-
Notifications
You must be signed in to change notification settings - Fork 7k
Make plugins sandbox-agnostic #2101
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Current progress: Support for Debian/Ubuntu operating systems has been added. Now it is possible to freely specify the sandbox_container_image. The sandbox will automatically install sshd when the program starts. sshd installation will be completed in about 30 seconds, followed by the installation of plugins. Finally, the fake shell will appear. Although there are some minor bugs and some ugly code, it is already barely usable.
|
# Conflicts: # opendevin/runtime/docker/ssh_box.py # opendevin/runtime/plugins/mixin.py
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @Shimada666 , this looks awesome, thanks for contributing! I'm happy to review when it's ready.
@neubig Thank you very much. I feel a bit embarrassed; this PR should have been ready for review much earlier, but I got a bit busy before and it was delayed.😢 I will further improve this PR and have it ready for review by tomorrow (the day after at the latest). Thanks again! |
No worries at all, thank you! |
Since the plugins depend on sshd for execution, we must include sshd in the image. In the previous example, I installed sshd in Ubuntu by specifying the entrypoint, and it successfully ran on Ubuntu 18.04/Debian 12, like this: self.container = self.docker_client.containers.run(
self.container_image,
entrypoint='bash',
# allow root login
user='root',
command=f"-c \"apt update && apt install openssh-server;mkdir /var/run/sshd && mkdir -p -m0755 /var/run/sshd;/usr/sbin/sshd -D -p {self._ssh_port} -o 'PermitRootLogin=yes'\"",
**network_kwargs,
working_dir=self.sandbox_workspace_dir,
name=self.container_name,
detach=True,
volumes=self.volumes,
) However, this approach is undoubtedly ugly and not universal. For instance, it doesn't apply to CentOS (which uses yum). Therefore, this PR does not include that part. Currently, it still requires an image with sshd built in to run, like After discussing with @xingyaoww, maybe we should abandon SSH and switch to using WebSocket communication. in future refactoring. A better approach is for users to provide a base image (CentOS/Ubuntu/Debian), from which we generate a Dockerfile to install the necessary runtime, rebuild the sandbox image, and then use this image. So, I plan for this PR to be used only for isolating the Python environment for opendevin and creating image caches to speed up startup times. When use_cache is set to true in config.toml, the sandbox cache image will be automatically generated after the first run, and this cache image will be used in subsequent runs to reduce the startup time of the sandbox. You can test it with the following command config.toml [core]
...
use_cache = false
sandbox_container_image = "ghcr.io/opendevin/sandbox:main" run command python3 opendevin/runtime/docker/ssh_box.py Currently, I am using the Python base environment (3.10) provided by miniforge as the runtime for opendevin. If needed, it is also easy to install Python 3.11 and use it as the runtime, with the trade-off being a slightly slower startup time the first time it is launched. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall LGTM! I think we can remove use_cache
and the logic for docker commit for now, and aim for a better Dockerfile
-based build solution directly and transparent to the user.
We can maybe directly create this "Dockefile builder" and put dependencies of |
Ok, I will try to refactor the image building logic into code so that we don't need the mamba plugin! |
I have added support for automatically building the agnostic_sandbox, and I have tested it on Ubuntu 22.04/Debian 11, and it works fine! To test, simply set sandbox_container_image = "ubuntu:22.04" in |
Now all CI tests are passed, I am ready to be reviewed again! |
I can't review all the sandbox topics myself, I'll leave that to others. Maybe add a test fixture Example: @pytest.mark.skipif(os.getenv('TEST_IN_CI') != 'true',
reason='Only run on CI',
) |
@tobitege Got it! I have added the skipif, please take a look. |
Thanks! Workflow is running. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Finally, all tests passed - LGTM. Happy to wait a bit if someone else want to take a look before merge.
|
||
pip install flake8 python-docx PyPDF2 python-pptx pylatexenc openai opencv-python | ||
source ~/.bashrc |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: Is this line necessary here now we are source script at every plugin initialization? Bc. pip install probably don't require the PYTHONPATH
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think it will be necessary. I plan to make improvements in the next PR by removing anything unnecessary.
@tobitege @yufansong @li-boxuan |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't fully understand this PR but I don't have any concern either.
_test_sandbox_jupyter_agentskills_fileop_pwd_impl(box) | ||
|
||
|
||
@pytest.mark.skipif(os.getenv('TEST_IN_CI') != 'true', |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This won't work because you are not adding TEST_IN_CI=true
env variable to test-for-sandbox
in ghcr.yml.
But don't worry, let me push a separate commit once this PR is merged. Not a big deal.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
a big thanks!
@Shimada666 I think we need some more testing of this PR. Now seeing this in the terminal log (WSL) in OpenDevin starting a new session in browser:
Any ideas? |
@tobitege You need use ghcr.io/opendevin/sandbox:main! |
So this also applies to the main README then which still states 0.6.2? |
However, the exception ideally should be handled by adding a check for miniforge3 being present and if not then output a transparent error message to the user, imho, to tell the user what else to do. |
It was there before. I just found out it was removed by this PR. I think it should be added back. |
#2560 |
@Shimada666 one more thing, does the Makefile also need a change (right at the top): It currently has: Otherwise the log shows that docker is pulling
Reference: #2561 |
#1979
The goal is to decouple the sandbox from the plugins, allowing the plugins to run in most sandbox images.
Using a miniforge isolated environment, mambarequirement is responsible for installing miniforge and pip/c library.
After testing, The agent_skill and jupyter plugins can run on an Ubuntu18/Debian12 image with only sshd and sudo installed.