scriptoriumadmin/fabro
1
0
Fork 0
mirror of https://github.com/fabro-sh/fabro.git synced 2026-08-28 05:27:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Merge b34f2b8207 into dc55183468

Browse source
This commit is contained in:
Bryan Helmkamp 2026-08-27 15:03:15 -04:00 • committed by GitHub
commit 5aefd0a193
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
12 changed files with 263 additions and 83 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
docs/public/changelog/2026-08-27.mdx Normal file
View file

@ -0,0 +1,21 @@
---
title: "Docker images for Daytona snapshots"
date: "2026-08-27"
---
Daytona environments now accept `image.docker`. Fabro creates or reuses a
Daytona snapshot from that image, so an existing image no longer needs a
wrapper Dockerfile. `image.dockerfile` remains available for custom builds.
Set one image source per Daytona environment:
```toml
[environments.cloud]
provider = "daytona"
[environments.cloud.image]
docker = "python:3.11-slim"
```
Fabro rejects a Daytona environment that sets both `image.docker` and
`image.dockerfile`.

1
docs/public/docs.json
View file

@ -309,6 +309,7 @@
"group": "August 2026",
"icon": "clock-rotate-left",
"pages": [
"changelog/2026-08-27",
"changelog/2026-08-26",
"changelog/2026-08-25",
"changelog/2026-08-23",

6
docs/public/execution/environments.mdx
View file

@ -212,7 +212,7 @@ Install seeds a `default` environment into SQLite. It is a normal persisted envi
| Environment field | Local | Docker | Daytona |
|---|---|---|---|
| `image.docker` | Ignored | Docker image | Error |
| `image.docker` | Ignored | Docker image | Snapshot base image; Fabro computes the snapshot name |
| `image.dockerfile` | Ignored | Warning; ignored | Snapshot Dockerfile; Fabro computes the snapshot name |
| `resources.cpu` | Warning; ignored | `cpu_quota = cpu * 100000` | Snapshot CPU |
| `resources.memory` | Warning; ignored | Container memory limit | Snapshot memory |
@ -276,14 +276,14 @@ The image must provide `/bin/bash`; Fabro evaluates every sandbox command with i
## Daytona
Daytona runs tools in a cloud sandbox. Without `image.dockerfile`, Fabro uses Daytona's built-in `daytona-medium` snapshot. With `image.dockerfile`, Fabro computes a deterministic internal snapshot name from the Dockerfile, resource hints, a single-tenant scope, and the Daytona API key.
Daytona runs tools in a cloud sandbox. Set either `image.docker` to use an existing Docker image or `image.dockerfile` to build a custom image. Fabro computes a deterministic internal snapshot name from the selected image source, resource hints, a single-tenant scope, and the Daytona API key. If neither field is set, Fabro uses Daytona's built-in `daytona-medium` snapshot.
```toml title="workflow.toml"
[environments.cloud]
provider = "daytona"
[environments.cloud.image]
dockerfile = { path = "Dockerfile" }
docker = "python:3.11-slim"
[environments.cloud.resources]
cpu = 4

4
docs/public/execution/run-configuration.mdx
View file

@ -320,8 +320,8 @@ memory = "8GB"
|---|---|
| `run.environment.id` | Environment slug to select. Defaults to `default`. |
| `environments.<slug>.provider` | Required provider: `local`, `docker`, or `daytona`. |
| `image.docker` | Docker image. Daytona rejects this field. |
| `image.dockerfile` | Inline Dockerfile or `{ path = "Dockerfile" }`; Daytona uses it to create or reuse an internally named snapshot. |
| `image.docker` | Docker image. Docker runs it directly; Daytona uses it to create or reuse an internally named snapshot. |
| `image.dockerfile` | Inline Dockerfile or `{ path = "Dockerfile" }`; Daytona uses it to create or reuse an internally named snapshot. Do not set it with `image.docker`. |
| `resources.cpu` / `memory` / `disk` | Best-effort resource hints. Unsupported provider fields warn and continue. |
| `network.mode` | `allow_all`, `block`, or `cidr_allow_list`. Local cannot enforce blocked/CIDR networking; Docker cannot enforce CIDR allow-lists. |
| `network.allow` | CIDRs for `cidr_allow_list`; entries are validated as CIDRs. |

22
docs/public/integrations/daytona.mdx
View file

@ -71,8 +71,9 @@ overwritten.
