mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-20 00:11:34 +00:00
7f84ac5e3f
## Summary
Replaces the `[run.sandbox]` configuration surface with a named,
provider-explicit environment catalog. Runs now select an environment by
slug (`[run.environment] id = "..."`) rather than configuring a sandbox
inline. Fabro resolves the catalog through normal settings precedence,
applies sparse run-level overrides, and creates a concrete sandbox from
the resolved environment.
This is a clean break — no `[run.sandbox]` compatibility layer.
### Plan Summary
- **New config shape:** Top-level `[environments.<slug>]` catalog valid
in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`. Runs
reference a slug via `[run.environment] id = "..."` with optional sparse
overrides under `[run.environment.*]`.
- **Unified environment fields:** `provider`, `image` (ref +
dockerfile), `resources` (cpu/memory/disk), `network` (mode + allow
CIDRs), `lifecycle` (preserve/stop_on_terminal/auto_stop), `labels`,
`volumes`, `env` — replacing the previous split between `[run.sandbox]`,
`[run.sandbox.docker]`, `[run.sandbox.daytona]`, and
`[run.sandbox.daytona.snapshot]`.
- **OpenAPI schema update:** `RunSandboxSettings`, `DockerSettings`,
`DaytonaSettings`, and `DaytonaNetworkLayer` replaced with
`RunEnvironmentSettings`, `EnvironmentSettings`, `EnvironmentProvider`,
`EnvironmentImageSettings`, `EnvironmentResourcesSettings`,
`EnvironmentNetworkSettings`, `EnvironmentLifecycleSettings`, and
`EnvironmentVolumeSettings`.
- **CLI flag rename:** `--sandbox <provider>` → `--environment <slug>`
on `run`, `create`, `preflight`, and `server start/restart`.
- **Provider capability model:** Hard errors for security properties a
provider cannot enforce (local with blocked/CIDR networking; docker with
CIDR allow-lists). Warnings for unsupported resource limits, volumes,
labels, auto-stop, and Docker Dockerfiles.
- **Docs and internal code updated** throughout: `.fabro/project.toml`,
workflow configs, all public docs, CLI args, manifest builders, and the
runner's GitHub credentials check.
### Provider mapping
| Environment field | Local | Docker | Daytona |
|---|---|---|---|
| `image.ref` | Ignored | Docker image | Snapshot name |
| `image.dockerfile` | Ignored | Warning; ignored | Snapshot Dockerfile
(requires `image.ref`) |
| `resources.cpu/memory/disk` | Warning; ignored | cpu_quota / memory
limit / warning | Snapshot sizing |
| `network.mode = block` | **Error** | `network_mode = none` | Daytona
block |
| `network.mode = cidr_allow_list` | **Error** | **Error** | Daytona
CIDR allow-list |
| `labels` | Warning; ignored | Warning; ignored | Daytona labels |
| `volumes` | Warning; ignored | Warning; ignored | Daytona volume
mounts |
| `lifecycle.auto_stop` | Warning; ignored | Warning; ignored | Daytona
auto-stop interval |
| `env` | Process env overlay | Container env | Sandbox env |
### Fabro Details
<details>
<summary>Ran 11 stages in 217m 39s for $129.86</summary>
| Stage | Duration | Cost | Retries |
|---|---|---|---|
| start | 0s | – | 0 |
| toolchain | 1s | – | 0 |
| preflight_compile | 4m 7s | – | 0 |
| preflight_lint | 4m 9s | – | 0 |
| fix_lints | 3m 46s | $1.06 | 0 |
| implement | 76m 6s | $57.39 | 0 |
| simplify_opus | 71m 50s | $38.17 | 0 |
| simplify_gpt | 8m 27s | $2.24 | 0 |
| verify | 6m 10s | – | 0 |
| fixup | 42m 1s | $31.00 | 0 |
| fmt | 3s | – | 0 |
| **Total** | **217m 39s** | **$129.86** | **0** |
</details>
<details>
<summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15
edges)</summary>
```dot
digraph ImplementPlan {
graph [
goal="Implement and simplify",
model_stylesheet="
* { model: claude-opus-4-7; }
"
]
rankdir=LR
start [shape=Mdiamond, label="Start"]
exit [shape=Msquare, label="Exit"]
toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0]
preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0]
preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0]
fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3]
implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"]
simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"]
simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"]
verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"]
fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3]
fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0]
start -> toolchain
toolchain -> preflight_compile [condition="outcome=succeeded"]
toolchain -> exit
preflight_compile -> preflight_lint [condition="outcome=succeeded"]
preflight_compile -> exit
preflight_lint -> implement [condition="outcome=succeeded"]
preflight_lint -> fix_lints
fix_lints -> preflight_lint
implement -> simplify_opus -> simplify_gpt -> verify
verify -> fmt [condition="outcome=succeeded"]
verify -> fixup
fixup -> verify
fmt -> exit
}
```
</details>
⚒️ Generated with [Fabro](https://fabro.sh)
---------
Co-authored-by: Fabro <noreply@fabro.sh>
Co-authored-by: Bryan Helmkamp <bryan@brynary.com>
Co-authored-by: Bryan Helmkamp <bhelmkamp@users.noreply.github.com>
197 lines
5.3 KiB
Text
197 lines
5.3 KiB
Text
---
|
|
title: "Environments"
|
|
description: "Reusable named execution environments for workflow runs"
|
|
---
|
|
|
|
Fabro separates **environments** from **sandboxes**:
|
|
|
|
- An **environment** is reusable desired configuration: provider, image, resources, network, lifecycle, labels, volumes, and environment variables.
|
|
- A **sandbox** is the concrete runtime instance Fabro creates for a run from the selected environment.
|
|
|
|
Runs select environments by slug:
|
|
|
|
```toml title="workflow.toml"
|
|
[run.environment]
|
|
id = "fabro-dev"
|
|
```
|
|
|
|
Environment catalogs can live in `settings.toml`, `.fabro/project.toml`, or `workflow.toml`, and merge through the normal settings precedence. The built-in default is `default`, a Docker environment using `buildpack-deps:noble`.
|
|
|
|
## Defining environments
|
|
|
|
```toml title="workflow.toml"
|
|
[run.environment]
|
|
id = "fabro-dev"
|
|
|
|
[environments.fabro-dev]
|
|
provider = "daytona" # local | docker | daytona
|
|
|
|
[environments.fabro-dev.image]
|
|
ref = "fabro-v11" # Docker image or Daytona snapshot name
|
|
dockerfile = { path = "Dockerfile" }
|
|
|
|
[environments.fabro-dev.resources]
|
|
cpu = 8
|
|
memory = "16GB"
|
|
disk = "20GB"
|
|
|
|
[environments.fabro-dev.network]
|
|
mode = "cidr_allow_list" # allow_all | block | cidr_allow_list
|
|
allow = ["10.0.0.0/8"]
|
|
|
|
[environments.fabro-dev.lifecycle]
|
|
preserve = false
|
|
stop_on_terminal = true
|
|
auto_stop = "30m"
|
|
|
|
[environments.fabro-dev.labels]
|
|
repo = "fabro-sh/fabro"
|
|
|
|
[[environments.fabro-dev.volumes]]
|
|
id = "vol-agent-state"
|
|
mount_path = "/home/daytona/agent-state"
|
|
subpath = "auth"
|
|
|
|
[environments.fabro-dev.env]
|
|
NODE_ENV = "development"
|
|
```
|
|
|
|
Run-level overrides are sparse and apply only to the selected environment:
|
|
|
|
```toml title="workflow.toml"
|
|
[run.environment]
|
|
id = "fabro-dev"
|
|
|
|
[run.environment.resources]
|
|
memory = "32GB"
|
|
|
|
[run.environment.lifecycle]
|
|
preserve = true
|
|
```
|
|
|
|
`env` and `labels` merge by key. `volumes` replace as a whole list when set at a higher-precedence layer.
|
|
|
|
## Selecting an environment from the CLI
|
|
|
|
Use `--environment` with an environment slug:
|
|
|
|
```bash
|
|
fabro run workflow.fabro --environment fabro-dev
|
|
fabro preflight workflow.fabro --environment ci
|
|
fabro server start --environment default
|
|
```
|
|
|
|
`--preserve-sandbox` still controls the concrete runtime instance lifecycle for a run. Runtime commands such as `fabro sandbox ssh` keep the word "sandbox" because they operate on an already-created runtime instance.
