Skip to content

Require containers 0.2.1 for sleepAfter streams#544

Merged
whoiskatrin merged 7 commits intomainfrom
fix/containers-activity-timeout
Mar 31, 2026
Merged

Require containers 0.2.1 for sleepAfter streams#544
whoiskatrin merged 7 commits intomainfrom
fix/containers-activity-timeout

Conversation

@whoiskatrin
Copy link
Copy Markdown
Collaborator

@whoiskatrin whoiskatrin commented Mar 31, 2026

Summary

  • require @cloudflare/containers@^0.2.1, which keeps sleepAfter from expiring while proxied request or stream work is still in flight
  • fix websocket transport so the shared control socket disconnects shortly after the last in-flight request completes, allowing sleepAfter to expire normally once the sandbox is actually idle
  • add E2E coverage for both sides of the behavior: a quiet long-running execStream() must survive past sleepAfter, and an idle sandbox with short sleepAfter must eventually stop

Testing

  • npm run typecheck
  • E2E is running in CI for both HTTP and WebSocket transport jobs

Reviewer Notes

  • sandbox-sdk's built-in container-facing APIs already route through containerFetch() / fetch(), so @cloudflare/containers@0.2.1 is the right upstream fix for the original customer report
  • the follow-up websocket change is required because the SDK keeps a shared control WebSocket open in SANDBOX_TRANSPORT=websocket; after the containers fix, that persistent proxy connection counts as in-flight activity and can keep the sandbox artificially alive
  • the transport fix is intentionally small: it schedules an idle disconnect only when there are no pending requests, so active commands and streams keep working while truly idle sandboxes can sleep again
  • package-lock.json includes npm metadata churn, but the functional dependency change is the bump to @cloudflare/containers@0.2.1

Update sandbox to require the containers release that tracks in-flight
proxy work for sleepAfter. Add an E2E regression so long-running quiet
execStream calls do not get terminated while the container is still
active.
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 31, 2026

🦋 Changeset detected

Latest commit: fc11058

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@cloudflare/sandbox Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

Open in Devin Review

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Mar 31, 2026

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/sandbox-sdk/@cloudflare/sandbox@544

commit: fc11058

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 31, 2026

🐳 Docker Images Published

Variant Image
Default cloudflare/sandbox:0.0.0-pr-544-fc11058
Python cloudflare/sandbox:0.0.0-pr-544-fc11058-python
OpenCode cloudflare/sandbox:0.0.0-pr-544-fc11058-opencode
Musl cloudflare/sandbox:0.0.0-pr-544-fc11058-musl
Desktop cloudflare/sandbox:0.0.0-pr-544-fc11058-desktop

Usage:

FROM cloudflare/sandbox:0.0.0-pr-544-fc11058

Version: 0.0.0-pr-544-fc11058


📦 Standalone Binary

For arbitrary Dockerfiles:

COPY --from=cloudflare/sandbox:0.0.0-pr-544-fc11058 /container-server/sandbox /sandbox
ENTRYPOINT ["/sandbox"]

Download via GitHub CLI:

gh run download 23808170391 -n sandbox-binary

Extract from Docker:

docker run --rm cloudflare/sandbox:0.0.0-pr-544-fc11058 cat /container-server/sandbox > sandbox && chmod +x sandbox

@whoiskatrin whoiskatrin marked this pull request as ready for review March 31, 2026 10:25
scuffi
scuffi previously approved these changes Mar 31, 2026
@ghostwriternr
Copy link
Copy Markdown
Member

This is primarily a comment regarding the original implementation on the containers package, but it looks like we're currently firing alarms in a loop every 50ms.

In our test, a 5-second stream with 3s sleepAfter produced 13 alarms in ~400ms (the window between sleepAfter expiring and the stream ending. If a user runs a long running command that streams output for 10 minutes with sleepAfter: '30s', there will be 9.5 minutes of alarms in a 50ms loop, which will be in the thousands but all doing nothing useful and charging the user for every invocation. We should maybe add a more graceful 1-second sleep between checks? cc @gabivlj sample logs

Copy link
Copy Markdown
Member

@ghostwriternr ghostwriternr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change LGTM. Non-blocking, I think we should also have another complementary test that creates a sandbox with a short sleepAfter like 3s, runs a quick command, waits 4+ seconds, and asserts the sandbox was stopped. That way the we always prove both sides: sleepAfter kills idle containers, and the inflightRequests check from the containers package prevents it from killing active ones.

ghostwriternr
ghostwriternr previously approved these changes Mar 31, 2026
Switch the sandbox dependency to the released containers package and
update the pending changeset text to match the minimum supported
version.
@whoiskatrin whoiskatrin merged commit 9a2f553 into main Mar 31, 2026
20 checks passed
@whoiskatrin whoiskatrin deleted the fix/containers-activity-timeout branch March 31, 2026 17:27
@sandy-bonk sandy-bonk bot mentioned this pull request Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants