mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-01-30 07:06:39 +08:00
## Summary Implement a flexible sandbox provider system supporting both self-managed (Docker) and SaaS (Aliyun Code Interpreter) backends for secure code execution in agent workflows. **Key Changes:** - ✅ Aliyun Code Interpreter provider using official `agentrun-sdk>=0.0.16` - ✅ Self-managed provider with gVisor (runsc) security - ✅ Arguments parameter support for dynamic code execution - ✅ Database-only configuration (removed fallback logic) - ✅ Configuration scripts for quick setup Issue #12479 ## Features ### 🔌 Provider Abstraction Layer **1. Self-Managed Provider** (`agent/sandbox/providers/self_managed.py`) - Wraps existing executor_manager HTTP API - gVisor (runsc) for secure container isolation - Configurable pool size, timeout, retry logic - Languages: Python, Node.js, JavaScript - ⚠️ **Requires**: gVisor installation, Docker, base images **2. Aliyun Code Interpreter** (`agent/sandbox/providers/aliyun_codeinterpreter.py`) - SaaS integration using official agentrun-sdk - Serverless microVM execution with auto-authentication - Hard timeout: 30 seconds max - Credentials: `AGENTRUN_ACCESS_KEY_ID`, `AGENTRUN_ACCESS_KEY_SECRET`, `AGENTRUN_ACCOUNT_ID`, `AGENTRUN_REGION` - Automatically wraps code to call `main()` function **3. E2B Provider** (`agent/sandbox/providers/e2b.py`) - Placeholder for future integration ### ⚙️ Configuration System - `conf/system_settings.json`: Default provider = `aliyun_codeinterpreter` - `agent/sandbox/client.py`: Enforces database-only configuration - Admin UI: `/admin/sandbox-settings` - Configuration validation via `validate_config()` method - Health checks for all providers ### 🎯 Key Capabilities **Arguments Parameter Support:** All providers support passing arguments to `main()` function: ```python # User code def main(name: str, count: int) -> dict: return {"message": f"Hello {name}!" * count} # Executed with: arguments={"name": "World", "count": 3} # Result: {"message": "Hello World!Hello World!Hello World!"} ``` **Self-Describing Providers:** Each provider implements `get_config_schema()` returning form configuration for Admin UI **Error Handling:** Structured `ExecutionResult` with stdout, stderr, exit_code, execution_time ## Configuration Scripts Two scripts for quick Aliyun sandbox setup: **Shell Script (requires jq):** ```bash source scripts/configure_aliyun_sandbox.sh ``` **Python Script (interactive):** ```bash python3 scripts/configure_aliyun_sandbox.py ``` ## Testing ```bash # Unit tests uv run pytest agent/sandbox/tests/test_providers.py -v # Aliyun provider tests uv run pytest agent/sandbox/tests/test_aliyun_codeinterpreter.py -v # Integration tests (requires credentials) uv run pytest agent/sandbox/tests/test_aliyun_codeinterpreter_integration.py -v # Quick SDK validation python3 agent/sandbox/tests/verify_sdk.py ``` **Test Coverage:** - 30 unit tests for provider abstraction - Provider-specific tests for Aliyun - Integration tests with real API - Security tests for executor_manager ## Documentation - `docs/develop/sandbox_spec.md` - Complete architecture specification - `agent/sandbox/tests/MIGRATION_GUIDE.md` - Migration from legacy sandbox - `agent/sandbox/tests/QUICKSTART.md` - Quick start guide - `agent/sandbox/tests/README.md` - Testing documentation ## Breaking Changes ⚠️ **Migration Required:** 1. **Directory Move**: `sandbox/` → `agent/sandbox/` - Update imports: `from sandbox.` → `from agent.sandbox.