ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve URLs for previously published server charts**\\n\\nFor any `opensandbox-server` release published before this change where the app and chart versions differ, this URL points to a nonexistent tag: the previous publishing workflow explicitly used `app_version` in `release_tag`, while the artifact filename used `CHART_VERSION`. Existing artifacts are not relocated by changing the workflow, so users who follow “Choose a published” release can receive a 404; retain the legacy URL instructions for older releases or document a cutoff/migration alongside the new convention.\\n\\nAGENTS.md reference: [AGENTS.md:L44-L47](https://github.com/opensandbox-group/OpenSandbox/blob/4bb7ec373006949ae1ae59bb9309028e2371a341/AGENTS.md#L44-L47)\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"docs/kubernetes/deployment.md\",\"side\":\"RIGHT\",\"line\":31}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `4bb7ec3730`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"Fixed on the current head (`4bb7ec373006949ae1ae59bb9309028e2371a341`). The standalone `opensandbox-controller` chart is now version `0.2.1` while retaining `appVersion: \\\"0.2.0\\\"`; the umbrella dependency is `0.2.1`, and `Chart.lock` was regenerated. I also restored independent chart/app version handling in the publish workflow so a `helm/opensandbox-controller/0.2.1` tag preserves the committed controller app version instead of rewriting it to a nonexistent image version.\\n\\nVerified with `make helm-lint`, `helm dependency list charts/opensandbox`, standalone and umbrella render assertions (both default to `controller:v0.2.0` and omit `--containerd-socket-path`; an explicit socket override still renders the flag), workflow YAML parsing, and the docs build. All checks on the current head are green.\",\"path\":\"kubernetes/charts/opensandbox-controller/values.yaml\",\"side\":\"RIGHT\",\"line\":66}{\"type\":\"pull_request_comment\",\"body\":\"No additional compatibility note is needed because there are no legacy `opensandbox-server` Helm releases or tags to preserve. I checked the complete GitHub release list (`gh release list --limit 500`) and the remote tag namespace (`refs/tags/helm/opensandbox-server/*`); both contain zero matches. The only four historical `helm/*` releases are controller/umbrella `0.1.0` and `0.2.0`, and their tag, chart, and app versions are equal.\\n\\nTherefore this documentation describes the first future `opensandbox-server` chart release under the corrected chart-version URL convention; it cannot turn any previously published server URL into a 404. Adding a cutoff or migration path would document artifacts that never existed.\",\"path\":\"docs/kubernetes/deployment.md\",\"side\":\"RIGHT\",\"line\":31}{\"type\":\"pull_request_comment\",\"body\":\"@codex /review\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Report the server version that the chart actually deploys**\\n\\nWhen a tag-triggered `opensandbox-server` release runs, this reads `0.1.0` from `Chart.yaml`, while `kubernetes/charts/opensandbox-server/values.yaml:28` pins the default server image to `v0.2.2`. The updated deployment guide tells users to copy this advertised app version and explicitly pass it as `server.image.tag`, so following the release instructions deploys the wrong server version; align `appVersion` with the pinned image or derive the reported version from the chart's effective image tag.\\n\\nAGENTS.md reference: [AGENTS.md:L42-L46](https://github.com/opensandbox-group/OpenSandbox/blob/4bb7ec373006949ae1ae59bb9309028e2371a341/AGENTS.md#L42-L46)\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/publish-helm-chart.yml\",\"side\":\"RIGHT\",\"line\":154}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `4bb7ec3730`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"Fixed on the current head (`d6dc9097e7e79f9403f7bc77bcaa76850588f972`) by updating `kubernetes/charts/opensandbox-server/Chart.yaml` to `appVersion: \\\"0.2.2\\\"`, matching the chart's effective default `server.image.tag: \\\"v0.2.2\\\"`. This is a one-time metadata backfill: `scripts/bump-server-chart.sh` already updates both the pinned image tag and `appVersion` for future server releases.\\n\\nVerified that `helm show chart` reports app version `0.2.2` for both the standalone chart and the packaged umbrella dependency, and that both rendered deployments use `opensandbox/server:v0.2.2` with `app.kubernetes.io/version: \\\"0.2.2\\\"`. `make helm-lint`, workflow YAML parsing, and the full docs build also pass.