examples: add envd-sandbox example with multi-language clients - #1302
Merged
kubernetes-prow[bot] merged 5 commits intoAug 13, 2026
Conversation
✅ Deploy Preview for agent-sandbox canceled.
|
kubernetes-prow
Bot
added
cncf-cla: yes
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds an ChangesEnvd Sandbox Example
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested labels: Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Dockerfile
participant Sandbox
participant envd_pod
participant test_client
Dockerfile->>Sandbox: provide envd container image
Sandbox->>envd_pod: create envd container
envd_pod-->>Sandbox: expose readiness on /health
test_client->>envd_pod: verify /health, /init, /files, and /metrics
envd_pod-->>test_client: return endpoint responses
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
examples/envd-sandbox/sandbox-envd.yaml (1)
32-59: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftDo not deploy an unauthenticated root execution API by default.
The manifest exposes envd’s process and filesystem API, while the image runs as root and the README confirms
--isnotfcmode has no authentication. Without a default-deny ingress policy or configured authentication, workloads that can reach the Pod IP can execute commands as root.
examples/envd-sandbox/sandbox-envd.yaml#L32-L59: enforce a safe access boundary, such as default-deny ingress with explicit router/client allowance, or require token-based authentication.examples/envd-sandbox/Dockerfile#L56-L69: avoid root where envd supports it, or clearly retain it only behind the enforced access boundary.examples/envd-sandbox/README.md#L135-L141: document the concrete secure manifest configuration rather than only warning about exposure.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/envd-sandbox/sandbox-envd.yaml` around lines 32 - 59, Secure the envd deployment by enforcing an access boundary in examples/envd-sandbox/sandbox-envd.yaml (lines 32-59), using default-deny ingress with explicit router/client allowance or configuring token authentication. In examples/envd-sandbox/Dockerfile (lines 56-69), avoid running envd as root where supported, or retain root only with the enforced boundary. In examples/envd-sandbox/README.md (lines 135-141), document the concrete secure manifest configuration and authentication or ingress requirements.Source: Linters/SAST tools
🧹 Nitpick comments (1)
examples/envd-sandbox/test_client.go (1)
71-73: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winWrap raw HTTP/decode errors with endpoint context.
Lines 73, 87, 107, 117, 129, and 134 return transport errors from specific endpoints without context, and line 138 returns decoded
json.Unmarshalerrors without endpoint context. Wrap these with a short endpoint/stage prefix using%w, e.g.fmt.Errorf("GET /metrics body decode: %w", err).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/envd-sandbox/test_client.go` around lines 71 - 73, Update the endpoint request and response-decoding error returns in the test client, including the health request and the other referenced endpoint operations, to wrap each underlying error with a concise endpoint/stage context using fmt.Errorf and %w. Preserve the original errors for unwrapping while distinguishing transport, body, and JSON decode failures.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/envd-sandbox/Dockerfile`:
- Around line 25-32: Pin ENVD_VERSION in examples/envd-sandbox/Dockerfile to a
reviewed immutable upstream tag or commit instead of the moving main branch, and
update the build example in examples/envd-sandbox/README.md lines 59-61 to use
the same revision.
In `@examples/envd-sandbox/test_client.ts`:
- Around line 65-111: Bound every verification request with a deadline: in
examples/envd-sandbox/test_client.ts lines 65-111, update each fetch call in the
verification checks to pass an AbortSignal.timeout(...) option; in
examples/envd-sandbox/test_client.sh lines 47-80, add both --connect-timeout and
--max-time to every curl invocation. Preserve the existing request behavior and
documented exit handling.
---
Outside diff comments:
In `@examples/envd-sandbox/sandbox-envd.yaml`:
- Around line 32-59: Secure the envd deployment by enforcing an access boundary
in examples/envd-sandbox/sandbox-envd.yaml (lines 32-59), using default-deny
ingress with explicit router/client allowance or configuring token
authentication. In examples/envd-sandbox/Dockerfile (lines 56-69), avoid running
envd as root where supported, or retain root only with the enforced boundary. In
examples/envd-sandbox/README.md (lines 135-141), document the concrete secure
manifest configuration and authentication or ingress requirements.