` 2. **Mandatory Configuration**: - SystemSettings must have `sandbox.provider_type` configured - Removed fallback default values - Configuration must exist in database (from `conf/system_settings.json`) 3. **Aliyun Credentials**: - Requires `AGENTRUN_*` environment variables (not `ALIYUN_*`) - `AGENTRUN_ACCOUNT_ID` is now required (Aliyun primary account ID) 4. **Self-Managed Provider**: - gVisor (runsc) must be installed for security - Install: `go install gvisor.dev/gvisor/runsc@latest` ## Database Schema Changes ```python # SystemSettings.value: CharField → TextField api/db/db_models.py: Changed for unlimited config length # SystemSettingsService.get_by_name(): Fixed query precision api/db/services/system_settings_service.py: startswith → exact match ``` ## Files Changed ### Backend (Python) - `agent/sandbox/providers/base.py` - SandboxProvider ABC interface - `agent/sandbox/providers/manager.py` - ProviderManager - `agent/sandbox/providers/self_managed.py` - Self-managed provider - `agent/sandbox/providers/aliyun_codeinterpreter.py` - Aliyun provider - `agent/sandbox/providers/e2b.py` - E2B provider (placeholder) - `agent/sandbox/client.py` - Unified client (enforces DB-only config) - `agent/tools/code_exec.py` - Updated to use provider system - `admin/server/services.py` - SandboxMgr with registry & validation - `admin/server/routes.py` - 5 sandbox API endpoints - `conf/system_settings.json` - Default: aliyun_codeinterpreter - `api/db/db_models.py` - TextField for SystemSettings.value - `api/db/services/system_settings_service.py` - Exact match query ### Frontend (TypeScript/React) - `web/src/pages/admin/sandbox-settings.tsx` - Settings UI - `web/src/services/admin-service.ts` - Sandbox service functions - `web/src/services/admin.service.d.ts` - Type definitions - `web/src/utils/api.ts` - Sandbox API endpoints ### Documentation - `docs/develop/sandbox_spec.md` - Architecture spec - `agent/sandbox/tests/MIGRATION_GUIDE.md` - Migration guide - `agent/sandbox/tests/QUICKSTART.md` - Quick start - `agent/sandbox/tests/README.md` - Testing guide ### Configuration Scripts - `scripts/configure_aliyun_sandbox.sh` - Shell script (jq) - `scripts/configure_aliyun_sandbox.py` - Python script ### Tests - `agent/sandbox/tests/test_providers.py` - 30 unit tests - `agent/sandbox/tests/test_aliyun_codeinterpreter.py` - Provider tests - `agent/sandbox/tests/test_aliyun_codeinterpreter_integration.py` - Integration tests - `agent/sandbox/tests/verify_sdk.py` - SDK validation ## Architecture ``` Admin UI → Admin API → SandboxMgr → ProviderManager → [SelfManaged|Aliyun|E2B] ↓ SystemSettings ``` ## Usage ### 1. Configure Provider **Via Admin UI:** 1. Navigate to `/admin/sandbox-settings` 2. Select provider (Aliyun Code Interpreter / Self-Managed) 3. Fill in configuration 4. Click "Test Connection" to verify 5. Click "Save" to apply **Via Configuration Scripts:** ```bash # Aliyun provider export AGENTRUN_ACCESS_KEY_ID="xxx" export AGENTRUN_ACCESS_KEY_SECRET="yyy" export AGENTRUN_ACCOUNT_ID="zzz" export AGENTRUN_REGION="cn-shanghai" source scripts/configure_aliyun_sandbox.sh ``` ### 2. Restart Service ```bash cd docker docker compose restart ragflow-server ``` ### 3. Execute Code in Agent ```python from agent.sandbox.client import execute_code result = execute_code( code='def main(name: str) -> dict: return {"message": f"Hello {name}!"}', language="python", timeout=30, arguments={"name": "World"} ) print(result.stdout) # {"message": "Hello World!"