\",\"path\":\".github/workflows/publish-helm-chart.yml\",\"side\":\"RIGHT\",\"line\":154}","text_elements",[],{"_397":676,"_376":377,"_399":383},{"_400":677,"_402":-5,"_45":-5,"_404":678,"_406":-5,"_99":317,"_95":408},[679],{"_409":383},{"_49":672,"_95":451},{"_397":681,"_376":377,"_399":383},{"_400":682,"_402":-5,"_45":-5,"_404":683,"_406":-5,"_99":317,"_95":408},[684,685],{"_409":383},{"_49":687,"_95":451},{"_49":686,"_95":451},"\n /workspace/OpenSandbox\n bash\n 2026-08-18\n Etc/UTC\n /workspace/OpenSandbox\n","# AGENTS.md instructions for /workspace/OpenSandbox\n\n\n# OpenSandbox AGENTS\n\nUse this file as the root router for the monorepo. Prefer the nearest `AGENTS.md` in the directory tree for task-specific instructions.\n\n## Repository Map\n\n- `server/`: FastAPI lifecycle control plane, Docker/Kubernetes runtime integration, snapshot metadata, and server tests\n- `components/execd/`: in-sandbox execution daemon\n- `components/egress/`: per-sandbox network egress policy sidecar\n- `components/ingress/`: ingress gateway and endpoint routing\n- `components/internal/`: shared Go helpers used by runtime components\n- `sdks/`: sandbox, code-interpreter, and MCP SDKs plus generated clients\n- `specs/`: public OpenAPI contracts and examples\n- `kubernetes/`: Kubernetes operator, CRDs, task-executor, Helm charts, and Kind e2e tests\n- `cli/`: `osb` command-line client and bundled CLI skills\n- `tests/`: cross-language end-to-end SDK tests\n- `docs/`, `examples/`, `sandboxes/`, `oseps/`: documentation, samples, images/environments, and proposals\n\n## Routing\n\n- For `server/**`, or lifecycle server behavior, sandbox creation flow, or user-visible server config, read `server/AGENTS.md`.\n- For `sdks/**`, or SDK generation, handwritten adapters, or cross-language SDK alignment, read `sdks/AGENTS.md`.\n- For `specs/**`, or API contract, schema, or example changes, read `specs/AGENTS.md`.\n- For `kubernetes/**`, or CRDs, controller behavior, task execution, Helm/Kustomize deployment, pool scheduling, pause/resume snapshots, or Kind e2e tests, read `kubernetes/AGENTS.md`.\n- For cross-cutting changes spanning spec, server, and SDKs, start with `specs/AGENTS.md` and then read affected consumer guides.\n- For runtime component changes under `components/**`, read the nearest `README.md` or `DEVELOPMENT.md`; keep component APIs aligned with `specs/` and SDK consumers.\n- For CLI changes under `cli/**`, read `cli/README.md` and verify command help/output behavior alongside unit tests.\n- For cross-language e2e tests under `tests/**`, read the language-local README and keep test assumptions aligned with current server and SDK behavior.\n- For areas without a local `AGENTS.md`, use the nearest `README.md`, `DEVELOPMENT.md`, and CI workflow as the next source of truth.\n\n## Working Principles\n\n- Think before coding: state assumptions, surface ambiguity, and ask or push back when the request has conflicting interpretations.\n- Simplicity first: implement the smallest solution that satisfies the request; avoid speculative features, one-off abstractions, and unnecessary configurability.\n- Surgical changes: touch only files and lines needed for the task, match local style, and do not refactor or delete unrelated pre-existing code.\n- Goal-driven execution: translate non-trivial work into verifiable success criteria, add or update focused tests when behavior changes, and loop until checks pass or blockers are clear.\n\n## Guardrails\n\nAlways:\n\n- Keep changes focused on the user request.\n- Treat `specs/*` as public contract sources.\n- Keep spec, implementation, SDKs, docs, examples, config, and CLI behavior aligned when user-visible behavior changes.\n- When changing `specs/*`, also update or verify affected server, SDK, docs, and release outputs when practical.\n- When changing CRDs or Kubernetes public behavior, update or verify generated manifests, Helm/Kustomize deployment output, server Kubernetes integration, and docs when practical.\n- Prefer additive, backward-compatible changes for public interfaces.\n- Regenerate derived outputs when the source-of-truth file changes.\n- Update tests when behavior changes or bugs are fixed.\n- Mention unrun or blocked verification in the final handoff.\n- Prefer file-scoped or package-scoped checks before full-suite validation.\n\nAsk first:\n\n- Breaking public API, SDK, config, protocol, or CLI changes\n- Breaking CRD, annotation, label, Helm values, or Kubernetes deployment changes\n- Intentional drift between a public contract and its implementation\n- User-visible config or behavior changes without a clear migration story\n\nNever:\n\n- Edit generated output as the only fix.