</Note>
[environments.cloud.image]
dockerfile = "FROM rust:1.85-slim-bookworm\nRUN apt-get update && apt-get install -y git ripgrep"
# Or keep the Dockerfile next to this TOML file:
docker = "rust:1.85-slim-bookworm"
# Or replace docker with an inline or path-based Dockerfile:
# dockerfile = "FROM rust:1.85-slim-bookworm\nRUN apt-get update && apt-get install -y git ripgrep"
# dockerfile = { path = "./Dockerfile" }
[environments.cloud.resources]
@ -110,7 +111,7 @@ Snapshots let you pre-build an environment image so each run starts with depende
```toml title="run.toml"
[environments.cloud.image]
dockerfile = "FROM node:20-slim\nRUN apt-get update && apt-get install -y git"
docker = "node:20-slim"
[environments.cloud.resources]
cpu = 4
@ -118,10 +119,19 @@ memory = 8
disk = 20
```
When a run starts with `image.dockerfile`, Fabro computes an internal snapshot name and looks up that snapshot in Daytona. If it doesn't exist, Fabro creates it automatically and polls until it reaches `Active` state (up to 10 minutes). `dockerfile` can be inline content or `{ path = "..." }`; paths are resolved relative to the TOML file that declares them and are bundled into run manifests. If the snapshot already exists, it's reused immediately.
Set either `image.docker` or `image.dockerfile`. `image.docker` can name any image that Daytona can pull, so a Dockerfile is not required. Use `image.dockerfile` when the image needs extra packages or other build steps:
```toml title="run.toml"
[environments.cloud.image]
dockerfile = "FROM node:20-slim\nRUN apt-get update && apt-get install -y git"
```
Fabro computes an internal snapshot name and looks up that snapshot in Daytona. If it does not exist, Fabro creates it automatically and polls until it reaches `Active` state for up to 30 minutes. A Dockerfile can be inline content or `{ path = "..." }`; paths are resolved relative to the TOML file that declares them and are bundled into run manifests. If the snapshot already exists, Fabro reuses it immediately.
The exact `image.docker` value is part of the snapshot identity. Prefer a digest such as `registry.example.com/team/image@sha256:...` when the image must be reproducible. If a mutable tag moves without its text changing, Fabro continues to reuse the existing snapshot.
<Note>
If no Dockerfile is configured, sandboxes are created from the `daytona-medium` snapshot which includes standard dev tools (git, etc.). To force a new custom snapshot, change the Dockerfile text, for example by adding a comment.
If neither image source is configured, sandboxes are created from the `daytona-medium` snapshot, which includes standard dev tools such as Git. To force a new Dockerfile snapshot, change the Dockerfile text, for example by adding a comment.
</Note>
## Private repositories
@ -227,7 +237,7 @@ If doctor reports missing scopes, regenerate the Daytona key with `write:snapsho
### Custom snapshot did not roll
Custom Daytona snapshot names are computed from the Dockerfile, resource hints, tenant scope, and Daytona API key. To force a new custom snapshot, change `image.dockerfile` text under the selected `[environments.<slug>.image]`.
Custom Daytona snapshot names are computed from the image reference or Dockerfile, resource hints, tenant scope, and Daytona API key. For `image.docker`, use an immutable digest and update it when the image changes. For `image.dockerfile`, change the Dockerfile text under the selected `[environments.<slug>.image]`.