} ``` ## Troubleshooting ### "Container pool is busy" (Self-Managed) - **Cause**: Pool exhausted (default: 1 container in `.env`) - **Fix**: Increase `SANDBOX_EXECUTOR_MANAGER_POOL_SIZE` to 5+ ### "Sandbox provider type not configured" - **Cause**: Database missing configuration - **Fix**: Run config script or set via Admin UI ### "gVisor not found" - **Cause**: runsc not installed - **Fix**: `go install gvisor.dev/gvisor/runsc@latest && sudo cp ~/go/bin/runsc /usr/local/bin/` ### Aliyun authentication errors - **Cause**: Wrong environment variable names - **Fix**: Use `AGENTRUN_*` prefix (not `ALIYUN_*`) ## Checklist - [x] All tests passing (30 unit tests + integration tests) - [x] Documentation updated (spec, migration guide, quickstart) - [x] Type definitions added (TypeScript) - [x] Admin UI implemented - [x] Configuration validation - [x] Health checks implemented - [x] Error handling with structured results - [x] Breaking changes documented - [x] Configuration scripts created - [x] gVisor requirements documented Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
179 lines
5.2 KiB
Markdown
179 lines
5.2 KiB
Markdown
# Aliyun OpenSandbox Provider - 快速测试指南
|
||
|
||
## 测试说明
|
||
|
||
### 1. 单元测试(不需要真实凭据)
|
||
|
||
单元测试使用 mock,**不需要**真实的 Aliyun 凭据,可以随时运行。
|
||
|
||
```bash
|
||
# 运行 Aliyun 提供商的单元测试
|
||
pytest agent/sandbox/tests/test_aliyun_provider.py -v
|
||
|
||
# 预期输出:
|
||
# test_aliyun_provider.py::TestAliyunOpenSandboxProvider::test_provider_initialization PASSED
|
||
# test_aliyun_provider.py::TestAliyunOpenSandboxProvider::test_initialize_success PASSED
|
||
# ...
|
||
# ========================= 48 passed in 2.34s ==========================
|
||
```
|
||
|
||
### 2. 集成测试(需要真实凭据)
|
||
|
||
集成测试会调用真实的 Aliyun API,需要配置凭据。
|
||
|
||
#### 步骤 1: 配置环境变量
|
||
|
||
```bash
|
||
export ALIYUN_ACCESS_KEY_ID="LTAI5t..." # 替换为真实的 Access Key ID
|
||
export ALIYUN_ACCESS_KEY_SECRET="..." # 替换为真实的 Access Key Secret
|
||
export ALIYUN_REGION="cn-hangzhou" # 可选,默认为 cn-hangzhou
|
||
```
|
||
|
||
#### 步骤 2: 运行集成测试
|
||
|
||
```bash
|
||
# 运行所有集成测试
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py -v -m integration
|
||
|
||
# 运行特定测试
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_health_check -v
|
||
```
|
||
|
||
#### 步骤 3: 预期输出
|
||
|
||
```
|
||
test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_initialize_provider PASSED
|
||
test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_health_check PASSED
|
||
test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_execute_python_code PASSED
|
||
...
|
||
========================== 10 passed in 15.67s ==========================
|
||
```
|
||
|
||
### 3. 测试场景
|
||
|
||
#### 基础功能测试
|
||
|
||
```bash
|
||
# 健康检查
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_health_check -v
|
||
|
||
# 创建实例
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_create_python_instance -v
|
||
|
||
# 执行代码
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_execute_python_code -v
|
||
|
||
# 销毁实例
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_destroy_instance -v
|
||
```
|
||
|
||
#### 错误处理测试
|
||
|
||
```bash
|
||
# 代码执行错误
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_execute_python_code_with_error -v
|
||
|
||
# 超时处理
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunOpenSandboxIntegration::test_execute_python_code_timeout -v
|
||
```
|
||
|
||
#### 真实场景测试
|
||
|
||
```bash
|
||
# 数据处理工作流
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunRealWorldScenarios::test_data_processing_workflow -v
|
||
|
||
# 字符串操作
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunRealWorldScenarios::test_string_manipulation -v
|
||
|
||
# 多次执行
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py::TestAliyunRealWorldScenarios::test_multiple_executions_same_instance -v