\n- Mix unrelated component work into the same change.\n\n## Documentation Rules\n\n### Content ownership — single source of truth\n\n| Content type | Source of truth | Rule |\n|---|---|---|\n| User and operations docs | `docs/` | Keep long-form docs here |\n| Root README | repo root `README.md` | GitHub homepage |\n| SDK, CLI, Helm, and other publishable package READMEs | package directory | Keep install, quick start, and package entry points |\n| Non-publishable component/module READMEs | component/module directory | Keep minimal pointers to `docs/` when a docs page exists |\n| Examples | `docs/examples/` + runnable code under `examples/` | Put docs in `docs/examples/`; keep example READMEs as thin pointers |\n| OSEPs | `oseps/` | `docs/community/oseps.md` only indexes GitHub proposals |\n| CONTRIBUTING, CODE_OF_CONDUCT, DEVELOPMENT | repo root / component directory | `docs/community/` links to them, does not duplicate them |\n\n**When modifying user-visible or operations-visible behavior**: update `docs/` first.\n\n**When editing READMEs**: avoid long-form docs outside root or publishable package READMEs.\n\n**When adding examples**: keep runnable code under `examples/`, and document it under `docs/examples/`.\n\n**When linking from README files to docs**: prefer repository-relative `docs/*.md` links so links match the checked-out branch or tag. Use `https://open-sandbox.ai` as a public site entry point, not as the only source link from versioned code directories.\n\n**When handling localized READMEs**: do not add new localized copies for SDKs, examples, or non-special modules.\n\n### Docs site structure\n\n```\ndocs/\n getting-started/ # Quick start, installation, configuration\n architecture/ # Architecture overview, network design\n guides/ # Feature guides (credential vault, secure container, etc.)\n sdks/ # SDK reference (one page per language per SDK)\n components/ # Server, execd, ingress, egress\n kubernetes/ # Kubernetes operator and deployment\n api/ # OpenAPI spec reference\n cli/ # CLI reference\n examples/ # One page per example\n community/ # Contributing, code of conduct, OSEPs, releases\n reference/ # Migration guides\n```\n\n### Docs conventions\n\n- Engine: VitePress. Config is a static `config.mts` with no build-time code generation.\n- All images go in `docs/public/images/`, referenced as `/images/filename` in markdown.\n- Every page must have YAML frontmatter with `title` and `description`.\n- Internal links use VitePress absolute paths (e.g., `/sdks/python`, `/guides/credential-vault`).\n- Links to source code or specs use full GitHub URLs.\n- Use VitePress custom containers (`::: tip`, `::: warning`, `::: info`) and code groups where appropriate.\n- Build and verify: `cd docs && pnpm docs:build` — must complete with zero errors.\n- The README.md in `docs/` is for docs-site contributors only (how to run dev server), and must stay excluded from the published site.\n\n## Review Focus\n\n- Prioritize breaking changes in specs, SDK interfaces, config, CLI behavior, and protocols.\n- Flag protocol changes that are unnecessary, inconsistent, or hard to implement.\n- Flag changes that break source-of-truth boundaries or intended layering.\n- Call out missing tests and compatibility risks explicitly.\n\n",{"_397":689,"_376":377,"_399":383},{"_400":690,"_402":-5,"_45":-5,"_404":691,"_406":-5,"_99":692,"_95":408},[693],{"_409":383},"developer",{"_49":694,"_95":451},"Do not spawn sub-agents unless the user or applicable AGENTS.md/skill instructions explicitly ask for sub-agents, delegation, or parallel agent work.",{"_397":696,"_376":377,"_399":383},{"_400":697,"_402":-5,"_45":-5,"_404":698,"_406":-5,"_99":692,"_95":408},[699],{"_409":383},{"_49":700,"_95":451},"You are `/root`, the primary agent in a team of agents collaborating to fulfill the user's goals.\n\nAt the start of your turn, you are the active agent.\nYou can spawn sub-agents to handle subtasks, and those sub-agents can spawn their own sub-agents.\nAll agents in the team, including the agents that you can assign tasks to, are equally intelligent and capable, and have access to the same set of tools.\n\nYou can use `spawn_agent` to create a new agent, `followup_task` to give an existing agent a new task and trigger a turn, and `send_message` to pass a message to a running agent without triggering a turn.\nChild agents can also spawn their own sub-agents.\nYou can decide how much context you want to propagate to your sub-agents with the `fork_turns` parameter.\n\nYou will receive messages in the analysis channel in the form:\n```\nMessage Type: MESSAGE | FINAL_ANSWER\nTask name: \nSender: \nPayload:\n\n```\nThey may be addressed as to=/root\n\nNote that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.collaboration.spawn_agent`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message.\n\nAll agents share the same directory. In detail:\n- All agents have access to the same container and filesystem as you.\n- All agents use the same current working directory.\n- As a result, edits made by one agent are immediately visible to all other agents.\n\nThere are 4 available concurrency slots, meaning that up to 4 agents can be active at once, including you.",{"_397":702,"_376":377,"_399":383},{"_400":703,"_402":-5,"_45":-5,"_404":704,"_406":-5,"_99":692,"_95":408},[705,706],{"_409":383},{"_49":708,"_95":451},{"_49":707,"_95":451},"\n## Skills\nA skill is a set of instructions provided through a `SKILL.md` source. Below is the list of skills that can be used. Each entry includes a name, description, and source locator. `file` locators are on the host filesystem, `environment resource` locators are owned by an execution environment, `orchestrator resource` locators are opaque non-filesystem resources, and `custom resource` locators use their provider's access mechanism.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs questions, use the Codex manual helper first for broad Codex self-knowledge, and restrict fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries for plugin ordering and availability metadata, or update an existing local plugin during development with the CLI-driven cachebuster and reinstall flow. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_376":377,"_90":711},{"_106":-5,"_45":383,"_384":712,"_386":387,"_388":389,"_390":713},[],"inProgress",{"_390":715,"_376":377},{"_716":717,"_95":718},"activeFlags",[],"active","thread/started",{"_721":722},"thread",{"_723":-5,"_724":-5,"_725":726,"_727":389,"_461":462,"_728":18,"_729":-5,"_730":-5,"_731":-5,"_732":733,"_45":377,"_734":735,"_193":-5,"_736":-5,"_168":737,"_738":207,"_739":389,"_740":377,"_467":741,"_390":742,"_743":-5,"_80":744,"_745":389},"agentNickname","agentRole","cliVersion","0.144.0-alpha.4","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/08/18/rollout-2026-08-18T13-04-43-01a014f9-63e0-7f31-abf2-e454200129aa.jsonl","preview","recencyAt","sessionId","vscode",{"_95":394},"threadSource",[],"updatedAt",[],"messages",[749],{"_45":750,"_751":752,"_753":754,"_755":754,"_400":756,"_390":757,"_402":-5,"_758":35,"_759":760,"_761":291,"_762":-5},"8ad22a71-e7e4-41c9-88ca-1aa9b1f9ebe2","author",{"_99":317,"_193":-5,"_759":771},"create_time",1787058282.519305,"update_time",{"_767":49,"_768":769},"finished_successfully","weight","metadata",{"_763":764},"recipient","channel","l1239dk1",{"_765":766},"inline_comments",[],"content_type","parts",[770],"@codex /review\nfix(chart): default containerdSocketPath to empty and bump opensandbox chart to 0.2.2\n\n## What does this PR do?\n\n1. **Fix Controller \\`--containerd-socket-path\\` flag crash**:\n - Default \\`controller.snapshot.containerdSocketPath\\` to \\`\"\"\\` in \\`kubernetes/charts/opensandbox-controller/values.yaml\\`.\n - The Go controller binary defaults internally to \\`/var/run/containerd/containerd.sock\\` when the flag is omitted. Defaulting to \\`\"\"\\` in chart values ensures \\`--containerd-socket-path\\` is not rendered by default, preventing \\`flag provided but not defined: -containerd-socket-path\\` CrashLoopBackOff when deploying with controller image \\`v0.2.0\\`.\n2. **Bump all-in-one chart version to 0.2.2**:\n - Update \\`version\\` and \\`appVersion\\` to \\`0.2.2\\` in \\`kubernetes/charts/opensandbox/Chart.yaml\\` and synchronize \\`Chart.lock\\`.\n3. **Enhance CI & Makefile validation**:\n - Update \\`make helm-lint\\` in \\`kubernetes/Makefile\\` to lint all subcharts and verify \\`helm dependency build\\` for the all-in-one chart.\n - Add \\`make helm-lint\\` step to \\`.github/workflows/kubernetes-test.yml\\` to prevent future \\`Chart.lock\\` out-of-sync release failures.\n4. **Update docs**:\n - Update tip in \\`docs/examples/aks-kata.md\\`.\n\n## Related Issue\n\nFixes #1529\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Publish the controller fix under a new chart version**\n\nWhen users install the standalone `opensandbox-controller` release rather than building the repository checkout, this corrected default remains unavailable: the edited chart still declares `version: 0.2.0` in `kubernetes/charts/opensandbox-controller/Chart.yaml`, which is already the documented release package, while `publish-helm-chart.yml` derives the artifact version from that unchanged field and explicitly does not bump it. Bump the controller chart version and update the umbrella dependency/lock so this CrashLoop fix is shipped as a distinct artifact.