Create an Agent Sandbox Container Edition

Step 1: Create a warm pool by using SandboxSet

A warm pool is a set of pre-created Sandbox replicas managed by the SandboxSet CR. Applications obtain ready Sandboxes directly from the warm pool, which significantly improves delivery efficiency.

1. In the left-side navigation pane, click Custom Resources, choose the CRDs tab, and then click Create from YAML.

2. Use the following YAML to create a SandboxSet resource. ack-sandbox-manager automatically watches and identifies the resource, and initializes a sandbox template configuration named code-interpreter at the same time.

   apiVersion: agents.kruise.io/v1alpha1
   kind: SandboxSet
   metadata:
     name: code-interpreter
     namespace: default
   spec:
     runtimes:
     - name: csi           # Supports CSI mounting. Newly created Sandboxes are injected with the corresponding Sidecar
     - name: agent-runtime # Injects environment management tools such as envd
     replicas: 4
     template:
       metadata:
         labels:
           alibabacloud.com/acs: "true"
           alibabacloud.com/compute-class: agent-sandbox # Agent Sandbox instance type 
           alibabacloud.com/compute-qos: default # Compute QoS: default
       spec:
         automountServiceAccountToken: false
         containers:
         - image: registry-cn-zhangjiakou-vpc.ack.aliyuncs.com/acs/code-interpreter:v1.6 # Replace with the region where your cluster is deployed
           imagePullPolicy: IfNotPresent
           name: sandbox
           resources:
             limits:
               cpu: "1"
               memory: 1Gi
             requests:
               cpu: "1"
               memory: 1Gi
               ephemeral-storage: 30Gi
         terminationGracePeriodSeconds: 30

   For more information about the fields and advanced configurations of the SandboxSet CRD, see Sandbox CRD field descriptions.

   Important

   The code-interpreter image is intended only for verification in test environments. If you want to deploy it in a production environment, you must perform the necessary security hardening. Expand the section below to view the detailed image instructions.

   code-interpreter image usage instructions

   • Image pull: The registry-cn-zhangjiakou-vpc.ack.aliyuncs.com/acs/code-interpreter image is a sample image that ACS builds based on the e2b-code-interpreter project. It is compatible with the run_code operation of the E2B client. To speed up image pulls, you can change the region in the image address to your actual region name, or remove -vpc to pull the image over the Internet.

   • Use a custom image: If you want to use E2B code-interpreter (directly or as a base image), we recommend that you select a versioned image provided by ACS. ACS does not guarantee runtime compatibility with the official E2B latest image. If you need to use a custom image, make sure that the image meets the following conditions:

     1. It contains basic commands such as cp, mv, and mkdir.

     2. It contains bash, and the executable file is located at /bin/bash.

     When you use a custom image, the E2B run_code method is temporarily unavailable.

3. In the left-side navigation pane, click Pods, select the corresponding namespace, and view the created code-interpreter Sandbox.

   You can run the kubectl get sbs command to view SandboxSet resources, where AVAILABLE indicates the number of Sandboxes that are ready.

After a Sandbox is allocated, SandboxSet automatically triggers the replenishment process to maintain the number of instances in the warm pool.

Step 2: Obtain an Agent Sandbox Container Edition

Developers can also manage Sandbox resources by using the Kubernetes SDK.

Step 1: Enable in-place resource resizing for SandboxSet

In the spec.template.metadata.annotations of the SandboxSet, add scaling.alibabacloud.com/enable-inplace-resource-resize: "true" to allow Sandboxes in the warm pool to perform in-place VPA when they are allocated.

The following example creates only a warm pool with smaller specifications. You can specify specifications to dynamically scale out during subsequent allocations.

apiVersion: agents.kruise.io/v1alpha1
kind: SandboxSet
metadata:
  name: code-interpreter
spec:
  template:
    metadata:
      annotations:
        # When a Sandbox is allocated from the warm pool, allow in-place VPA
        scaling.alibabacloud.com/enable-inplace-resource-resize: "true"
    spec:
      containers:
        - name: interpreter
          image: xxx
          resources:
            requests:
              cpu: 500m     
              memory: 1Gi 
            limits:
              cpu: 500m 
              memory: 1Gi
  replicas: 5  # The number of warm instances

