05ab45225a
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Sandbox providers are the seam that lets agent runs execute in isolated environments; today the only first-party remote provider is Daytona, a hosted third-party service > - Self-hosters running Paperclip on their own infrastructure (often Kubernetes already) have no first-party way to run agent sandboxes on a cluster they control > - That gap matters for teams with data-residency, sovereignty, or cost constraints who cannot or will not send workloads to a hosted sandbox service > - This pull request adds a Kubernetes sandbox-provider plugin as a standalone, workspace-excluded package: it implements every SandboxProvider hook the Daytona provider does, on infrastructure the operator owns > - The benefit is that any Paperclip deployment with a Kubernetes cluster gets multi-tenant, network-isolated, quota-bounded agent sandboxes with zero new external dependencies ## Linked Issues or Issue Description No existing issue. Following the feature template: - **Problem:** Paperclip's remote sandbox execution requires a hosted third-party provider. Self-hosters cannot run agent sandboxes on their own Kubernetes clusters with a first-party provider. - **Proposed solution:** A `@paperclipai/plugin-kubernetes` sandbox-provider plugin with two backends: long-lived sandboxes via the [kubernetes-sigs/agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox) CRD (multi-command exec, adapter-install pattern) and one-shot `batch/v1` Jobs (stable APIs only, no extra controllers). - **Alternatives considered:** Driving kubectl from a generic shell provider (no lifecycle/lease semantics), or requiring a hosted provider (exactly the constraint this removes). ## What Changed This is **stage 1 of 3** of a staged contribution (direction agreed with maintainers): the plugin package alone. Stage 2 (server integration: lease params, provider registration) and stage 3 (agent runtime images + CI) are companion PRs that will be cross-linked from a comment here. - New package `packages/plugins/sandbox-providers/kubernetes` (workspace-excluded, like the path already carved out in `pnpm-workspace.yaml`): src, unit + kind integration tests, operator prerequisite manifests, README, smoke-test guide - Implements the full SandboxProvider hook surface the Daytona provider implements: `validateConfig`, `probe`, `acquireLease`, `resumeLease`, `releaseLease`, `destroyLease`, `realizeWorkspace`, `execute` - Two backends: `sandbox-cr` (default; long-lived pod via the agent-sandbox `Sandbox` CR, supports multi-command exec) and `job` (one-shot `batch/v1` Job; nothing beyond k8s 1.27+ required) - Per-run adapter resolution: one environment serves mixed harnesses; the per-run `adapterType` hint is read through a local optional type extension, so the plugin typechecks and builds against the current plugin SDK and simply falls back to the environment's configured default adapter until stage 2 lands - Exec-env wrapping: the Kubernetes exec API carries no environment, so commands are wrapped to receive the run's env - Fast-upload interception for workspace realization, scoped per lease - Per-tenant isolation: derived namespace per company, RBAC, ResourceQuota, restricted-PSS pod security (runAsNonRoot, drop ALL, seccomp RuntimeDefault, no SA token automount) - Network egress policy in two flavors: native `NetworkPolicy` and `CiliumNetworkPolicy` (FQDN allowlists) - Image allowlist with glob matching, registry override, and per-run image override validation - Per-run Kubernetes Secrets