\n\nAGENTS.md reference: [AGENTS.md:L46-L46](https://github.com/opensandbox-group/OpenSandbox/blob/45bbe5b40c64a9b4e214f04011a9f8b0dfaadb47/AGENTS.md#L46-L46)\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `45bbe5b40c`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve URLs for previously published server charts**\n\nFor any `opensandbox-server` release published before this change where the app and chart versions differ, this URL points to a nonexistent tag: the previous publishing workflow explicitly used `app_version` in `release_tag`, while the artifact filename used `CHART_VERSION`. Existing artifacts are not relocated by changing the workflow, so users who follow “Choose a published” release can receive a 404; retain the legacy URL instructions for older releases or document a cutoff/migration alongside the new convention.\n\nAGENTS.md reference: [AGENTS.md:L44-L47](https://github.com/opensandbox-group/OpenSandbox/blob/4bb7ec373006949ae1ae59bb9309028e2371a341/AGENTS.md#L44-L47)\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `4bb7ec3730`\n \n\n

ℹ️ About Codex in GitHub

\nFixed on the current head (`4bb7ec373006949ae1ae59bb9309028e2371a341`). The standalone `opensandbox-controller` chart is now version `0.2.1` while retaining `appVersion: \"0.2.0\"`; the umbrella dependency is `0.2.1`, and `Chart.lock` was regenerated. I also restored independent chart/app version handling in the publish workflow so a `helm/opensandbox-controller/0.2.1` tag preserves the committed controller app version instead of rewriting it to a nonexistent image version.\n\nVerified with `make helm-lint`, `helm dependency list charts/opensandbox`, standalone and umbrella render assertions (both default to `controller:v0.2.0` and omit `--containerd-socket-path`; an explicit socket override still renders the flag), workflow YAML parsing, and the docs build. All checks on the current head are green.\nNo additional compatibility note is needed because there are no legacy `opensandbox-server` Helm releases or tags to preserve. I checked the complete GitHub release list (`gh release list --limit 500`) and the remote tag namespace (`refs/tags/helm/opensandbox-server/*`); both contain zero matches. The only four historical `helm/*` releases are controller/umbrella `0.1.0` and `0.2.0`, and their tag, chart, and app versions are equal.\n\nTherefore this documentation describes the first future `opensandbox-server` chart release under the corrected chart-version URL convention; it cannot turn any previously published server URL into a 404. Adding a cutoff or migration path would document artifacts that never existed.\n@codex /review\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Report the server version that the chart actually deploys**\n\nWhen a tag-triggered `opensandbox-server` release runs, this reads `0.1.0` from `Chart.yaml`, while `kubernetes/charts/opensandbox-server/values.yaml:28` pins the default server image to `v0.2.2`. The updated deployment guide tells users to copy this advertised app version and explicitly pass it as `server.image.tag`, so following the release instructions deploys the wrong server version; align `appVersion` with the pinned image or derive the reported version from the chart's effective image tag.\n\nAGENTS.md reference: [AGENTS.md:L42-L46](https://github.com/opensandbox-group/OpenSandbox/blob/4bb7ec373006949ae1ae59bb9309028e2371a341/AGENTS.md#L42-L46)\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `4bb7ec3730`\n \n\n

ℹ️ About Codex in GitHub

\nFixed on the current head (`d6dc9097e7e79f9403f7bc77bcaa76850588f972`) by updating `kubernetes/charts/opensandbox-server/Chart.yaml` to `appVersion: \"0.2.2\"`, matching the chart's effective default `server.image.tag: \"v0.2.2\"`. This is a one-time metadata backfill: `scripts/bump-server-chart.sh` already updates both the pinned image tag and `appVersion` for future server releases.