### "Timed out waiting for snapshot to become active"

3
lib/apps/fabro-server/src/server/handler/runs.rs
View file

@ -1087,9 +1087,8 @@ async fn validate_intent_environment(
let provider = run_manifest::effective_sandbox_provider(&settings.run);
let image = &settings.run.environment.image;
let image_incompatible = match provider {
SandboxProviderKind::Local => false,
SandboxProviderKind::Docker => image.docker.is_none() && image.dockerfile.is_some(),
SandboxProviderKind::Daytona => image.docker.is_some(),
SandboxProviderKind::Local | SandboxProviderKind::Daytona => false,
};
let (target_incompatible, detail) = match target {
RunTarget::Git(_) => (

1
lib/components/fabro-sandbox/src/config.rs
View file

@ -122,5 +122,6 @@ pub struct DaytonaSnapshotSettings {
pub cpu: Option<i32>,
pub memory: Option<i32>,
pub disk: Option<i32>,
pub image: Option<String>,
pub dockerfile: Option<DockerfileSource>,
}

169
lib/components/fabro-sandbox/src/daytona/mod.rs
View file

@ -44,7 +44,7 @@ use crate::{
/// Remediation shown when a Daytona sandbox has no usable Bash.
const DAYTONA_BASH_REMEDIATION: &str = "Daytona sandboxes require /bin/bash for every command, with no `sh` fallback. Use the \
built-in Daytona snapshot, or a custom snapshot whose Dockerfile installs bash.";
built-in Daytona snapshot, or a custom snapshot whose image provides bash.";
/// Remediation shown when the session transport reaches Bash but never
/// completes.
@ -162,6 +162,18 @@ pub mod snapshot_identity {
entrypoint: Option<&'static str>,
}
#[derive(Serialize)]
struct ImageSnapshotManifest<'a> {
identity_version: u8,
provider: &'static str,
tenant: &'static str,
image: &'a str,
cpu: Option<i32>,
memory_gb: Option<i32>,
disk_gb: Option<i32>,
entrypoint: Option<&'static str>,
}
pub fn snapshot_name(api_key: &str, config: &DaytonaSnapshotConfig) -> crate::Result<String> {
let manifest = canonical_manifest(config)?;
let mut mac = HmacSha256::new_from_slice(api_key.as_bytes())
@ -174,16 +186,36 @@ pub mod snapshot_identity {
}
fn canonical_manifest(config: &DaytonaSnapshotConfig) -> crate::Result<Vec<u8>> {
let dockerfile = match &config.dockerfile {
Some(DockerfileSource::Inline(text)) => text.as_str(),
Some(DockerfileSource::Path { .. }) => {
let dockerfile = match (&config.image, &config.dockerfile) {
(Some(image), None) => {
return serde_json::to_vec(&ImageSnapshotManifest {
identity_version: IDENTITY_VERSION,
provider: PROVIDER,
tenant: TENANT,
image,
cpu: config.cpu,
memory_gb: config.memory,
disk_gb: config.disk,
entrypoint: None,
})
.map_err(|err| {
crate::Error::context("Failed to serialize Daytona snapshot identity", err)
});
}
(Some(_), Some(_)) => {
return Err(crate::Error::message(
"Daytona snapshot dockerfile path should have been resolved to inline content before sandbox creation",
"Daytona custom snapshots accept either image.docker or image.dockerfile, not both",
));
}
None => {
(None, None) => {
return Err(crate::Error::message(
"Daytona custom snapshots require image.dockerfile",
"Daytona custom snapshots require image.docker or image.dockerfile",
));
}
(None, Some(DockerfileSource::Inline(text))) => text.as_str(),
(None, Some(DockerfileSource::Path { .. })) => {
return Err(crate::Error::message(
"Daytona snapshot dockerfile path should have been resolved to inline content before sandbox creation",
));
}
};
@ -204,6 +236,45 @@ pub mod snapshot_identity {
}
}
fn create_snapshot_params(
name: &str,
config: &DaytonaSnapshotConfig,
) -> crate::Result<daytona_sdk::CreateSnapshotParams> {
let image = match (&config.image, &config.dockerfile) {
(Some(image), None) => daytona_sdk::ImageSource::Name(image.clone()),
(None, Some(DockerfileSource::Inline(dockerfile))) => {
daytona_sdk::ImageSource::Custom(daytona_sdk::DockerImage::from_dockerfile(dockerfile))
}
(None, Some(DockerfileSource::Path { .. })) => {
return Err(crate::Error::message(format!(
"Snapshot '{name}': dockerfile path should have been resolved to inline content before sandbox creation"
)));
}
(Some(_), Some(_)) => {
return Err(crate::Error::message(format!(
"Snapshot '{name}': image.docker and image.dockerfile cannot both be configured"
)));
}
(None, None) => {
return Err(crate::Error::message(format!(
"Snapshot '{name}' does not exist and no image or dockerfile was provided to create it"
)));
}
};
Ok(daytona_sdk::CreateSnapshotParams {
name: name.to_string(),
image,
resources: Some(daytona_sdk::Resources {
cpu: config.cpu,
memory: config.memory,
disk: config.disk,
..Default::default()
}),
entrypoint: None,
})
}
#[derive(Debug)]
pub struct DaytonaKeyCheck {
pub key_name: String,
@ -1101,9 +1172,9 @@ impl DaytonaSandbox {
/// Ensure the named snapshot exists and is active.
