Conversation
…cation - Replaced instances of DetailedMetricsService with a unified metrics_service for consistency. - Updated metrics retrieval methods to use the new service, including summary, language usage, and pool statistics. - Enhanced metrics middleware to record API request metrics using the new service. - Removed redundant code and improved error handling in various metrics-related functions. - Adjusted API endpoints to reflect changes in metrics data structure and retrieval methods.
…ing logic - Updated the masking logic to only include non-proc/non-sys paths for bind mounts, ensuring compliance with OCI runtime restrictions. - Removed unnecessary readonly path handling, simplifying the hardening process. - Changed the container's read_only setting to False to accommodate Docker's put_archive API requirements while maintaining security through other hardening measures.
- Added comprehensive tests for file upload lifecycle, including validation of file summary and download functionality. - Introduced mocks for file and session services to simulate interactions during tests. - Improved assertions to ensure response data structure aligns with expected formats for LibreChat. - Updated existing tests to utilize new mock setups and validate additional response details.
…ality - Deleted the state management API endpoints from the codebase, including all associated models and services. - Updated documentation to reflect the removal of state-related features. - Adjusted API imports and response models to eliminate references to state management. - Refined authentication logic to only accept API keys via the `x-api-key` header, removing support for `Authorization` headers. - Enhanced functional tests to align with the updated API structure, ensuring comprehensive coverage of remaining functionalities.
- Added a new Dockerfile to build a unified image with multiple language runtimes and nsjail for secure code execution. - Created a docker-compose configuration to manage the API, Redis, and MinIO services, ensuring proper dependencies and health checks. - Implemented a base configuration for nsjail to define security policies and resource limits for sandboxed execution. - Refactored the application to replace container management with sandbox management, including updates to service initialization, health checks, and execution logic. - Enhanced settings to support sandbox configuration, including paths, limits, and cleanup intervals. - Updated relevant models and services to track and manage sandboxes instead of containers, ensuring a seamless transition to the new execution environment.
- Switched to using a pre-built Docker image for the API service, simplifying the build process. - Enhanced the docker-compose configuration with SSL support and environment variable management. - Adjusted the Dockerfile to improve Python package installation and added support for a dashboard. - Refined sandbox execution logic by using absolute paths and modifying permissions for sandbox directories. - Updated nsjail configuration to improve security and resource management, including disabling unnecessary namespaces. - Improved validation for nsjail availability in the configuration validator.
- Activated REPL mode in the Docker configuration for improved interactive code execution. - Updated execution commands for TypeScript and R languages to use relative paths, simplifying file handling. - Adjusted working directory references in the execution runner to utilize sandbox-specific paths. - Enhanced nsjail configuration to skip setsid() for REPL mode, ensuring stdin pipes remain connected. - Disabled default resource limits in nsjail to rely on Docker's resource management.
- Updated the environment configuration to clarify that only Python supports REPL pooling, enhancing performance by reducing startup time. - Simplified the Docker Compose setup by removing unnecessary volume mounts and optimizing resource limits for better performance. - Enhanced the nsjail configuration to ensure proper isolation and security during sandbox execution, including improved process management. - Refined the sandbox pool logic to focus solely on Python, eliminating unused configurations for other languages. - Improved documentation to reflect changes in sandbox behavior and configuration settings.
… access - Updated the authentication skip logic to permit access to the admin dashboard without authentication. - Retained existing exclusions for specified paths and OPTIONS method, ensuring consistent behavior for unauthenticated requests.
- Replaced Docker-based execution with nsjail for enhanced security and isolation. - Unified Docker image now includes all 12 language runtimes, simplifying the build process. - Updated environment configurations and Docker Compose files to reflect the new sandbox architecture. - Removed legacy Docker configurations and scripts, streamlining the setup for improved performance. - Enhanced documentation to clarify the new sandboxing approach and its benefits.
…ss management - Added 'init: true' to the Docker Compose configuration to utilize the tini init process, which helps in reaping zombie processes created by nsjail and Python child processes.
- Set the keep-alive timeout to 120 seconds in the server configuration for both HTTPS and API endpoints, enhancing connection management and performance.
…andboxing - Renamed configuration settings from `container_*` to `sandbox_*` for clarity and consistency. - Removed deprecated settings related to container management and streamlined resource limits. - Enhanced documentation to reflect changes in configuration structure and sandbox behavior. - Updated relevant code references to align with the new naming conventions, ensuring proper functionality across the application.
- Refactored SSL configuration settings to improve clarity and functionality, including renaming `enable_https` to `https_enabled` and adjusting the logic for SSL file validation. - Updated default values for SSL certificate paths and enhanced documentation for HTTPS settings. - Increased resource limits for execution time and file size, optimizing performance for sandbox operations. - Adjusted session cleanup interval and enabled orphan MinIO cleanup for better resource management.
…I workflows - Removed container-level resource limits from the Docker Compose file to streamline configuration. - Updated GitHub Actions workflow for Docker publishing to include all files in the docker directory. - Enhanced linting workflow by adding flake8 and black for improved code quality checks and added a new job for Docker build validation.
- Included a build context in the Docker Compose configuration for the API service, enabling local builds and enhancing flexibility in development.
- Changed several logger.info calls to logger.debug for less critical messages in the cleanup, execution, and session services to reduce log verbosity. - Updated logger messages in the FastAPI startup functions to reflect successful service starts without indicating success explicitly. - Enhanced request logging to differentiate between error and successful requests based on response status.
- Modified the default value for `enable_access_logs` to false in the configuration, shifting to a middleware-based approach for request logging. - Enhanced documentation in the configuration files to clarify logging levels and formats, including a detailed guide for log levels. - Adjusted several logger calls from `info` to `debug` to reduce verbosity in state and sandbox management logs. - Updated the logging setup to suppress uvicorn access logs, allowing the new middleware to handle request logging with status-aware levels.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- metrics.py: Use isinstance checks and assertions to narrow types from _execution_stats dict (mixed int/defaultdict values) - executor.py: Handle proc.returncode being Optional[int] with fallback Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The 0o777 chmod is intentional — each sandbox gets its own isolated directory that needs to be writable by the nsjail unprivileged user. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker/per-language Dockerfiles andbuild-images.sh.ENABLE_ACCESS_LOGS=false).Test plan
ENABLE_ACCESS_LOGS=truere-enables uvicorn access logs🤖 Generated with Claude Code