\n\nVerified that `helm show chart` reports app version `0.2.2` for both the standalone chart and the packaged umbrella dependency, and that both rendered deployments use `opensandbox/server:v0.2.2` with `app.kubernetes.io/version: \"0.2.2\"`. `make helm-lint`, workflow YAML parsing, and the full docs build also pass.",{},"created",1787058340.958191,"Completing the task","event_type","info",{"_95":408,"_99":96,"_400":1576},{"_95":779,"_780":781},"partial_repo_snapshot","files",[782,783,784,785,786,787,788,789],{"_168":1556,"_791":-5,"_792":1557,"_794":-5},{"_168":1531,"_791":-5,"_792":1532,"_794":-5},{"_168":1392,"_791":-5,"_792":1393,"_794":-5},{"_168":1261,"_791":-5,"_792":1262,"_794":-5},{"_168":1218,"_791":-5,"_792":1219,"_794":-5},{"_168":1078,"_791":-5,"_792":1079,"_794":-5},{"_168":920,"_791":-5,"_792":921,"_794":-5},{"_168":790,"_791":-5,"_792":793,"_794":-5},"docs/kubernetes/deployment.md","contents","line_range_contents",[795],"missing_reason",{"_796":797,"_798":799,"_400":800,"_801":62},"line_range_start",1,"line_range_end",195,[802,803,804,802,207,805,207,806,207,807,207,808,809,810,207,811,207,812,207,813,207,814,207,815,207,816,207,817,818,819,820,821,207,822,823,824,207,825,207,826,207,827,828,829,207,830,831,832,833,834,835,821,207,836,207,837,838,839,840,841,842,843,844,845,846,821,207,847,207,848,207,849,207,850,207,817,851,821,207,852,207,817,853,832,854,855,821,207,856,207,817,857,832,858,207,859,832,860,821,207,861,207,817,862,821,207,863,207,864,865,866,867,868,869,870,871,872,207,873,207,874,207,875,207,817,876,832,854,855,821,207,877,207,878,207,879,207,880,207,881,882,883,884,885,207,837,886,887,888,889,890,821,207,891,892,893,894,207,895,207,896,207,897,207,827,898,821,207,899,207,900,901,902,903,904,905,207,906,207,907,207,908,909,910,911,912,913,914,207,915,207,916,917,918,919],"contains_end_of_file","---","title: Kubernetes Deployment","description: Deploy OpenSandbox components on Kubernetes with Helm charts.","# Kubernetes Deployment","This guide covers deploying OpenSandbox on Kubernetes, including the operator, CRDs, and supporting components.","## Prerequisites","- Kubernetes 1.21.1+","- Helm 3.x","- `kubectl` configured for your cluster","## Install CRDs and Operator","The OpenSandbox Kubernetes operator manages `BatchSandbox`, `Pool`, and `SandboxSnapshot` custom resources.","For installation instructions and Helm chart values, see the [Kubernetes operator documentation](https://github.com/opensandbox-group/OpenSandbox/tree/main/kubernetes).","## Install the Lifecycle Server","Install the controller and CRDs before the lifecycle server. The server runs in the cluster with a `ServiceAccount` and uses the Kubernetes API to create and manage sandbox resources.","Choose a published `opensandbox-server` chart from [GitHub Releases](https://github.com/opensandbox-group/OpenSandbox/releases?q=helm%2Fopensandbox-server&expanded=true), then set both versions from that release:","```sh","CHART_VERSION=\"\"","APP_VERSION=\"\"","CHART_URL=\"https://github.com/opensandbox-group/OpenSandbox/releases/download/helm/opensandbox-server/${CHART_VERSION}/opensandbox-server-${CHART_VERSION}.tgz\"","```","::: info Versioning","The release tag and `.tgz` filename identify the Helm chart version. The server application version is independent and is listed on each GitHub Release.",":::","### Configure API authentication","By default, the server refuses to start without an API key in a non-interactive container. Create both the control-plane namespace and the default sandbox workload namespace, then store the key in a Kubernetes `Secret`:","```bash","kubectl create namespace opensandbox-system --dry-run=client -o yaml | kubectl apply -f -","kubectl create namespace opensandbox --dry-run=client -o yaml | kubectl apply -f -","read -s OPENSANDBOX_API_KEY","kubectl create secret generic opensandbox-api-key \\"," --namespace opensandbox-system \\"," --from-literal=api-key=\"${OPENSANDBOX_API_KEY}\" \\"," --dry-run=client -o yaml | kubectl apply -f -","unset OPENSANDBOX_API_KEY","Reference the Secret from a values file:","```yaml","# values-server.yaml","server:"," replicaCount: 2"," env:"," - name: OPENSANDBOX_SERVER_API_KEY"," valueFrom:"," secretKeyRef:"," name: opensandbox-api-key"," key: api-key","Use an external secret manager instead of creating the Secret manually in production environments.","The chart installs the server into `opensandbox-system`, while the default `configToml` creates sandbox and pool resources in `opensandbox`. If you change `[kubernetes].namespace` in `configToml`, create that namespace instead of `opensandbox` before submitting workloads.","### Install and verify","Inspect all available settings before installation:","helm show values \"${CHART_URL}\"","Install the server from the versioned chart artifact:","helm install opensandbox-server \"${CHART_URL}\" \\"," --set-string server.image.tag=\"${APP_VERSION}\" \\"," --values values-server.yaml","Wait for the Deployment and verify the API health endpoint:","kubectl rollout status deployment/opensandbox-server \\"," --timeout=180s","kubectl port-forward \\"," service/opensandbox-server 8080:80","In another terminal:","curl --fail http://127.0.0.1:8080/health","### Important