support agent sandbox (minio)

Dockerfile

@@ -1,9 +1,9 @@
-# Check Dockerhub for available tags: https://hub.docker.com/r/tryretool/backend/tags
+ARG VERSION=dev-3.380.0-940f7d8
 
-ARG VERSION=X.Y.Z-stable
+FROM --platform=linux/amd64 753800337063.dkr.ecr.us-west-2.amazonaws.com/agent-executor-service:${VERSION} AS agent-sandbox
 
-FROM tryretool/code-executor-service:${VERSION} AS code-executor
+FROM --platform=linux/amd64 753800337063.dkr.ecr.us-west-2.amazonaws.com/code-executor-service:${VERSION} AS code-executor
 
-FROM tryretool/backend:${VERSION}
+FROM --platform=linux/amd64 753800337063.dkr.ecr.us-west-2.amazonaws.com/onprem:${VERSION}
 
 CMD ./docker_scripts/start_api.sh

compose.yaml

@@ -17,6 +17,7 @@ services:
       - code-executor
     depends_on:
       - postgres
+      - minio
     restart: always
 
   jobs-runner:
@@ -102,6 +103,107 @@ services:
     networks:
       - code-executor
     restart: always
+
+  agent-sandbox-controller:
+    build:
+      context: .
+      target: agent-sandbox
+    user: root
+    env_file: docker.env
+    environment:
+      - NODE_ENV=production
+      - AGENT_EXECUTOR_ROLE=controller
+      - ORCHESTRATOR=docker
+      - EXECUTOR_IMAGE=${EXECUTOR_IMAGE:-retool-onprem-agent-sandbox-controller}
+      - DOCKER_NETWORK=agent-sandbox
+      - EXECUTOR_SERVICE_NAME=agent-sandbox
+      - SANDBOX_BACKEND_URL=http://api:3000
+      - EXECUTOR_EXTRA_ENV=SANDBOX_NETWORK_ENABLED=false,SANDBOX_HTTP_PROXY=http://agent-sandbox-proxy:3019
+      - EXECUTOR_SECCOMP_PROFILE_PATH=/seccomp/gvisor-seccomp.json
+      # Lower pool sizes for local development
+      - PREWARM_POOL_SIZE=1
+      - MAX_TOTAL_JOBS=10
+      - MAX_CONCURRENT_CREATES=2
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./gvisor-seccomp.json:/seccomp/gvisor-seccomp.json:ro
+    networks:
+      - backend
+      - agent-sandbox
+    depends_on:
+      - postgres
+    restart: always
+
+  agent-sandbox-proxy:
+    build:
+      context: .
+      target: agent-sandbox
+    env_file: docker.env
+    environment:
+      - NODE_ENV=production
+      - AGENT_EXECUTOR_ROLE=proxy
+      - ORCHESTRATOR=docker
+      - PROXY_PORT=3019
+      - EXECUTOR_SERVICE_NAME=agent-sandbox
+      - BACKEND_URL=http://api:3000
+      # Uncomment to restrict which external domains sandboxes can reach
+      # - ALLOWED_DOMAINS=api.openai.com,api.anthropic.com
+    ports:
+      - 3019:3019
+    networks:
+      - backend
+      - agent-sandbox
+    depends_on:
+      - postgres
+    restart: always
+
+  r2-agent-worker:
+    build:
+      context: .
+    env_file: docker.env
+    environment:
+      - SERVICE_TYPE=R2_AGENT_TEMPORAL_WORKER
+      - WORKER_TEMPORAL_TASKQUEUE=r2-agent
+    networks:
+      - backend
+      - agent-sandbox
+    depends_on:
+      - postgres
+    restart: always
+
+  minio:
+    image: minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      - MINIO_ROOT_USER=retool
+      - MINIO_ROOT_PASSWORD=retoolminio
+      - MINIO_DOMAIN=minio
+    ports:
+      - 9000:9000
+      - 9001:9001
+    networks:
+      backend:
+        aliases:
+          - retool-rr-git.minio
+          - retool-rr-snapshots.minio
+    volumes:
+      - minio-data:/data
+    restart: always
+
+  minio-init:
+    image: minio/mc:latest
+    depends_on:
+      - minio
+    entrypoint: >
+      /bin/sh -c "
+      sleep 3;
+      mc alias set local http://minio:9000 retool retoolminio;
+      mc mb --ignore-existing local/retool-rr-git;
+      mc mb --ignore-existing local/retool-rr-snapshots;
+      echo 'Buckets created successfully';
+      "
+    networks:
+      - backend
 
   # Retool's internal DB, we recommend using an externally hosted database: https://docs.retool.com/docs/configuring-retools-storage-database
   postgres:
@@ -146,7 +248,10 @@ networks:
   frontend:
   backend:
   code-executor:
+  agent-sandbox:
+    name: agent-sandbox
 
 volumes:
   data:
   retooldb-data:
+  minio-data: