mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-01-29 22:56:36 +08:00
## Summary Implement a flexible sandbox provider system supporting both self-managed (Docker) and SaaS (Aliyun Code Interpreter) backends for secure code execution in agent workflows. **Key Changes:** - ✅ Aliyun Code Interpreter provider using official `agentrun-sdk>=0.0.16` - ✅ Self-managed provider with gVisor (runsc) security - ✅ Arguments parameter support for dynamic code execution - ✅ Database-only configuration (removed fallback logic) - ✅ Configuration scripts for quick setup Issue #12479 ## Features ### 🔌 Provider Abstraction Layer **1. Self-Managed Provider** (`agent/sandbox/providers/self_managed.py`) - Wraps existing executor_manager HTTP API - gVisor (runsc) for secure container isolation - Configurable pool size, timeout, retry logic - Languages: Python, Node.js, JavaScript - ⚠️ **Requires**: gVisor installation, Docker, base images **2. Aliyun Code Interpreter** (`agent/sandbox/providers/aliyun_codeinterpreter.py`) - SaaS integration using official agentrun-sdk - Serverless microVM execution with auto-authentication - Hard timeout: 30 seconds max - Credentials: `AGENTRUN_ACCESS_KEY_ID`, `AGENTRUN_ACCESS_KEY_SECRET`, `AGENTRUN_ACCOUNT_ID`, `AGENTRUN_REGION` - Automatically wraps code to call `main()` function **3. E2B Provider** (`agent/sandbox/providers/e2b.py`) - Placeholder for future integration ### ⚙️ Configuration System - `conf/system_settings.json`: Default provider = `aliyun_codeinterpreter` - `agent/sandbox/client.py`: Enforces database-only configuration - Admin UI: `/admin/sandbox-settings` - Configuration validation via `validate_config()` method - Health checks for all providers ### 🎯 Key Capabilities **Arguments Parameter Support:** All providers support passing arguments to `main()` function: ```python # User code def main(name: str, count: int) -> dict: return {"message": f"Hello {name}!" * count} # Executed with: arguments={"name": "World", "count": 3} # Result: {"message": "Hello World!Hello World!Hello World!"} ``` **Self-Describing Providers:** Each provider implements `get_config_schema()` returning form configuration for Admin UI **Error Handling:** Structured `ExecutionResult` with stdout, stderr, exit_code, execution_time ## Configuration Scripts Two scripts for quick Aliyun sandbox setup: **Shell Script (requires jq):** ```bash source scripts/configure_aliyun_sandbox.sh ``` **Python Script (interactive):** ```bash python3 scripts/configure_aliyun_sandbox.py ``` ## Testing ```bash # Unit tests uv run pytest agent/sandbox/tests/test_providers.py -v # Aliyun provider tests uv run pytest agent/sandbox/tests/test_aliyun_codeinterpreter.py -v # Integration tests (requires credentials) uv run pytest agent/sandbox/tests/test_aliyun_codeinterpreter_integration.py -v # Quick SDK validation python3 agent/sandbox/tests/verify_sdk.py ``` **Test Coverage:** - 30 unit tests for provider abstraction - Provider-specific tests for Aliyun - Integration tests with real API - Security tests for executor_manager ## Documentation - `docs/develop/sandbox_spec.md` - Complete architecture specification - `agent/sandbox/tests/MIGRATION_GUIDE.md` - Migration from legacy sandbox - `agent/sandbox/tests/QUICKSTART.md` - Quick start guide - `agent/sandbox/tests/README.md` - Testing documentation ## Breaking Changes ⚠️ **Migration Required:** 1. **Directory Move**: `sandbox/` → `agent/sandbox/` - Update imports: `from sandbox.` → `from agent.sandbox.` 2. **Mandatory Configuration**: - SystemSettings must have `sandbox.provider_type` configured - Removed fallback default values - Configuration must exist in database (from `conf/system_settings.json`) 3. **Aliyun Credentials**: - Requires `AGENTRUN_*` environment variables (not `ALIYUN_*`) - `AGENTRUN_ACCOUNT_ID` is now required (Aliyun primary account ID) 4. **Self-Managed Provider**: - gVisor (runsc) must be installed for security - Install: `go install gvisor.dev/gvisor/runsc@latest` ## Database Schema Changes ```python # SystemSettings.value: CharField → TextField api/db/db_models.py: Changed for unlimited config length # SystemSettingsService.get_by_name(): Fixed query precision api/db/services/system_settings_service.py: startswith → exact match ``` ## Files Changed ### Backend (Python) - `agent/sandbox/providers/base.py` - SandboxProvider ABC interface - `agent/sandbox/providers/manager.py` - ProviderManager - `agent/sandbox/providers/self_managed.py` - Self-managed provider - `agent/sandbox/providers/aliyun_codeinterpreter.py` - Aliyun provider - `agent/sandbox/providers/e2b.py` - E2B provider (placeholder) - `agent/sandbox/client.py` - Unified client (enforces DB-only config) - `agent/tools/code_exec.py` - Updated to use provider system - `admin/server/services.py` - SandboxMgr with registry & validation - `admin/server/routes.py` - 5 sandbox API endpoints - `conf/system_settings.json` - Default: aliyun_codeinterpreter - `api/db/db_models.py` - TextField for SystemSettings.value - `api/db/services/system_settings_service.py` - Exact match query ### Frontend (TypeScript/React) - `web/src/pages/admin/sandbox-settings.tsx` - Settings UI - `web/src/services/admin-service.ts` - Sandbox service functions - `web/src/services/admin.service.d.ts` - Type definitions - `web/src/utils/api.ts` - Sandbox API endpoints ### Documentation - `docs/develop/sandbox_spec.md` - Architecture spec - `agent/sandbox/tests/MIGRATION_GUIDE.md` - Migration guide - `agent/sandbox/tests/QUICKSTART.md` - Quick start - `agent/sandbox/tests/README.md` - Testing guide ### Configuration Scripts - `scripts/configure_aliyun_sandbox.sh` - Shell script (jq) - `scripts/configure_aliyun_sandbox.py` - Python script ### Tests - `agent/sandbox/tests/test_providers.py` - 30 unit tests - `agent/sandbox/tests/test_aliyun_codeinterpreter.py` - Provider tests - `agent/sandbox/tests/test_aliyun_codeinterpreter_integration.py` - Integration tests - `agent/sandbox/tests/verify_sdk.py` - SDK validation ## Architecture ``` Admin UI → Admin API → SandboxMgr → ProviderManager → [SelfManaged|Aliyun|E2B] ↓ SystemSettings ``` ## Usage ### 1. Configure Provider **Via Admin UI:** 1. Navigate to `/admin/sandbox-settings` 2. Select provider (Aliyun Code Interpreter / Self-Managed) 3. Fill in configuration 4. Click "Test Connection" to verify 5. Click "Save" to apply **Via Configuration Scripts:** ```bash # Aliyun provider export AGENTRUN_ACCESS_KEY_ID="xxx" export AGENTRUN_ACCESS_KEY_SECRET="yyy" export AGENTRUN_ACCOUNT_ID="zzz" export AGENTRUN_REGION="cn-shanghai" source scripts/configure_aliyun_sandbox.sh ``` ### 2. Restart Service ```bash cd docker docker compose restart ragflow-server ``` ### 3. Execute Code in Agent ```python from agent.sandbox.client import execute_code result = execute_code( code='def main(name: str) -> dict: return {"message": f"Hello {name}!"}', language="python", timeout=30, arguments={"name": "World"} ) print(result.stdout) # {"message": "Hello World!"} ``` ## Troubleshooting ### "Container pool is busy" (Self-Managed) - **Cause**: Pool exhausted (default: 1 container in `.env`) - **Fix**: Increase `SANDBOX_EXECUTOR_MANAGER_POOL_SIZE` to 5+ ### "Sandbox provider type not configured" - **Cause**: Database missing configuration - **Fix**: Run config script or set via Admin UI ### "gVisor not found" - **Cause**: runsc not installed - **Fix**: `go install gvisor.dev/gvisor/runsc@latest && sudo cp ~/go/bin/runsc /usr/local/bin/` ### Aliyun authentication errors - **Cause**: Wrong environment variable names - **Fix**: Use `AGENTRUN_*` prefix (not `ALIYUN_*`) ## Checklist - [x] All tests passing (30 unit tests + integration tests) - [x] Documentation updated (spec, migration guide, quickstart) - [x] Type definitions added (TypeScript) - [x] Admin UI implemented - [x] Configuration validation - [x] Health checks implemented - [x] Error handling with structured results - [x] Breaking changes documented - [x] Configuration scripts created - [x] gVisor requirements documented Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
424 lines
14 KiB
Python
424 lines
14 KiB
Python
#
|
|
# Copyright 2025 The InfiniFlow Authors. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
#
|
|
|
|
"""
|
|
Unit tests for sandbox provider abstraction layer.