---
Nitpick comments:
In `@examples/envd-sandbox/test_client.go`:
- Around line 71-73: Update the endpoint request and response-decoding error
returns in the test client, including the health request and the other
referenced endpoint operations, to wrap each underlying error with a concise
endpoint/stage context using fmt.Errorf and %w. Preserve the original errors for
unwrapping while distinguishing transport, body, and JSON decode failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 74973dc6-751c-40fd-95cf-bcb60e5b4da5
📒 Files selected for processing (10)
examples/README.mdexamples/envd-sandbox/Dockerfileexamples/envd-sandbox/README.mdexamples/envd-sandbox/requirements.txtexamples/envd-sandbox/sandbox-envd.yamlexamples/envd-sandbox/test_client.goexamples/envd-sandbox/test_client.pyexamples/envd-sandbox/test_client.shexamples/envd-sandbox/test_client.tssite/content/docs/use-cases/examples/envd-sandbox/_index.md
dongjiang1989
force-pushed
the
add-envd
branch
2 times, most recently
from
July 28, 2026 12:21
6c850fb to
6db6497
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/envd-sandbox/Dockerfile`:
- Around line 34-35: Update the Dockerfile checkout flow around ENVD_VERSION to
support documented commit hashes as well as branches and tags, using a
clone-then-checkout approach rather than relying on git clone --branch. In
examples/envd-sandbox/Dockerfile lines 34-35, preserve shallow fetching where
compatible and ensure the requested revision is checked out;
examples/envd-sandbox/README.md lines 144-146 requires no direct change because
it documents the supported commit-pin behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 953f92bd-2d33-409f-a547-6694c2727fff
📒 Files selected for processing (10)
examples/README.mdexamples/envd-sandbox/Dockerfileexamples/envd-sandbox/README.mdexamples/envd-sandbox/requirements.txtexamples/envd-sandbox/sandbox-envd.yamlexamples/envd-sandbox/test_client.goexamples/envd-sandbox/test_client.pyexamples/envd-sandbox/test_client.shexamples/envd-sandbox/test_client.tssite/content/docs/use-cases/examples/envd-sandbox/_index.md
🚧 Files skipped from review as they are similar to previous changes (5)
- site/content/docs/use-cases/examples/envd-sandbox/_index.md
- examples/README.md
- examples/envd-sandbox/test_client.go
- examples/envd-sandbox/test_client.ts
- examples/envd-sandbox/test_client.sh
Add an envd-sandbox example that demonstrates running E2B's envd daemon as the container entrypoint inside an agent-sandbox. envd exposes an E2B-compatible REST and gRPC API on port 49983, providing filesystem operations, process execution, environment management, and metrics. Includes: - Multi-stage Dockerfile building envd from upstream e2b-dev/infra source (pinned to a specific commit for reproducible builds) - Sandbox CRD manifest with health probes and default-deny NetworkPolicy - Verification clients in Python, Go, TypeScript, and Shell (curl+jq) with request timeouts (AbortSignal / --connect-timeout / --max-time) - README with architecture diagram, step-by-step guide, security hardening checklist, and troubleshooting - Documentation site page under use-cases/examples Security: default-deny ingress NetworkPolicy restricts envd API access to pods labeled `access: envd-client`. All test clients use request timeouts. Go client wraps errors with endpoint context. Signed-off-by: dongjiang <dongjiang1989@126.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/envd-sandbox/README.md`:
- Line 148: Update the “Token authentication” item in the README to document the
actual bootstrap flow: allow the initial trusted POST /init request without a
token, set the daemon’s accessToken through that request, then require clients
to send X-Access-Token for subsequent requests. Remove the guidance to configure
E2B_ACCESS_TOKEN in the sandbox environment.