///
/// If the snapshot doesn't exist and a dockerfile is provided, creates it
/// and polls until it reaches `Active` state. Returns an error if the
/// snapshot is in a terminal failure state.
/// If the snapshot doesn't exist and an image source is provided, creates
/// it and polls until it reaches `Active` state. Returns an error if
/// the snapshot is in a terminal failure state.
async fn ensure_snapshot(
&self,
name: &str,
@ -1131,37 +1202,11 @@ impl DaytonaSandbox {
}
}
Err(daytona_sdk::DaytonaError::NotFound { .. }) => {
let dockerfile = match &snap_cfg.dockerfile {
Some(DockerfileSource::Inline(s)) => s.as_str(),
Some(DockerfileSource::Path { .. }) => {
return Err(crate::Error::message(format!(
"Snapshot '{name}': dockerfile path should have been resolved to inline content before sandbox creation"
)));
}
None => {
return Err(crate::Error::message(format!(
"Snapshot '{name}' does not exist and no dockerfile provided to create it"
)));
}
};
self.emit(SandboxEvent::SnapshotCreating {
name: name.to_string(),
});
let params = daytona_sdk::CreateSnapshotParams {
name: name.to_string(),
image: daytona_sdk::ImageSource::Custom(
daytona_sdk::DockerImage::from_dockerfile(dockerfile),
),
resources: Some(daytona_sdk::Resources {
cpu: snap_cfg.cpu,
memory: snap_cfg.memory,
disk: snap_cfg.disk,
..Default::default()
}),
entrypoint: None,
};
let params = create_snapshot_params(name, snap_cfg)?;
self.client.snapshot.create(&params).await.map_err(|e| {
crate::Error::context(format!("Failed to create snapshot '{name}'"), e)
})?;
@ -1470,7 +1515,7 @@ impl Sandbox for DaytonaSandbox {
.config
.snapshot
.as_ref()
.filter(|snapshot| snapshot.dockerfile.is_some())
.filter(|snapshot| snapshot.image.is_some() || snapshot.dockerfile.is_some())
{
let api_key = self.api_key.as_deref().ok_or_else(|| {
self.fail_init(
@ -3653,6 +3698,7 @@ mod tests {
cpu: Some(2),
memory: Some(4),
disk: Some(10),
image: None,
dockerfile: Some(DockerfileSource::Inline(
"FROM ubuntu:24.04\nRUN apt-get update".to_string(),
)),
@ -3663,6 +3709,7 @@ mod tests {
let rotated_key = snapshot_identity::snapshot_name("dtn_rotated", &config).unwrap();
assert_eq!(first, second);
assert_eq!(first, "fabro-e607185f-c7ab-88c9-bf9d-d70addba9298");
assert_ne!(first, rotated_key);
let uuid = first
.strip_prefix("fabro-")
@ -3678,6 +3725,7 @@ mod tests {
cpu: Some(2),
memory: Some(4),
disk: Some(10),
image: None,
dockerfile: Some(DockerfileSource::Inline("FROM ubuntu:24.04".to_string())),
};
let base_name = snapshot_identity::snapshot_name("dtn_secret", &base).unwrap();
@ -3715,6 +3763,7 @@ mod tests {
cpu: None,
memory: None,
disk: None,
image: None,
dockerfile: Some(DockerfileSource::Inline(
"FROM private.example.com/secret-image\nRUN echo raw-secret".to_string(),
)),
@ -3728,6 +3777,49 @@ mod tests {
assert!(!name.contains("dtn_super_secret_key"));
}
#[test]
fn computed_snapshot_identity_changes_for_image_reference() {
let config = DaytonaSnapshotConfig {
cpu: Some(2),
memory: Some(4),
disk: Some(10),
image: Some("ubuntu:24.04".to_string()),
dockerfile: None,
};
let first = snapshot_identity::snapshot_name("dtn_secret", &config).unwrap();