|
|
"""
|
|
|
|
import pytest
|
|
from unittest.mock import Mock, patch
|
|
import requests
|
|
|
|
from agent.sandbox.providers.base import SandboxProvider, SandboxInstance, ExecutionResult
|
|
from agent.sandbox.providers.manager import ProviderManager
|
|
from agent.sandbox.providers.self_managed import SelfManagedProvider
|
|
|
|
|
|
class TestSandboxDataclasses:
|
|
"""Test sandbox dataclasses."""
|
|
|
|
def test_sandbox_instance_creation(self):
|
|
"""Test SandboxInstance dataclass creation."""
|
|
instance = SandboxInstance(
|
|
instance_id="test-123",
|
|
provider="self_managed",
|
|
status="running",
|
|
metadata={"language": "python"}
|
|
)
|
|
|
|
assert instance.instance_id == "test-123"
|
|
assert instance.provider == "self_managed"
|
|
assert instance.status == "running"
|
|
assert instance.metadata == {"language": "python"}
|
|
|
|
def test_sandbox_instance_default_metadata(self):
|
|
"""Test SandboxInstance with None metadata."""
|
|
instance = SandboxInstance(
|
|
instance_id="test-123",
|
|
provider="self_managed",
|
|
status="running",
|
|
metadata=None
|
|
)
|
|
|
|
assert instance.metadata == {}
|
|
|
|
def test_execution_result_creation(self):
|
|
"""Test ExecutionResult dataclass creation."""
|
|
result = ExecutionResult(
|
|
stdout="Hello, World!",
|
|
stderr="",
|
|
exit_code=0,
|
|
execution_time=1.5,
|
|
metadata={"status": "success"}
|
|
)
|
|
|
|
assert result.stdout == "Hello, World!"
|
|
assert result.stderr == ""
|
|
assert result.exit_code == 0
|
|
assert result.execution_time == 1.5
|
|
assert result.metadata == {"status": "success"}
|
|
|
|
def test_execution_result_default_metadata(self):
|
|
"""Test ExecutionResult with None metadata."""
|
|
result = ExecutionResult(
|
|
stdout="output",
|
|
stderr="error",
|
|
exit_code=1,
|
|
execution_time=0.5,
|
|
metadata=None
|
|
)
|
|
|
|
assert result.metadata == {}
|
|
|
|
|
|
class TestProviderManager:
|
|
"""Test ProviderManager functionality."""
|
|
|
|
def test_manager_initialization(self):
|
|
"""Test ProviderManager initialization."""
|
|
manager = ProviderManager()
|
|
|
|
assert manager.current_provider is None
|
|
assert manager.current_provider_name is None
|
|
assert not manager.is_configured()
|
|
|
|
def test_set_provider(self):
|
|
"""Test setting a provider."""
|
|
manager = ProviderManager()
|
|
mock_provider = Mock(spec=SandboxProvider)
|
|
|
|
manager.set_provider("self_managed", mock_provider)
|
|
|
|
assert manager.current_provider == mock_provider
|
|
assert manager.current_provider_name == "self_managed"
|
|
assert manager.is_configured()
|
|
|
|
def test_get_provider(self):
|
|
"""Test getting the current provider."""
|
|
manager = ProviderManager()
|
|
mock_provider = Mock(spec=SandboxProvider)
|
|
|
|
manager.set_provider("self_managed", mock_provider)
|
|
|
|
assert manager.get_provider() == mock_provider
|
|
|
|
def test_get_provider_name(self):
|
|
"""Test getting the current provider name."""
|
|
manager = ProviderManager()
|
|
mock_provider = Mock(spec=SandboxProvider)
|
|
|
|
manager.set_provider("self_managed", mock_provider)
|
|
|
|
assert manager.get_provider_name() == "self_managed"
|
|
|
|
def test_get_provider_when_not_set(self):
|
|
"""Test getting provider when none is set."""
|
|
manager = ProviderManager()
|
|
|
|
assert manager.get_provider() is None
|
|
assert manager.get_provider_name() is None
|
|
|
|
|
|
class TestSelfManagedProvider:
|
|
"""Test SelfManagedProvider implementation."""
|
|
|
|
def test_provider_initialization(self):
|
|
"""Test provider initialization."""
|
|
provider = SelfManagedProvider()
|
|
|
|
assert provider.endpoint == "http://localhost:9385"
|
|
assert provider.timeout == 30
|
|
assert provider.max_retries == 3
|
|
assert provider.pool_size == 10
|
|
assert not provider._initialized
|
|
|
|
@patch('requests.get')
|
|
def test_initialize_success(self, mock_get):
|
|
"""Test successful initialization."""
|
|
mock_response = Mock()
|
|
mock_response.status_code = 200
|
|
mock_get.return_value = mock_response
|
|
|
|
provider = SelfManagedProvider()
|
|
result = provider.initialize({
|
|
"endpoint": "http://test-endpoint:9385",
|
|
"timeout": 60,
|
|
"max_retries": 5,
|
|
"pool_size": 20
|
|
})
|
|
|
|
assert result is True
|
|
assert provider.endpoint == "http://test-endpoint:9385"
|
|
assert provider.timeout == 60
|
|
assert provider.max_retries == 5
|
|
assert provider.pool_size == 20
|
|
assert provider._initialized
|
|
mock_get.assert_called_once_with("http://test-endpoint:9385/healthz", timeout=5)
|
|
|
|
@patch('requests.get')
|
|
def test_initialize_failure(self, mock_get):
|
|
"""Test initialization failure."""
|
|
mock_get.side_effect = Exception("Connection error")
|
|
|
|
provider = SelfManagedProvider()
|
|
result = provider.initialize({"endpoint": "http://invalid:9385"})
|
|
|
|
assert result is False
|
|
assert not provider._initialized
|
|
|
|
def test_initialize_default_config(self):
|
|
"""Test initialization with default config."""
|
|
with patch('requests.get') as mock_get:
|
|
mock_response = Mock()
|
|
mock_response.status_code = 200
|
|
mock_get.return_value = mock_response
|
|
|
|
provider = SelfManagedProvider()
|
|
result = provider.initialize({})
|
|
|
|
assert result is True
|
|
assert provider.endpoint == "http://localhost:9385"
|
|
assert provider.timeout == 30
|
|
|
|
def test_create_instance_python(self):
|
|
"""Test creating a Python instance."""
|
|
provider = SelfManagedProvider()
|
|
provider._initialized = True
|
|
|
|
instance = provider.create_instance("python")
|
|
|
|
assert instance.provider == "self_managed"
|
|
assert instance.status == "running"
|
|
assert instance.metadata["language"] == "python"
|
|
assert instance.metadata["endpoint"] == "http://localhost:9385"
|
|
assert len(instance.instance_id) > 0 # Verify instance_id exists
|
|
|
|
def test_create_instance_nodejs(self):
|
|
"""Test creating a Node.js instance."""
