging artifact; never raises.
Warns once if the role lacks s3:DeleteObject (objects then rely on a bucket lifecycle policy).
Task-def ephemeralStorage block, or None for Fargate’s implicit 20 GiB default.
Fargate accepts only 21-200 GiB explicitly (20 is valid only as the omitted default).
True for references already pointing at an ECR registry host.
Such references (e.g. an image resolved against the configured ECR mirror)
must be used as-is; reapplying the ecr_repository + sanitize rewrite
would corrupt the tag.
Validate a Fargate cpu (units) + memory (MiB) pair; Fargate rejects unsupported combinations.
Reject an image reference with characters outside the safe set (shell-injection guard).
Fetch a Secrets Manager secret → temp file (mode 0600).
Read ECS sandbox config from SSM Parameter Store.
Returns a dict matching the JSON structure written by Terraform (cluster, subnets, security_groups, roles, SSH ARNs, EFS, etc.). Results are cached per (region, project) for the process lifetime.