let changed = snapshot_identity::snapshot_name("dtn_secret", &DaytonaSnapshotConfig {
image: Some("ubuntu:24.10".to_string()),
..config
})
.unwrap();
assert_ne!(first, changed);
assert!(!first.contains("ubuntu"));
}
#[test]
fn snapshot_creation_uses_named_image_source() {
let config = DaytonaSnapshotConfig {
cpu: Some(2),
memory: Some(4),
disk: Some(10),
image: Some("ubuntu:24.04".to_string()),
dockerfile: None,
};
let params = create_snapshot_params("fabro-test", &config).unwrap();
assert_eq!(params.name, "fabro-test");
assert!(matches!(
params.image,
daytona_sdk::ImageSource::Name(ref image) if image == "ubuntu:24.04"
));
let resources = params.resources.expect("resources should be configured");
assert_eq!(resources.cpu, Some(2));
assert_eq!(resources.memory, Some(4));
assert_eq!(resources.disk, Some(10));
}
#[tokio::test]
async fn ensure_snapshot_uses_computed_snapshot_name_for_daytona_api_calls() {
let api_key = "dtn_secret";
@ -3735,6 +3827,7 @@ mod tests {
cpu: Some(2),
memory: Some(4),
disk: Some(10),
image: None,
dockerfile: Some(DockerfileSource::Inline("FROM ubuntu:24.04".to_string())),
};
let computed_name = snapshot_identity::snapshot_name(api_key, &snapshot).unwrap();

71
lib/components/fabro-sandbox/src/from_environment.rs
View file

@ -28,42 +28,48 @@ pub fn daytona_config_from_environment(
settings: &RunEnvironmentSettings,
clone: &RunCloneSettings,
) -> DaytonaConfig {
let dockerfile = settings
.image
.dockerfile
.as_ref()
.map(|dockerfile| match dockerfile {
ResolvedDockerfileSource::Inline(text) => SandboxDockerfileSource::Inline(text.clone()),
ResolvedDockerfileSource::Path { path } => {
SandboxDockerfileSource::Path { path: path.clone() }
}
});
let snapshot = (settings.image.docker.is_some() || dockerfile.is_some()).then(|| {
DaytonaSnapshotSettings {
cpu: settings.resources.cpu,
memory: settings
.resources
.memory
.map(|size| size_to_gb_i32(size.as_bytes())),
disk: settings
.resources
.disk
.map(|size| size_to_gb_i32(size.as_bytes())),
image: settings.image.docker.clone(),
dockerfile,
}
});
DaytonaConfig {
auto_stop_interval: settings
.lifecycle
.auto_stop
.map(|duration| duration_to_minutes_i32(duration.as_std())),
labels: (!settings.labels.is_empty()).then(|| settings.labels.clone()),
snapshot: settings.image.dockerfile.as_ref().map(|dockerfile| {
DaytonaSnapshotSettings {
cpu: settings.resources.cpu,
memory: settings
.resources
.memory
.map(|size| size_to_gb_i32(size.as_bytes())),
disk: settings
.resources
.disk
.map(|size| size_to_gb_i32(size.as_bytes())),
dockerfile: Some(match dockerfile {
ResolvedDockerfileSource::Inline(text) => {
SandboxDockerfileSource::Inline(text.clone())
}
ResolvedDockerfileSource::Path { path } => {
SandboxDockerfileSource::Path { path: path.clone() }
}
}),
}
}),
network: Some(match settings.network.mode {
labels: (!settings.labels.is_empty()).then(|| settings.labels.clone()),
snapshot,
network: Some(match settings.network.mode {
EnvironmentNetworkMode::Block => DaytonaNetwork::Block,
EnvironmentNetworkMode::AllowAll => DaytonaNetwork::AllowAll,
EnvironmentNetworkMode::CidrAllowList => {
DaytonaNetwork::AllowList(settings.network.allow.clone())
}
}),
clone_depth: clone.depth_limit(),
