Repository navigation
Add container providers and Rust/Python/JS/TS APIs - #117
Merged
Merged
Conversation
Pin Prettier and check owned sources in CI. Keep private factories embeddable and upstream input pins unchanged. Extract the standalone package verifier so its code is formatted too.
Workers reads running synchronously, while provider execute may need I/O. Keep the observation explicit and bound to native invocation authority.
Execute delegates on the original native event, with owned leases, bounded handles and mailboxes, shared byte reservations, and producer output proof. Close unpublished exports when result publication fails. Qualify unchanged Sandbox SDK/image exec, files and background process routes. Restrict test network cleanup to verified empty bridges owned by that test host. Broader RPC and sandbox-provider profiles remain incomplete.
Let the published Sandbox SDK consume incremental output under the original event authority. Bound reads and cleanup across language facades, and give the one-shot fence helper room for existing nftables rules.
…age-support # Conflicts: # crates/cellar-javascript/tests/support/native.rs
Retain original producer authority and output proof through native leases. Negotiate producer/consumer byte budgets and join reader cancellation, disposal and lease loss. Separate response writes and EOF waits from local storage mutation admission. Pending output previously refused independent waitUntil writes with ConcurrentMutation; the reproduced native regression now passes with output gates intact.
Use native leases and producer output proof for bounded writes, close and abort. Preserve aliases, backpressure and joined cleanup across mixed readable/writable results. A later frame refusal after accepted frames now reports unknown effects for the composite write. Qualify native binary persistence, held acknowledgements, partial failures and stale writers; retain explicit stream-input and SDK upload gaps.
Keep stream producers in their original event. Use native leased controls for bounded backpressure and joined caller cleanup. Validate input errors before nesting their encoded frames so producer stacks cannot cross the session.
Keep container WebSocket I/O in its opening event and prove later callers before sending. Preserve handshake headers across language facades and bound local proxy queues. Qualify the unchanged pinned SDK and image with a gated binary upload and joined cleanup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cellar now has a host-selected container provider boundary shared by Rust, Python, JavaScript and TypeScript. Native Docker/compatible Podman remains the default; experimental E2B and Vercel adapters provide bounded execution and files. The optional Cloudflare runtime runs selected published Containers and Sandbox operations through the same native authority and output gates.
Delivered behavior
Native-only hosts remain free of JavaScript engines. Cloud credentials and provider selection stay in host configuration.
Acceptance evidence
The new image test uploads 2 MiB + 17 bytes through actual Sandbox SDK RPC. It observes a real temporary-file prefix before releasing the source, requires the destination to remain unpublished until EOF, verifies the SDK byte count and every final byte, downloads the file through unchanged readFile with encoding none, then requires explicit SDK destroy and drained native resources.
The shared WebSocket facade never lends the opening event's native socket handle to a later event. Each later send first proves that caller's writes. Storage sync barriers may overlap while a second actual storage mutation still refuses. Failures after an accepted upgrade or data frame retain uncertain outcomes; no frame is replayed.
Validation and limits
Broader native qualification is not green. The latest serial runs passed 85 tests and failed 9 across 7 integration targets. Failures included handler/execution budgets, startup/input deadlines, an alarm HTTP 500 and drainage. Other qualification jobs and disk traffic were observed, but causality is unproven. Isolated passes do not close these failures; no deadline or assertion was relaxed. Details and prior evidence are retained in the ledger.
Merged latest main at
ce687427; conflicts preserve both provider tests and binding examples. JS/TS binding builds, Cargo metadata, adapter Clippy, Rust format/layout (1,156 sources), docs and the engine-free dependency guard pass after merge.Remaining priorities
E2B/Vercel live-account qualification is deferred until the user's configurations are supplied. Their protocol peers do not establish live service qualification. The complete SP-01–SP-10 goal remains incomplete, and the full Cloudflare baseline retains
conformance: not_rununtil all required operations, lifetimes and failure cases are qualified.