|
|
provider = SelfManagedProvider()
|
|
provider._initialized = True
|
|
|
|
instance = provider.create_instance("nodejs")
|
|
|
|
assert instance.metadata["language"] == "nodejs"
|
|
|
|
def test_create_instance_not_initialized(self):
|
|
"""Test creating instance when provider not initialized."""
|
|
provider = SelfManagedProvider()
|
|
|
|
with pytest.raises(RuntimeError, match="Provider not initialized"):
|
|
provider.create_instance("python")
|
|
|
|
@patch('requests.post')
|
|
def test_execute_code_success(self, mock_post):
|
|
"""Test successful code execution."""
|
|
mock_response = Mock()
|
|
mock_response.status_code = 200
|
|
mock_response.json.return_value = {
|
|
"status": "success",
|
|
"stdout": '{"result": 42}',
|
|
"stderr": "",
|
|
"exit_code": 0,
|
|
"time_used_ms": 100.0,
|
|
"memory_used_kb": 1024.0
|
|
}
|
|
mock_post.return_value = mock_response
|
|
|
|
provider = SelfManagedProvider()
|
|
provider._initialized = True
|
|
|
|
result = provider.execute_code(
|
|
instance_id="test-123",
|
|
code="def main(): return {'result': 42}",
|
|
language="python",
|
|
timeout=10
|
|
)
|
|
|
|
assert result.stdout == '{"result": 42}'
|
|
assert result.stderr == ""
|
|
assert result.exit_code == 0
|
|
assert result.execution_time > 0
|
|
assert result.metadata["status"] == "success"
|
|
assert result.metadata["instance_id"] == "test-123"
|
|
|
|
@patch('requests.post')
|
|
def test_execute_code_timeout(self, mock_post):
|
|
"""Test code execution timeout."""
|
|
mock_post.side_effect = requests.Timeout()
|
|
|
|
provider = SelfManagedProvider()
|
|
provider._initialized = True
|
|
|
|
with pytest.raises(TimeoutError, match="Execution timed out"):
|
|
provider.execute_code(
|
|
instance_id="test-123",
|
|
code="while True: pass",
|
|
language="python",
|
|
timeout=5
|
|
)
|
|
|
|
@patch('requests.post')
|
|
def test_execute_code_http_error(self, mock_post):
|
|
"""Test code execution with HTTP error."""
|
|
mock_response = Mock()
|
|
mock_response.status_code = 500
|
|
mock_response.text = "Internal Server Error"
|
|
mock_post.return_value = mock_response
|
|
|
|
provider = SelfManagedProvider()
|
|
provider._initialized = True
|
|
|
|
with pytest.raises(RuntimeError, match="HTTP 500"):
|
|
provider.execute_code(
|
|
instance_id="test-123",
|
|
code="invalid code",
|
|
language="python"
|
|
)
|
|
|
|
def test_execute_code_not_initialized(self):
|
|
"""Test executing code when provider not initialized."""
|
|
provider = SelfManagedProvider()
|
|
|
|
with pytest.raises(RuntimeError, match="Provider not initialized"):
|
|
provider.execute_code(
|
|
instance_id="test-123",
|
|
code="print('hello')",
|
|
language="python"
|
|
)
|
|
|
|
def test_destroy_instance(self):
|
|
"""Test destroying an instance (no-op for self-managed)."""
|
|
provider = SelfManagedProvider()
|
|
provider._initialized = True
|
|
|
|
# For self-managed, destroy_instance is a no-op
|
|
result = provider.destroy_instance("test-123")
|
|
|
|
assert result is True
|
|
|
|
@patch('requests.get')
|
|
def test_health_check_success(self, mock_get):
|
|
"""Test successful health check."""
|
|
mock_response = Mock()
|
|
mock_response.status_code = 200
|
|
mock_get.return_value = mock_response
|
|
|
|
provider = SelfManagedProvider()
|
|
|
|
result = provider.health_check()
|
|
|
|
assert result is True
|
|
mock_get.assert_called_once_with("http://localhost:9385/healthz", timeout=5)
|
|
|
|
@patch('requests.get')
|
|
def test_health_check_failure(self, mock_get):
|
|
"""Test health check failure."""