values","| Value | Purpose | Notes |","|-------|---------|-------|","| `server.image.repository` | Server image registry and repository | Override for a private mirror or custom build. |","| `server.image.tag` | Server image version | The release install command pins it to `APP_VERSION`. |","| `server.replicaCount` | Number of server Pods | Defaults to `2`. |","| `server.env` | Additional container environment variables | Use it with `secretKeyRef` for `OPENSANDBOX_SERVER_API_KEY`. |","| `configToml` | Complete server configuration | Mounted at `/etc/opensandbox/config.toml`; overriding it replaces the complete default TOML, including the workload namespace. |","| `server.gateway.enabled` | Deploy the ingress gateway with the server | Defaults to `false`. |","| `namespaceOverride` | Namespace used by chart resources | Defaults to `opensandbox-system`. |","The server container and its `ClusterIP` Service use port `80`. Keep `[server].port = 80` when replacing `configToml` unless the chart templates are also updated to use a different port.","### Upgrade","Select the application and chart versions from the target GitHub Release, update `CHART_URL`, and run:","helm upgrade opensandbox-server \"${CHART_URL}\" \\","For the complete values reference and local development installation, see the [`opensandbox-server` chart README](https://github.com/opensandbox-group/OpenSandbox/tree/main/kubernetes/charts/opensandbox-server).","## Operator Metrics","The operator (controller-manager) exposes standard [controller-runtime](https://book.kubebuilder.io/reference/metrics) Prometheus metrics — reconcile rate and latency (`controller_runtime_reconcile_*`), work-queue depth, client-go request counts, and Go runtime stats. The endpoint is **disabled by default** (`--metrics-bind-address=0`).","Enable it through the `opensandbox-controller` chart values:","| Value | Default | Purpose |","|-------|---------|---------|","| `controller.metrics.enabled` | `false` | Expose the `/metrics` endpoint (sets `--metrics-bind-address`) |","| `controller.metrics.port` | `8080` | Port for the metrics endpoint |","| `controller.metrics.secure` | `false` | Serve over HTTPS with authn/authz (`--metrics-secure`); set `false` for plain HTTP scraping |","controller:"," metrics:"," enabled: true"," port: 8080"," secure: false # plain HTTP, e.g. for a PodMonitoring/ServiceMonitor scrape","- With `secure: false` the endpoint is plain HTTP and can be scraped directly (no TLS or bearer token).","- With `secure: true` the controller-runtime filter authenticates and authorizes each scrape via `TokenReview`/`SubjectAccessReview`. The chart then provisions two `ClusterRole`s automatically:"," - `opensandbox-metrics-auth-role` (bound to the manager) — lets the controller run the auth checks."," - `opensandbox-metrics-reader` (**not** bound by the chart) — grants `get` on the `/metrics` non-resource URL. Bind it to your scraper's `ServiceAccount` (e.g. Prometheus) and have the scraper present that account's bearer token.","Point your Prometheus stack at the `metrics` container port (for example via a `ServiceMonitor` or `PodMonitoring`).","## Configure the Server for Kubernetes","Generate a Kubernetes-oriented server config:","opensandbox-server init-config ~/.sandbox.toml --example k8s","Key Kubernetes-specific configuration sections:","| Section | Purpose |","|---------|---------|","| `[kubernetes]` | Workload provider, BatchSandbox template file |","| `[agent_sandbox]` | Agent sandbox settings |","| `[ingress]` | Ingress gateway for sandbox traffic routing |","| `[secure_runtime]` | Secure container runtime (gVisor, Kata) |","See [Configuration](/getting-started/configuration) for the full reference.","## Components on Kubernetes","| Component | Deployment | Purpose |","|-----------|-----------|---------|","| Server | Deployment | Lifecycle control plane |","| Operator | Deployment | Manages BatchSandbox/Pool CRDs |","| Ingress | DaemonSet/Deployment | Routes traffic to sandboxes |","| Egress | Sidecar | Per-sandbox egress policy enforcement |","| Execd | Built into sandbox images | In-sandbox execution |","## Related","- [Kubernetes Overview](/kubernetes/) — Operator features and CRDs","- [Pause & Resume](/guides/pause-resume) — Snapshot-based pause/resume on Kubernetes","- [Secure Container](/guides/secure-container) — gVisor and Kata on Kubernetes","- [Network Isolation](/architecture/network-isolation) — Egress policy design for