kaxil commented on PR #71672: URL: https://github.com/apache/airflow/pull/71672#issuecomment-5841526588
I rebased this onto main, which needed conflict fixes around the `common.ai` docs reorganization and the new `allow_egress_to_cidrs` field, and pushed one commit on top that addresses my last review. I measured the file-API behaviour against the live Islo API on the default image before changing the error handling: | Call | Islo answers | |---|---| | Download a missing file, or a directory | 404 `FILE_NOT_FOUND` | | Download a relative path | 400 `INVALID_REQUEST`, "path must be absolute: rel.txt" | | Upload onto a directory, or under `/proc` or `/sys` | 500 `INTERNAL_ERROR`, "An internal error occurred" | | Download or upload on a sandbox that does not exist | 404 `SANDBOX_NOT_FOUND` | What changed: - **File errors the model can fix now reach the model.** A 404, a 400 (with the API's message, trimmed to 200 characters) and a bare 500 on a write come back as a recoverable `SandboxError`, but only after `get_sandbox` confirms the sandbox is still usable, because a missing sandbox also answers 404. No response at all, 401/403/429 and any 5xx above 500 fail the task without the extra round trip. - **`allow_egress_to_cidrs` is refused at `create`**, as `sbx` refuses it. Islo only has `internet_enabled`, so accepting the field would provision an open or closed network where the Dag asked for an address allowlist. - **The timeout cleanup warning no longer promises reclamation when `delete_after=None`.** It now says the sandbox persists until deleted by hand. - **The extra is `islo`, not `sandbox-islo`**, matching `modal`. - The connection `timeout` is documented as the SDK client default: the backend sets its own timeout on every call (the command deadline, and 120 s for file transfers), so the field only matters for direct hook use. One gap: I could not run `example_sandbox_toolset_islo.py` end to end, because the account I tested with hit `402 BILLING_NOT_ALLOWED` after the first sandbox. @zozo123, could you run the system test once from your side, or let me know when there is credit on a test account? Two behaviours I also could not measure for the same reason: whether `internet_enabled=False` blocks DNS as well as TCP, and whether `pause_after_idle` pauses a sandbox while a silent command is still running. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