|
|
|
|
## Built-in default
|
|
|
|
```toml
|
|
[run.environment]
|
|
id = "default"
|
|
|
|
[environments.default]
|
|
provider = "docker"
|
|
|
|
[environments.default.image]
|
|
ref = "buildpack-deps:noble"
|
|
|
|
[environments.default.resources]
|
|
cpu = 2
|
|
memory = "4GB"
|
|
|
|
[environments.default.lifecycle]
|
|
preserve = false
|
|
stop_on_terminal = true
|
|
```
|
|
|
|
## Provider mappings
|
|
|
|
| Environment field | Local | Docker | Daytona |
|
|
|---|---|---|---|
|
|
| `image.ref` | Ignored | Docker image | Snapshot name |
|
|
| `image.dockerfile` | Ignored | Warning; ignored | Snapshot Dockerfile; requires `image.ref` |
|
|
| `resources.cpu` | Warning; ignored | `cpu_quota = cpu * 100000` | Snapshot CPU |
|
|
| `resources.memory` | Warning; ignored | Container memory limit | Snapshot memory |
|
|
| `resources.disk` | Warning; ignored | Warning; ignored | Snapshot disk |
|
|
| `network.mode = "allow_all"` | Host network | Docker default bridge | Daytona allow-all |
|
|
| `network.mode = "block"` | Error | Docker `none` network | Daytona block |
|
|
| `network.mode = "cidr_allow_list"` | Error | Error | Daytona CIDR allow-list |
|
|
| `labels` | Warning; ignored | Warning; ignored | Daytona labels |
|
|
| `volumes` | Warning; ignored | Warning; ignored | Daytona volume mounts |
|
|
| `lifecycle.auto_stop` | Warning; ignored | Warning; ignored | Daytona auto-stop |
|
|
| `env` | Process environment overlay | Container environment | Sandbox environment |
|
|
|
|
## Local
|
|
|
|
`local` runs tools directly in the resolved working directory. It offers no filesystem or network isolation, so use it only for trusted workflows.
|
|
|
|
```toml
|
|
[run.environment]
|
|
id = "host"
|
|
|
|
[environments.host]
|
|
provider = "local"
|
|
```
|
|
|
|
Fabro hard-errors if a local environment asks for blocked or CIDR-restricted networking because the provider cannot enforce it.
|
|
|
|
## Docker
|
|
|
|
Docker runs tools inside a container created from `image.ref`. Docker is the built-in default provider.
|
|
|
|
```toml
|
|
[run.environment]
|
|
id = "ci"
|
|
|
|
[environments.ci]
|
|
provider = "docker"
|
|
|
|
[environments.ci.image]
|
|
ref = "buildpack-deps:noble"
|
|
|
|
[environments.ci.resources]
|
|
cpu = 2
|
|
memory = "4GB"
|
|
|
|
[environments.ci.network]
|
|
mode = "block"
|
|
```
|
|
|
|
Docker and Daytona are clone-based providers. When a run has a GitHub origin, Fabro clones it into the provider workspace. Set `[run.clone] enabled = false` to start with an empty workspace.
|
|
|
|
## Daytona
|
|
|
|
Daytona runs tools in a cloud sandbox. `image.ref` is the snapshot name. If `image.dockerfile` is set and the snapshot does not exist, Fabro creates the snapshot; `image.ref` is required so the snapshot has a name.
|
|
|
|
```toml
|
|
[run.environment]
|
|
id = "cloud"
|
|
|
|
[environments.cloud]
|
|
provider = "daytona"
|
|
|
|
[environments.cloud.image]
|
|
ref = "rust-dev"
|
|
dockerfile = { path = "Dockerfile" }
|
|
|
|
[environments.cloud.resources]
|
|
cpu = 4
|
|
memory = "8GB"
|
|
disk = "20GB"
|
|
|
|
[environments.cloud.lifecycle]
|
|
auto_stop = "30m"
|
|
|
|
[environments.cloud.network]
|
|
mode = "cidr_allow_list"
|
|
allow = ["208.80.154.232/32", "10.0.0.0/8"]
|
|
```
|
|
|
|
Daytona volumes reference existing provider-managed volumes:
|
|
|
|
```toml
|
|
[[environments.cloud.volumes]]
|
|
id = "vol-agent-state"
|
|
mount_path = "/home/daytona/agent-state"
|
|
subpath = "agent-auth"
|
|
```
|