|
|
mock_get.side_effect = Exception("Connection error")
|
|
|
|
provider = SelfManagedProvider()
|
|
|
|
result = provider.health_check()
|
|
|
|
assert result is False
|
|
|
|
def test_get_supported_languages(self):
|
|
"""Test getting supported languages."""
|
|
provider = SelfManagedProvider()
|
|
|
|
languages = provider.get_supported_languages()
|
|
|
|
assert "python" in languages
|
|
assert "nodejs" in languages
|
|
assert "javascript" in languages
|
|
|
|
def test_get_config_schema(self):
|
|
"""Test getting configuration schema."""
|
|
schema = SelfManagedProvider.get_config_schema()
|
|
|
|
assert "endpoint" in schema
|
|
assert schema["endpoint"]["type"] == "string"
|
|
assert schema["endpoint"]["required"] is True
|
|
assert schema["endpoint"]["default"] == "http://localhost:9385"
|
|
|
|
assert "timeout" in schema
|
|
assert schema["timeout"]["type"] == "integer"
|
|
assert schema["timeout"]["default"] == 30
|
|
|
|
assert "max_retries" in schema
|
|
assert schema["max_retries"]["type"] == "integer"
|
|
|
|
assert "pool_size" in schema
|
|
assert schema["pool_size"]["type"] == "integer"
|
|
|
|
def test_normalize_language_python(self):
|
|
"""Test normalizing Python language identifier."""
|
|
provider = SelfManagedProvider()
|
|
|
|
assert provider._normalize_language("python") == "python"
|
|
assert provider._normalize_language("python3") == "python"
|
|
assert provider._normalize_language("PYTHON") == "python"
|
|
assert provider._normalize_language("Python3") == "python"
|
|
|
|
def test_normalize_language_javascript(self):
|
|
"""Test normalizing JavaScript language identifier."""
|
|
provider = SelfManagedProvider()
|
|
|
|
assert provider._normalize_language("javascript") == "nodejs"
|
|
assert provider._normalize_language("nodejs") == "nodejs"
|
|
assert provider._normalize_language("JavaScript") == "nodejs"
|
|
assert provider._normalize_language("NodeJS") == "nodejs"
|
|
|
|
def test_normalize_language_default(self):
|
|
"""Test language normalization with empty/unknown input."""
|
|
provider = SelfManagedProvider()
|
|
|
|
assert provider._normalize_language("") == "python"
|
|
assert provider._normalize_language(None) == "python"
|
|
assert provider._normalize_language("unknown") == "unknown"
|
|
|
|
|
|
class TestProviderInterface:
|
|
"""Test that providers correctly implement the interface."""
|
|
|
|
def test_self_managed_provider_is_abstract(self):
|
|
"""Test that SelfManagedProvider is a SandboxProvider."""
|
|
provider = SelfManagedProvider()
|
|
|
|
assert isinstance(provider, SandboxProvider)
|
|
|
|
def test_self_managed_provider_has_abstract_methods(self):
|
|
"""Test that SelfManagedProvider implements all abstract methods."""
|
|
provider = SelfManagedProvider()
|
|
|
|
# Check all abstract methods are implemented
|
|
assert hasattr(provider, 'initialize')
|
|
assert callable(provider.initialize)
|
|
|
|
assert hasattr(provider, 'create_instance')
|
|
assert callable(provider.create_instance)
|
|
|
|
assert hasattr(provider, 'execute_code')
|
|
assert callable(provider.execute_code)
|
|
|
|
assert hasattr(provider, 'destroy_instance')
|
|
assert callable(provider.destroy_instance)
|
|
|
|
assert hasattr(provider, 'health_check')
|
|
assert callable(provider.health_check)
|
|
|
|
assert hasattr(provider, 'get_supported_languages')
|
|
assert callable(provider.get_supported_languages)
|