carrying agent credentials, ownerRef'd to the Job or Sandbox CR for cascade GC ## Verification - Standalone build, exactly as the README documents: ```bash cd packages/plugins/sandbox-providers/kubernetes pnpm install --ignore-workspace pnpm test # 147 unit tests, 17 files, all green pnpm typecheck # clean against the in-repo plugin SDK on master pnpm build # dist/ emitted, manifest + worker entrypoints present ``` - A kind-cluster end-to-end integration test is included (`RUN_K8S_INTEGRATION_TESTS=1 pnpm test test/integration/end-to-end-run.test.ts`) - Beyond CI: this provider has been verified in a production multi-tenant deployment against five harnesses (opencode, pi, codex, gemini, claude code) with real billed runs ## Risks - **Zero behavior change for any existing deployment.** The package is workspace-excluded; nothing in the server imports or loads it until stage 2's integration lands. No existing code paths are touched. - The default `sandbox-cr` backend depends on an alpha CRD (`agents.x-k8s.io/v1alpha1`); the README flags this and the `job` backend uses only stable APIs as a fallback. - Risk surface is confined to deployments that explicitly install and configure the plugin. - The default runtime images (`ghcr.io/paperclipai/agent-runtime-*`) are published by the stage 3 companion PR (#7934); until that lands, deployments must point `runtimeImage` at their own images. ## Model Used Claude Opus 4.8 (1M context), extended thinking, with tool use (Claude Code). ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots (no UI changes) - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green (pending this push) - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
150 lines
5.2 KiB
TypeScript
150 lines
5.2 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import {
|
|
getAdapterDefaults,
|
|
buildAdapterEnv,
|
|
resolveRunAdapterType,
|
|
KNOWN_ADAPTER_TYPES,
|
|
type AdapterDefaults,
|
|
} from "../../src/adapter-defaults.js";
|
|
import type { AdapterRegistryEntry } from "../../src/adapter-registry.js";
|
|
|
|
describe("adapter-defaults (built-in)", () => {
|
|
it("returns defaults for claude_local", () => {
|
|
const d = getAdapterDefaults("claude_local");
|
|
expect(d.runtimeImage).toBe("ghcr.io/paperclipai/agent-runtime-claude:v1");
|
|
expect(d.envKeys).toContain("ANTHROPIC_API_KEY");
|
|
expect(d.allowFqdns).toContain("api.anthropic.com");
|
|
expect(d.probeCommand).toEqual(["claude", "--version"]);
|
|
});
|
|
|
|
it("returns defaults for codex_local", () => {
|
|
const d = getAdapterDefaults("codex_local");
|
|
expect(d.runtimeImage).toBe("ghcr.io/paperclipai/agent-runtime-codex:v1");
|
|
expect(d.envKeys).toContain("OPENAI_API_KEY");
|
|
expect(d.probeCommand).toEqual(["codex", "--version"]);
|
|
});
|
|
|
|
it("throws on unknown adapter type", () => {
|
|
expect(() => getAdapterDefaults("nonexistent_local")).toThrow(/unknown adapter type/i);
|
|
});
|
|
|
|
it("KNOWN_ADAPTER_TYPES contains all 7 supported adapters", () => {
|
|
expect(KNOWN_ADAPTER_TYPES).toEqual(
|
|
new Set([
|
|
"claude_local",
|
|
"codex_local",
|
|
"gemini_local",
|
|
"cursor_local",
|
|
"opencode_local",
|
|
"acpx_local",
|
|
"pi_local",
|
|
]),
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("getAdapterDefaults", () => {
|
|
it("returns built-in defaults when no registry is supplied", () => {
|
|
const d = getAdapterDefaults("claude_local");
|
|
expect(d.runtimeImage).toContain("agent-runtime-claude");
|
|
expect(d.envKeys).toEqual(["ANTHROPIC_API_KEY"]);
|
|
expect(d.defaultEnv).toBeUndefined();