Step 2: Declare the target resource specifications during allocation

When you allocate an Agent Sandbox Container Edition from the warm pool, you can dynamically scale the CPU to the specified specifications in the following two ways:

from e2b_code_interpreter import Sandbox
sbx = Sandbox.create(template="code-interpreter", metadata={
    "e2b.agents.kruise.io/cpu-request": "1000m",
    "e2b.agents.kruise.io/cpu-limit": "1000m"
})

apiVersion: agents.kruise.io/v1alpha1
kind: SandboxClaim
metadata:
  name: code-interpreter-vpa-claim
  namespace: default
spec:
  templateName: code-interpreter
  replicas: 1
  claimTimeout: 5m
  ttlAfterCompleted: 15m
  inplaceUpdate:  # Declare the target resource specifications
    resources:
      requests:
        cpu: 1000m
      limits:
        cpu: 1000m

Prepare a domain name

For more information, see Add or delete an Authoritative Zone. Configure the domain names your.domain.com and *.your.domain.com, and resolve them to the address of the Ingress. If access is entirely within the ACS cluster, you can also directly use the in-cluster Headless Service address: sandbox-manager.sandbox-system.svc.cluster.local.

Apply for a certificate

The E2B client must request the backend over the HTTPS protocol. In production scenarios, we recommend that you use the following methods to apply for a certificate.

kubectl create secret tls sandbox-manager-tls \
        --cert=fullchain.pem \
        --key=privkey.pem -n sandbox-system

export SSL_CERT_FILE=/path/to/ca-fullchain.pem
python main.py # Use Python to call the E2B SDK

sudo certbot certonly \
  --manual \
  --preferred-challenges=dns \
  --email your-email@example.com \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  -d "your.domain.com" \
  -d "*.your.domain.com"

sudo cp /etc/letsencrypt/live/your.domain.com/fullchain.pem ./fullchain.pem
sudo cp /etc/letsencrypt/live/your.domain.com/privkey.pem ./privkey.pem

kubectl create secret tls sandbox-manager-tls \
  --cert=fullchain.pem \
  --key=privkey.pem \
  --namespace=sandbox-system

DNS resolution

Run the following command to view the endpoint information:

kubectl get ingress sandbox-manager -o jsonpath='{range .status.loadBalancer.ingress[*]}{.hostname}{.ip}{"\n"}{end}' -n sandbox-system

Based on the endpoint information in the output, configure DNS resolution for the domain name your.domain.com or *.your.domain.com. For more information about DNS resolution, see Quick links.

• If the output is an IP address (such as 47.114.***.***), resolve the host record *.your.domain.com to that IP address as an A record.

• If the output is a domain name (such as alb-*****62roo70i*****.cn-hangzhou.alb.aliyuncsslb.com), resolve the host record *.your.domain.com to the corresponding domain name as a CNAME record.

• If multiple endpoints are output, you can resolve the record to any one of the endpoints, or configure round-robin for all endpoints.

The ack-agent-sandbox-controller add-on fails to install. Error message: RAM Role AliyunCSManagedAgentSandboxRole is not granted

1. Go to the Resource Access Management (RAM) Roles page, search for AliyunCSManagedAgentSandboxRole, and then click the role name to open the role details page.

2. On the role details page, select AliyunCSManagedAgentSandboxRolePolicy, and then click Remove Permission.

3. Grant the permissions again. Click the authorization link.

Sandbox creation times out or returns an errore2b create sandbox: status 500

For various reasons, errors may occur while a sandbox is being obtained, which causes the allocation of a sandbox from the warm pool to fail. By default, Sandbox Manager and SandboxClaim Controller delete the sandbox on which an error occurred and retry allocating a new sandbox. If you need to retain the failed Sandbox instance and its corresponding Pod for troubleshooting, you can add the following parameters when you obtain the sandbox to skip the deletion:

from e2b_code_interpreter import Sandbox

sbx = Sandbox.create(template="some-template", timeout=3000, metadata={
    "e2b.agents.kruise.io/reserve-failed-sandbox": "true"
})

apiVersion: agents.kruise.io/v1alpha1
kind: SandboxClaim
metadata:
  name: code-interpreter-vpa-claim
  namespace: default
spec:
  templateName: code-interpreter
  replicas: 1
  reserveFailedSandbox: true