|
||
```
|
||
|
||
## 常见问题
|
||
|
||
### Q: 没有凭据怎么办?
|
||
|
||
**A:** 运行单元测试即可,不需要真实凭据:
|
||
```bash
|
||
pytest agent/sandbox/tests/test_aliyun_provider.py -v
|
||
```
|
||
|
||
### Q: 如何跳过集成测试?
|
||
|
||
**A:** 使用 pytest 标记跳过:
|
||
```bash
|
||
# 只运行单元测试,跳过集成测试
|
||
pytest agent/sandbox/tests/ -v -m "not integration"
|
||
```
|
||
|
||
### Q: 集成测试失败怎么办?
|
||
|
||
**A:** 检查以下几点:
|
||
|
||
1. **凭据是否正确**
|
||
```bash
|
||
echo $ALIYUN_ACCESS_KEY_ID
|
||
echo $ALIYUN_ACCESS_KEY_SECRET
|
||
```
|
||
|
||
2. **网络连接是否正常**
|
||
```bash
|
||
curl -I https://opensandbox.cn-hangzhou.aliyuncs.com
|
||
```
|
||
|
||
3. **是否有 OpenSandbox 服务权限**
|
||
- 登录阿里云控制台
|
||
- 检查是否已开通 OpenSandbox 服务
|
||
- 检查 AccessKey 权限
|
||
|
||
4. **查看详细错误信息**
|
||
```bash
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py -v -s
|
||
```
|
||
|
||
### Q: 测试超时怎么办?
|
||
|
||
**A:** 增加超时时间或检查网络:
|
||
```bash
|
||
# 使用更长的超时
|
||
pytest agent/sandbox/tests/test_aliyun_integration.py -v --timeout=60
|
||
```
|
||
|
||
## 测试命令速查表
|
||
|
||
| 命令 | 说明 | 需要凭据 |
|
||
|------|------|---------|
|
||
| `pytest agent/sandbox/tests/test_aliyun_provider.py -v` | 单元测试 | ❌ |
|
||
| `pytest agent/sandbox/tests/test_aliyun_integration.py -v` | 集成测试 | ✅ |
|
||
| `pytest agent/sandbox/tests/ -v -m "not integration"` | 仅单元测试 | ❌ |
|
||
| `pytest agent/sandbox/tests/ -v -m integration` | 仅集成测试 | ✅ |
|
||
| `pytest agent/sandbox/tests/ -v` | 所有测试 | 部分需要 |
|
||
|
||
## 获取 Aliyun 凭据
|
||
|
||
1. 访问 [阿里云控制台](https://ram.console.aliyun.com/manage/ak)
|
||
2. 创建 AccessKey
|
||
3. 保存 AccessKey ID 和 AccessKey Secret
|
||
4. 设置环境变量
|
||
|
||
⚠️ **安全提示:**
|
||
- 不要在代码中硬编码凭据
|
||
- 使用环境变量或配置文件
|
||
- 定期轮换 AccessKey
|
||
- 限制 AccessKey 权限
|
||
|
||
## 下一步
|
||
|
||
1. ✅ **运行单元测试** - 验证代码逻辑
|
||
2. 🔧 **配置凭据** - 设置环境变量
|
||
3. 🚀 **运行集成测试** - 测试真实 API
|
||
4. 📊 **查看结果** - 确保所有测试通过
|
||
5. 🎯 **集成到系统** - 使用 admin API 配置提供商
|
||
|
||
## 需要帮助?
|
||
|
||
- 查看 [完整文档](README.md)
|
||
- 检查 [sandbox 规范](../../../../../docs/develop/sandbox_spec.md)
|
||
- 联系 RAGFlow 团队
|