In `@examples/envd-sandbox/test_client.py`:
- Around line 76-84: Update the _init function’s /init request payload to use
the envd schema field envVars instead of envs, then verify the HELLO variable
through the /envs endpoint before returning success. Preserve the existing 204
status assertion and init success behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 272d33fa-f482-4f1b-b002-92a58629d72a
📒 Files selected for processing (10)
examples/README.mdexamples/envd-sandbox/Dockerfileexamples/envd-sandbox/README.mdexamples/envd-sandbox/requirements.txtexamples/envd-sandbox/sandbox-envd.yamlexamples/envd-sandbox/test_client.goexamples/envd-sandbox/test_client.pyexamples/envd-sandbox/test_client.shexamples/envd-sandbox/test_client.tssite/content/docs/use-cases/examples/envd-sandbox/_index.md
🚧 Files skipped from review as they are similar to previous changes (7)
- examples/README.md
- site/content/docs/use-cases/examples/envd-sandbox/_index.md
- examples/envd-sandbox/test_client.go
- examples/envd-sandbox/requirements.txt
- examples/envd-sandbox/sandbox-envd.yaml
- examples/envd-sandbox/test_client.ts
- examples/envd-sandbox/test_client.sh
- Fix ENVD_VERSION checkout to support commit hashes (clone + checkout) - Update token authentication docs to describe /init bootstrap flow - Change /init payload field from 'envs' to 'envVars' per envd schema - Add /envs verification after /init in test_client.py Signed-off-by: dongjiang <dongjiang1989@126.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/envd-sandbox/test_client.py`:
- Line 88: Update the assertion in the environment lookup test to remove the
full envs object from its failure message. Report only the missing HELLO key or
a sanitized list of environment keys, without exposing environment values or
credentials.
- Around line 83-88: Replace the runtime assert statements in the verification
flow of test_client.py with explicit conditional checks that raise
AssertionError when the status codes or HELLO environment value are unexpected.
Preserve the existing expected values and include the relevant response value or
envs data in each failure message.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: fa028029-8598-4474-a68e-d007c1b1b2df
📒 Files selected for processing (5)
examples/envd-sandbox/README.mdexamples/envd-sandbox/test_client.goexamples/envd-sandbox/test_client.pyexamples/envd-sandbox/test_client.shexamples/envd-sandbox/test_client.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- examples/envd-sandbox/README.md
- examples/envd-sandbox/test_client.go
- examples/envd-sandbox/test_client.ts
- examples/envd-sandbox/test_client.sh
- Replace assert statements with explicit if checks in _init() - Remove full envs object from failure message to avoid exposing values - Report only present keys in HELLO verification error Signed-off-by: dongjiang <dongjiang1989@126.com>
There was a problem hiding this comment.
Pull request overview
Adds a new envd-sandbox example to the repository and docs site, demonstrating how to run E2B’s envd daemon as the container entrypoint inside an agents.x-k8s.io/v1beta1 Sandbox, along with multi-language verification clients to exercise the REST API.
Changes:
- Add a new docs-site page that includes the example’s README content via Hugo mounts.
