zozo123 opened a new pull request, #71725: URL: https://github.com/apache/airflow/pull/71725
Adds a hosted Boat backend for `SandboxToolset`, giving containerized Airflow workers a production-capable backend without a local daemon or KVM. Boat is the service formerly called Ascii Box: the vendor renamed it on 2026-09-15 and published `boat-sdk` 1.0.0 the next day. The old `ascii.dev/api/box/v1` base now answers with `Deprecation` and `Sunset: 31 Oct 2026` headers (see [Migrating from Box to Boat](https://docs.boat.dev/migrating-from-box)), so this PR ships the backend under the new name from the start: `BoatSandboxBackend`, the `sandbox-boat` extra on `boat-sdk>=1.0.0`, `boat_conn_id` / `boat_default`, and `BOAT_API_KEY` / `BOAT_BASE_URL`. ### What changed - maps `SandboxSpec.env` at creation and refuses deny-all / per-domain egress policies Boat cannot enforce; - uses the native file write API, which has no command-line length ceiling to work around, and keeps the inherited shell read, which bounds a read inside the guest instead of after the bytes have reached the worker; - applies the API's command deadline (capped at 600s), destroys timed-out sandboxes and any sandbox that never becomes ready, and configures a server-side TTL as the orphan-cleanup backstop; - resolves the optional `boat-sdk` and a generic Airflow connection lazily, and exports the backend eagerly (the module imports the SDK on first use, so the package stays importable without it and a missing SDK surfaces as an actionable error); - documents the `sandbox-boat` extra and adds unit plus system coverage. ### Validation - Unit tests cover connection resolution, fail-closed network policy, command bounding/timeout teardown, teardown of a sandbox that never reports ready, file ops, and the idempotent delete on the `/sandboxes/{sandboxId}` route; - the previously recorded system test Dag ran end to end against `https://boat.dev/api/v1` with a real key on 2026-09-19 (create, rename, readiness, command, write, read, list, non-zero exit, delete): `1 passed in 13.47s`; - the previous revision passed 23,548 non-database provider tests in CI; - local static checks pass with the container-dependent provider YAML check excluded, including ruff, dependency-lock validation, and provider metadata regeneration; - fixed the generated extras ordering and the short heading underline that failed static checks, documentation, and spellcheck in CI; and - local container-dependent unit tests and provider mypy could not be completed because a usable Airflow CI image was unavailable. Fresh CI validates the updated revision. Related: #68847 See also: #71672, #71676 --- ##### Was generative AI tooling used to co-author this PR? - [x] Yes — Cursor (Grok), Claude Code (Opus 5), Claude Code (Fable 5.1), Codex (GPT-6) Generated-by: Cursor (Grok), Claude Code (Opus 5), Claude Code (Fable 5.1), Codex (GPT-6) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
