Skip to content

add computesdk image to hub #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kisernl wants to merge 1 commit into
base: main
Choose a base branch
from
Open

add computesdk image to hub #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions hub/computesdk/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
ARG SANDBOX_VERSION=latest
FROM --platform=linux/amd64 ghcr.io/blaxel-ai/sandbox:${SANDBOX_VERSION} AS blaxel

# Use ComputeSDK self-hosted compute runtime as base (Debian Bookworm)
FROM --platform=linux/amd64 computesdk/compute:latest
Copy link
Copy Markdown
Contributor

@mendral-app mendral-app Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (P1): Unpinned external base image computesdk/compute:latest is a supply chain risk. Any upstream change or compromise is silently pulled in on every build. Pin to a specific digest or version tag.

Suggested change
Suggested change
FROM --platform=linux/amd64 computesdk/compute:latest
FROM --platform=linux/amd64 computesdk/compute:<specific-version-or-digest>
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At hub/computesdk/Dockerfile, line 5:

<issue>
Unpinned external base image `computesdk/compute:latest` is a supply chain risk. Any upstream change or compromise is silently pulled in on every build. Pin to a specific digest or version tag.
</issue>


# Copy Blaxel sandbox API binary (required for all Blaxel sandbox templates)
COPY --from=blaxel /sandbox-api /usr/local/bin/sandbox-api

# Switch to root for package installation
USER root

# Install netcat for the health-check loop in entrypoint.sh
RUN apt-get update && apt-get install -y --no-install-recommends \
netcat-openbsd \
&& rm -rf /var/lib/apt/lists/*
Copy link
Copy Markdown

@cursor cursor Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dockerfile missing explicit curl installation used by entrypoint

Medium Severity

The Dockerfile explicitly installs netcat-openbsd for the health-check loop but does not install curl, which is used in entrypoint.sh to register the compute daemon with the sandbox API process manager. Every other template in this repo that uses curl in its entrypoint (astro, expo, nextjs, vite, jupyter-notebook, jupyter-server) explicitly installs it. If the computesdk/compute:latest base image ever removes curl, the compute daemon silently fails to start even when valid credentials are provided.

Additional Locations (1)
Fix in Cursor Fix in Web

Copy link
Copy Markdown

@cursor cursor Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bugbot Autofix determined this is a false positive.

The referenced files hub/computesdk/Dockerfile and hub/computesdk/entrypoint.sh are absent in this branch, so this missing dependency issue is not applicable.

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.


# Copy and set up entrypoint
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]
38 changes: 38 additions & 0 deletions hub/computesdk/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
#!/bin/sh

# Normalize ComputeSDK credential env vars BEFORE starting any processes.
# The compute binary reads API_KEY / ACCESS_TOKEN directly, but users may
# pass COMPUTESDK_API_KEY / COMPUTESDK_ACCESS_TOKEN instead.
export API_KEY="${API_KEY:-${COMPUTESDK_API_KEY:-}}"
export ACCESS_TOKEN="${ACCESS_TOKEN:-${COMPUTESDK_ACCESS_TOKEN:-}}"

# Start the Blaxel sandbox API (required)
# It inherits the exported env vars, so child processes it spawns will too.
/usr/local/bin/sandbox-api &

# Wait for sandbox API to be ready
echo "Waiting for sandbox API..."
while ! nc -z 127.0.0.1 8080; do
sleep 0.1
done
Copy link
Copy Markdown

@cursor cursor Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Health-check loop lacks timeout, may hang forever

Medium Severity

The nc -z health-check loop waiting for the sandbox API on port 8080 has no timeout, unlike every other hub template that uses this pattern (astro, expo, nextjs, vite, jupyter-notebook), which all implement a 30-second timeout with a counter. If sandbox-api fails to start or crashes immediately, this loop will spin forever, leaving the container hung with no error message and no way to diagnose the failure.

Fix in Cursor Fix in Web

Copy link
Copy Markdown

@cursor cursor Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bugbot Autofix determined this is a false positive.

The referenced file hub/computesdk/entrypoint.sh does not exist in this branch, so this health-check loop is not present to fix.

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.


echo "Sandbox API ready"

# Start the ComputeSDK compute daemon via the sandbox API process manager.
if [ -n "$ACCESS_TOKEN" ] || [ -n "$API_KEY" ]; then
echo "Starting ComputeSDK compute daemon (credentials found)..."
curl -s http://127.0.0.1:8080/process \
-X POST \
-H "Content-Type: application/json" \
-d '{"name": "compute-daemon", "workingDir": "/app", "command": "/app/compute serve-daemon", "waitForCompletion": false}'
else
echo "WARNING: No COMPUTESDK_ACCESS_TOKEN or COMPUTESDK_API_KEY set."
echo "The compute daemon will NOT start automatically."
echo "Provide credentials at sandbox creation time, or start manually via:"
echo " /app/compute serve-daemon --access-token <TOKEN>"
fi

echo "ComputeSDK sandbox ready"

# Keep the container running
Copy link
Copy Markdown
Contributor

@mendral-app mendral-app Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bug (P1): wait with no PID argument waits for all background jobs, but only sandbox-api is backgrounded. If sandbox-api crashes, the container exits silently with code 0. Capture the PID and wait on it explicitly so a crash propagates correctly.

Suggested change
Suggested change
# Keep the container running
SANDBOX_PID=$!
# Keep the container running; exit if sandbox-api dies
wait $SANDBOX_PID
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At hub/computesdk/entrypoint.sh, line 37:

<issue>
`wait` with no PID argument waits for all background jobs, but only `sandbox-api` is backgrounded. If `sandbox-api` crashes, the container exits silently with code 0. Capture the PID and wait on it explicitly so a crash propagates correctly.
</issue>

wait
20 changes: 20 additions & 0 deletions hub/computesdk/template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{
"name": "computesdk-image",
"displayName": "ComputeSDK",
"categories": [],
"description": "Sandbox environment with the ComputeSDK compute runtime pre-installed",
"longDescription": "A Blaxel sandbox image with the ComputeSDK compute runtime pre-installed. The compute daemon is started automatically during sandbox creation via the gateway provider.",
"memory": 4096,
"ports": [
{
"name": "sandbox-api",
"target": 8080,
"protocol": "HTTP"
},
{
"name": "compute",
"target": 18080,
"protocol": "HTTP"
}
]
}