- Add the
examples/envd-sandboxexample (Dockerfile, Sandbox + NetworkPolicy manifest, README, and verification clients in Go/Python/TypeScript/Shell). - Link the new example from
examples/README.md.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| site/content/docs/use-cases/examples/envd-sandbox/_index.md | Adds docs-site entry that includes the example README. |
| examples/README.md | Adds the envd-sandbox entry to the examples index. |
| examples/envd-sandbox/README.md | Provides end-to-end instructions, architecture, security notes, and troubleshooting. |
| examples/envd-sandbox/Dockerfile | Multi-stage build that compiles envd from upstream and packages it into a Debian runtime image. |
| examples/envd-sandbox/sandbox-envd.yaml | Adds a Sandbox manifest plus default-deny ingress NetworkPolicy for the envd API port. |
| examples/envd-sandbox/requirements.txt | Pins Python dependency for the verification client. |
| examples/envd-sandbox/test_client.go | Adds Go verification client for envd REST endpoints. |
| examples/envd-sandbox/test_client.py | Adds Python verification client for envd REST endpoints. |
| examples/envd-sandbox/test_client.ts | Adds TypeScript verification client for envd REST endpoints. |
| examples/envd-sandbox/test_client.sh | Adds shell (curl+jq) verification client for envd REST endpoints. |
- test_client.go: handle json.Marshal error in init test - test_client.go: check all multipart form construction errors (WriteField, CreateFormFile, Write, Close) - test_client.go: validate download HTTP status code and handle io.ReadAll errors - test_client.sh: check upload HTTP status code and use trap for temp file cleanup Signed-off-by: dongjiang <dongjiang1989@126.com>
Member
Author
|
/test presubmit-agent-sandbox-benchmarks-kops-gcp-cilium |
Collaborator
|
/lgtm |
kubernetes-prow
Bot
added
the
lgtm
aditya-shantanu
left a comment
aditya-shantanu
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed at 9b676c6. No findings.
janetkuo
reviewed
Aug 13, 2026
| # envd resolves file paths relative to the execution user's home directory | ||
| # (default: /root). Running as root ensures file operations work correctly. | ||
| # In production, use sandbox-router or network policies for access control. | ||
| WORKDIR /root |
Member
There was a problem hiding this comment.
For improved security, especially in a sandbox environment meant for running arbitrary code, it's recommended to run the daemon as a non-root user by default.
IIUC running envd as non-root requires additional configuration.
Member
Author
There was a problem hiding this comment.
Thanks @janetkuo
The envd daemon keeps root privileges, and business child processes drop privileges to the unprivileged user (UID 1000).
ref:
envd runs as root (required for PTY/process management), but user-spawned subprocesses now execute as an unprivileged user (uid 1000) by setting defaultUser in the /init request. This follows the e2b-dev security model and limits blast radius if user code is malicious. Changes: - Dockerfile: Create non-root 'user' with home /home/user - Test clients: Pass defaultUser: "user" in /init payload - README: Document the security model (envd root, user code non-root) Reference: https://github.com/e2b-dev/infra/blob/main/packages/envd/debug.Dockerfile Signed-off-by: dongjiang <dongjiang@example.com> Signed-off-by: dongjiang <dongjiang1989@126.com>
kubernetes-prow
Bot
removed
the
lgtm
Member
Author
|
/test presubmit-agent-sandbox-benchmarks-kops-gcp-cilium /test presubmit-agent-sandbox-benchmarks-kops-gcp-kindnet |
Member
Author
|
/test presubmit-agent-sandbox-benchmarks-kops-gcp-cilium |
aditya-shantanu
approved these changes
Aug 13, 2026
Collaborator
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aditya-shantanu, dongjiang1989 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Add an
envd-sandboxexample that demonstrates running E2B's envd daemon as the container entrypoint inside an agent-sandbox. envd exposes an E2B-compatible REST and gRPC API on port 49983, providing:/health,/metrics,/init,/envs,/filesThis example includes:
agents.x-k8s.io/v1beta1) with health probesenvd runs with
--isnotfc(skip Firecracker MMDS polling) and--no-cgroupsflags for compatibility with standard Linux containers without KVM or kata-deploy.The example has been fully verified on both local Docker and Kind cluster with all four client languages.
Which issue(s) this PR is related to:
N/A — new example contribution
Release Note
Summary by CodeRabbit
envd-sandboxexample running an E2B-compatible REST (and gRPC) service withenvdas the container entrypoint, exposing port49983./healthprobes and a default-deny ingress NetworkPolicy./health,/init,/files, and/metrics.