kaxil opened a new pull request, #75826: URL: https://github.com/apache/airflow/pull/75826
The sandbox configuration page was hard to use. One paragraph covered five backends' network rules in a single 30-line run of clauses, the same explanations (the sandbox lifetime, the `durable` and HITL refusals) appeared two or three times, and it quoted one-off measurements no reader could reproduce. It also had facts wrong. The rewrite is organised by what a user sets up: network access, packages, sizing and timeouts, credentials, getting a file out, sharing a sandbox between tasks, what happens on failure, and cleanup. Per-backend network behaviour is now one table, and other backend differences link to `backends.rst` instead of being repeated in each section. Every quoted error and output block comes from a run against the current code: the refusal messages from each backend, what the model sees from a real Modal sandbox (a failed `pip install`, a non-zero exit, a timeout), and the task logs of the export and attach examples run with `airflow dags test`. Corrections to what the old page said: - OpenSandbox, Boat and Islo also refuse `allow_egress_to_cidrs`; the page said only `sbx` and OpenShell do. Islo was not mentioned at all. - The `run_command` description does not tell the model its working directory; it tells it to run `pwd`. - A run with `exports` that ends with no sandbox (it never called a tool, or a timeout deleted the sandbox) fails the task; it does not just export nothing. - Errors inside the sandbox other than terminal ones go back to the model as retry prompts, not only a missing path or an oversized file. The hand-kept `SandboxToolset` parameter list is removed. The API reference renders the same parameters from the docstring, and the copy had already drifted (it was missing `exports`). In `backends.rst`, the `sbx` section now says `SandboxSpec.env` is written to `/etc/profile` (moved from the configuration page), and an anchor was added for "What differs between the backends" so the configuration page can link to it. `backends.rst` and `index.rst` have the same problems as the old configuration page, and two wrong claims I left alone here to keep this diff reviewable: `index.rst` still says only `sbx` and OpenShell refuse `allow_egress_to_cidrs`, and the "Command timeouts" bullet in `backends.rst` says a timeout destroys an `sbx` sandbox, while `sbx` kills the command inside the sandbox and destroys it only when the CLI itself hangs. Those pages are a follow-up. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