|
|
});
|
|
|
|
it("throws on an unknown built-in type when no registry is supplied", () => {
|
|
expect(() => getAdapterDefaults("nope")).toThrow(/Unknown adapter type/);
|
|
});
|
|
|
|
it("resolves from the supplied registry (replace semantics, not merge)", () => {
|
|
const registry: AdapterRegistryEntry[] = [
|
|
{
|
|
adapterType: "opencode_local",
|
|
enabled: true,
|
|
runtimeImage: "registry.example/opencode:eu",
|
|
envKeys: ["ANTHROPIC_API_KEY"],
|
|
allowFqdns: [],
|
|
probeCommand: ["opencode", "--version"],
|
|
defaultEnv: { ANTHROPIC_BASE_URL: "http://bifrost:8080" },
|
|
},
|
|
];
|
|
const d = getAdapterDefaults("opencode_local", registry);
|
|
expect(d.runtimeImage).toBe("registry.example/opencode:eu");
|
|
expect(d.defaultEnv).toEqual({ ANTHROPIC_BASE_URL: "http://bifrost:8080" });
|
|
});
|
|
|
|
it("throws when the type is absent from a supplied registry", () => {
|
|
const registry: AdapterRegistryEntry[] = [
|
|
{
|
|
adapterType: "opencode_local",
|
|
runtimeImage: "x",
|
|
envKeys: [],
|
|
allowFqdns: [],
|
|
probeCommand: ["x"],
|
|
},
|
|
];
|
|
expect(() => getAdapterDefaults("claude_local", registry)).toThrow(
|
|
/not in the configured adapter registry/,
|
|
);
|
|
});
|
|
|
|
it("throws when a supplied registry entry is missing runtimeImage", () => {
|
|
const registry: AdapterRegistryEntry[] = [
|
|
{ adapterType: "opencode_local", envKeys: [], allowFqdns: [], probeCommand: ["x"] },
|
|
];
|
|
expect(() => getAdapterDefaults("opencode_local", registry)).toThrow(
|
|
/missing required runtime field: runtimeImage/,
|
|
);
|
|
});
|
|
|
|
it("defaults the optional array fields to [] when the registry omits them", () => {
|
|
const registry: AdapterRegistryEntry[] = [
|
|
{ adapterType: "opencode_local", runtimeImage: "img" },
|
|
];
|
|
const d = getAdapterDefaults("opencode_local", registry);
|
|
expect(d.envKeys).toEqual([]);
|
|
expect(d.allowFqdns).toEqual([]);
|
|
expect(d.probeCommand).toEqual([]);
|
|
});
|
|
});
|
|
|
|
describe("buildAdapterEnv", () => {
|
|
it("layers process-env (secret) over defaultEnv (non-secret base)", () => {
|
|
const defaults: AdapterDefaults = {
|
|
runtimeImage: "x",
|
|
envKeys: ["ANTHROPIC_API_KEY"],
|
|
allowFqdns: [],
|
|
probeCommand: ["x"],
|
|
defaultEnv: { ANTHROPIC_BASE_URL: "http://bifrost:8080", ANTHROPIC_API_KEY: "should-be-overridden" },
|
|
};
|
|
const env = buildAdapterEnv(defaults, { ANTHROPIC_API_KEY: "sk-real" });
|
|
expect(env).toEqual({
|
|
ANTHROPIC_BASE_URL: "http://bifrost:8080",
|
|
ANTHROPIC_API_KEY: "sk-real",
|
|
});
|
|
});
|
|
|
|
it("omits process-env keys that are absent", () => {
|
|
const defaults: AdapterDefaults = {
|
|
runtimeImage: "x",
|
|
envKeys: ["ANTHROPIC_API_KEY"],
|
|
allowFqdns: [],
|
|
probeCommand: ["x"],
|
|
};
|
|
expect(buildAdapterEnv(defaults, {})).toEqual({});
|
|
});
|
|
});
|
|
|
|
describe("resolveRunAdapterType", () => {
|
|
it("prefers the run/agent adapter when provided (mixed-harness env)", () => {
|
|
expect(resolveRunAdapterType("pi_local", "opencode_local")).toBe("pi_local");
|
|
});
|
|
it("falls back to the environment default when the run adapter is missing/blank", () => {
|
|
expect(resolveRunAdapterType(undefined, "opencode_local")).toBe("opencode_local");
|
|
expect(resolveRunAdapterType(null, "opencode_local")).toBe("opencode_local");
|
|
expect(resolveRunAdapterType(" ", "opencode_local")).toBe("opencode_local");
|
|
});
|
|
it("trims the run adapter", () => {
|
|
expect(resolveRunAdapterType(" pi_local ", "opencode_local")).toBe("pi_local");
|
|
});
|
|
});
|