skip_clone: !clone.enabled,
clone_depth: clone.depth_limit(),
skip_clone: !clone.enabled,
}
}
@ -243,4 +249,19 @@ mod tests {
);
assert!(!missing.exists());
}
#[cfg(feature = "daytona")]
#[test]
fn daytona_config_maps_docker_image_to_snapshot() {
let mut settings = run_environment(EnvironmentProvider::Daytona);
settings.image.docker = Some("ubuntu:24.04".to_string());
settings.resources.cpu = Some(2);
let config = daytona_config_from_environment(&settings, &RunCloneSettings::default());
let snapshot = config.snapshot.expect("image should configure a snapshot");
assert_eq!(snapshot.image.as_deref(), Some("ubuntu:24.04"));
assert!(snapshot.dockerfile.is_none());
assert_eq!(snapshot.cpu, Some(2));
}
}

1
lib/components/fabro-workflow/tests/it/daytona_integration.rs
View file

@ -406,6 +406,7 @@ async fn daytona_snapshot_sandbox() {
cpu: Some(2),
memory: Some(4),
disk: Some(10),
image: None,
dockerfile: Some(fabro_sandbox::daytona::DockerfileSource::Inline(
"FROM ubuntu:22.04\nRUN apt-get update && apt-get install -y ripgrep".to_string(),
)),

8
lib/foundation/fabro-config/src/resolve/environment.rs
View file

@ -206,10 +206,14 @@ fn validate_daytona_image_settings(
path: &str,
errors: &mut Vec<ResolveError>,
) {
if environment.provider == EnvironmentProvider::Daytona && environment.image.docker.is_some() {
if environment.provider == EnvironmentProvider::Daytona
&& environment.image.docker.is_some()
&& environment.image.dockerfile.is_some()
{
errors.push(ResolveError::Invalid {
path: format!("{path}.image"),
reason: "daytona environments do not support image.docker; use image.dockerfile for custom snapshots".to_string(),
reason: "daytona environments accept either image.docker or image.dockerfile, not both"
.to_string(),
});
}
}

39
lib/foundation/fabro-config/src/tests/resolve_run.rs
View file

@ -658,8 +658,8 @@ dockerfile = { path = "Dockerfile" }
}
#[test]
fn daytona_image_docker_errors() {
let err = workflow_settings_from_toml_with_catalog(
fn daytona_image_docker_resolves() {
let settings = workflow_settings_from_toml_with_catalog(
r#"
_version = 1
@ -674,12 +674,41 @@ provider = "daytona"
docker = "ubuntu:24.04"
"#,
)
.expect_err("daytona should reject docker image selection");
.expect("daytona should accept docker image selection")
.run;
assert_eq!(settings.environment.provider, EnvironmentProvider::Daytona);
assert_eq!(
settings.environment.image.docker.as_deref(),
Some("ubuntu:24.04")
);
assert!(settings.environment.image.dockerfile.is_none());
}
#[test]
fn daytona_rejects_docker_image_and_dockerfile_together() {
let err = workflow_settings_from_toml_with_catalog(
r#"
_version = 1
[run.environment]
id = "cloud"
"#,
r#"
[environments.cloud]
provider = "daytona"
[environments.cloud.image]
docker = "ubuntu:24.04"
dockerfile = "FROM ubuntu:24.04"
"#,
)
.expect_err("daytona should reject two snapshot sources");
let message = err.to_string();
assert!(
message.contains("image.docker") && message.contains("daytona"),
"expected daytona image.docker diagnostic, got: {message}"
message.contains("image.docker") && message.contains("image.dockerfile"),
"expected mutually exclusive image diagnostic, got: {message}"
);
}