Custom Sandbox Images

#!/usr/bin/env bash
# warm-runtime-configs.sh - manage warm runtime configurations (VM install).
#
# Usage:
#   ./warm-runtime-configs.sh list
#   ./warm-runtime-configs.sh save <name> <config.json>
#   ./warm-runtime-configs.sh delete <name>
#
# Credentials are read from Kubernetes secrets automatically. To run without
# cluster access, export these variables before calling the script:
#   export RUNTIME_API_URL=https://runtime-api.<your-base-domain>
#   export API_KEY=<value from the default-api-key secret>
#   export ADMIN_PASSWORD=<value from the admin-password secret, or set in Admin Console>
set -euo pipefail

NAMESPACE="${NAMESPACE:-openhands}"
COMMAND="${1:?usage: $0 list|save|delete}"
CONFIG_NAME="${2:-}"
CONFIG_FILE="${3:-}"

if [ -z "${RUNTIME_API_URL:-}" ]; then
  RUNTIME_API_URL="https://$(kubectl get ingress -n "$NAMESPACE" \
    -l app.kubernetes.io/name=runtime-api \
    -o jsonpath='{.items[0].spec.rules[0].host}')"
fi
if [ -z "${API_KEY:-}" ]; then
  API_KEY=$(kubectl get secret default-api-key -n "$NAMESPACE" \
    -o jsonpath='{.data.default-api-key}' | base64 -d)
fi
if [ "$COMMAND" != "list" ] && [ -z "${ADMIN_PASSWORD:-}" ]; then
  ADMIN_PASSWORD=$(kubectl get secret admin-password -n "$NAMESPACE" \
    -o jsonpath='{.data.admin-password}' | base64 -d)
fi

if [ "$COMMAND" != "list" ] && [ -z "${ADMIN_PASSWORD:-}" ]; then
  echo "Error: admin password is not set. See Step 1." >&2
  exit 1
fi

PYSCRIPT='
import binascii, hashlib, json, os, sys, urllib.error, urllib.request

API_URL = os.environ["RUNTIME_API_URL"].rstrip("/")

def req(path, method="GET", data=None, headers=None):
    h = {"Content-Type": "application/json", **(headers or {})}
    r = urllib.request.Request(f"{API_URL}{path}", method=method, headers=h)
    if data is not None:
        r.data = json.dumps(data).encode()
    try:
        with urllib.request.urlopen(r) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        sys.exit(f"HTTP {e.code}: {e.read().decode()}")

def admin_token():
    chal = req("/api/admin/challenge")
    dk = hashlib.pbkdf2_hmac(
        "sha256",
        os.environ["ADMIN_PASSWORD"].encode(),
        (chal["salt"] + chal["challenge"]).encode(),
        chal["iterations"],
        dklen=32,
    )
    resp = req(
        "/api/admin/login",
        "POST",
        {"challenge": chal["challenge"], "hash": binascii.hexlify(dk).decode()},
    )
    return resp["token"]

action = os.environ["ACTION"]
name = os.environ.get("CONFIG_NAME", "")

if action == "list":
    configs = req(
        "/api/warm-runtime-configs",
        headers={"X-API-Key": os.environ["API_KEY"]},
    )["configs"]
    print(json.dumps(configs, indent=2))
elif action == "save":
    body = json.load(sys.stdin)
    token = admin_token()
    saved = req(
        f"/api/admin/warm-runtime-configs/{name}",
        "PUT",
        body,
        headers={"Authorization": f"Bearer {token}"},
    )
    print("Saved", saved["name"], "image:", saved["image"], "count:", saved.get("count"))
elif action == "delete":
    token = admin_token()
    resp = req(
        f"/api/admin/warm-runtime-configs/{name}",
        "DELETE",
        headers={"Authorization": f"Bearer {token}"},
    )
    print(resp["message"])
'

case "$COMMAND" in
  list)
    ACTION=list API_KEY="$API_KEY" RUNTIME_API_URL="$RUNTIME_API_URL" \
      python3 -c "$PYSCRIPT"
    ;;
  save)
    if [ -z "$CONFIG_NAME" ] || [ ! -f "$CONFIG_FILE" ]; then
      echo "usage: $0 save <name> <config.json>" >&2; exit 1
    fi
    ACTION=save CONFIG_NAME="$CONFIG_NAME" ADMIN_PASSWORD="$ADMIN_PASSWORD" \
      RUNTIME_API_URL="$RUNTIME_API_URL" python3 -c "$PYSCRIPT" < "$CONFIG_FILE"
    ;;
  delete)
    if [ -z "$CONFIG_NAME" ]; then
      echo "usage: $0 delete <name>" >&2; exit 1
    fi
    ACTION=delete CONFIG_NAME="$CONFIG_NAME" ADMIN_PASSWORD="$ADMIN_PASSWORD" \
      RUNTIME_API_URL="$RUNTIME_API_URL" python3 -c "$PYSCRIPT"
    ;;
  *)
    echo "Unknown command: $COMMAND (valid: list, save, delete)" >&2; exit 1
    ;;
esac

# Run once from a machine with kubectl access, then save the output
NAMESPACE=openhands
echo "export RUNTIME_API_URL=https://$(kubectl get ingress -n "$NAMESPACE" \
  -l app.kubernetes.io/name=runtime-api \
  -o jsonpath='{.items[0].spec.rules[0].host}')"
echo "export API_KEY=$(kubectl get secret default-api-key -n "$NAMESPACE" \
  -o jsonpath='{.data.default-api-key}' | base64 -d)"
echo "export ADMIN_PASSWORD=$(kubectl get secret admin-password -n "$NAMESPACE" \
  -o jsonpath='{.data.admin-password}' | base64 -d)"