Kubernetes",".github/workflows/publish-helm-chart.yml",[922],{"_796":797,"_798":923,"_400":924,"_801":62},225,[925,207,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,931,941,942,943,931,941,944,945,946,207,947,948,949,207,950,951,952,953,954,955,956,957,958,959,960,961,962,207,963,964,965,966,207,967,968,961,969,207,970,971,964,972,973,974,975,976,977,975,978,979,975,980,981,982,983,984,985,986,987,988,207,989,990,991,964,992,993,994,207,995,996,988,207,995,997,998,988,207,999,1000,998,988,207,1001,207,1002,1003,964,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,983,1014,998,988,1005,1015,207,1016,1017,964,1018,1019,1020,207,1021,1022,998,988,207,1023,1024,207,1025,1026,964,1027,1018,1005,1028,1029,1005,1030,1031,207,1032,1033,964,1018,1034,1035,1036,207,1037,1038,964,1018,1039,1040,207,1041,964,1018,1042,207,1043,964,1018,1044,207,1045,1046,961,1047,207,1048,1049,961,1050,1051,1052,1053,975,1054,1055,975,1056,975,1057,975,1058,1059,1060,1061,1062,1063,975,1064,975,1058,1065,1066,975,1067,1068,1061,1062,1063,975,1069,975,1070,975,1071,1072,1073,1074,1075,1076,990,1077],"name: Publish Helm Chart","on:"," workflow_dispatch:"," inputs:"," component:"," description: 'Component to release'"," required: true"," type: choice"," options:"," - opensandbox-controller"," - opensandbox-server"," - opensandbox"," - opensandbox-node-agent"," default: 'opensandbox-controller'"," chart_version:"," description: 'Chart version to release (without v prefix, e.g., 0.1.0)'"," default: '0.1.0'"," app_version:"," description: 'App version (without v prefix, e.g., 0.1.0)'"," push:"," tags:"," - 'helm/**' # Format: helm//, e.g., helm/opensandbox-controller/0.1.0","jobs:"," release-preflight:"," uses: ./.github/workflows/release-preflight.yml"," publish:"," needs: release-preflight"," runs-on: ubuntu-latest"," permissions:"," contents: write"," id-token: write"," attestations: write"," artifact-metadata: write"," steps:"," - name: Checkout code"," uses: actions/checkout@v4"," with:"," fetch-depth: 0"," - name: Configure Git"," run: |"," git config user.name \"$GITHUB_ACTOR\""," git config user.email \"$GITHUB_ACTOR@users.noreply.github.com\""," - name: Install Helm"," uses: azure/setup-helm@v4"," version: 'latest'"," - name: Parse tag and set variables"," id: parse_tag"," if [[ \"${{ github.ref }}\" == refs/tags/helm/* ]]; then"," TAG_PATH=\"${{ github.ref }}\""," TAG_PATH=\"${TAG_PATH#refs/tags/}\""," "," COMPONENT=$(echo \"$TAG_PATH\" | cut -d'/' -f2)"," VERSION=$(echo \"$TAG_PATH\" | cut -d'/' -f3)"," # Remove 'v' prefix if present"," VERSION=${VERSION#v}"," echo \"component=$COMPONENT\" >> $GITHUB_OUTPUT"," echo \"chart_version=$VERSION\" >> $GITHUB_OUTPUT"," echo \"release_tag=$TAG_PATH\" >> $GITHUB_OUTPUT"," else"," echo \"component=${{ inputs.component }}\" >> $GITHUB_OUTPUT"," echo \"chart_version=${{ inputs.chart_version }}\" >> $GITHUB_OUTPUT"," echo \"app_version=${{ inputs.app_version }}\" >> $GITHUB_OUTPUT"," echo \"release_tag=helm/${{ inputs.component }}/${{ inputs.chart_version }}\" >> $GITHUB_OUTPUT"," fi"," - name: Verify release tag on origin"," env:"," RELEASE_TAG: ${{ steps.parse_tag.outputs.release_tag }}"," set -euo pipefail"," local_commit=\"$(git rev-parse 'HEAD^{commit}')\""," remote_commit=\"$(git ls-remote origin \"refs/tags/${RELEASE_TAG}^{}\" | awk 'NR == 1 { print $1 }')\""," if [[ -z \"$remote_commit\" ]]; then"," remote_commit=\"$(git ls-remote origin \"refs/tags/${RELEASE_TAG}\" | awk 'NR == 1 { print $1 }')\""," echo \"::error::Release tag '${RELEASE_TAG}' does not exist on origin. Have an authorized release manager push the protected tag before publishing the Helm chart.\""," exit 1"," if [[ \"$local_commit\" != \"$remote_commit\" ]]; then"," echo \"::error::Current commit is ${local_commit}, but origin tag '${RELEASE_TAG}' resolves to ${remote_commit}. Refusing to publish the Helm chart.\""," echo \"Verified release tag '${RELEASE_TAG}' at ${remote_commit}.\""," - name: Set chart path"," id: chart_path"," COMPONENT=\"${{ steps.parse_tag.outputs.component }}\""," "," if [ \"$COMPONENT\" == \"opensandbox-controller\" ]; then"," CHART_PATH=\"kubernetes/charts/opensandbox-controller\""," elif [ \"$COMPONENT\" == \"opensandbox-server\" ]; then"," CHART_PATH=\"kubernetes/charts/opensandbox-server\""," elif [ \"$COMPONENT\" == \"opensandbox\" ]; then"," CHART_PATH=\"kubernetes/charts/opensandbox\""," elif [ \"$COMPONENT\" == \"opensandbox-node-agent\" ]; then"," CHART_PATH=\"kubernetes/charts/opensandbox-node-agent\""," echo \"Error: Unknown component: $COMPONENT\""," echo \"path=$CHART_PATH\" >> $GITHUB_OUTPUT"," - name: Get chart version from Chart.yaml"," id: chart_version"," CHART_PATH=\"${{ steps.chart_path.outputs.path }}\""," CHART_VERSION=$(grep '^version:' $CHART_PATH/Chart.yaml | awk '{print $2}')"," EXPECTED_CHART_VERSION=\"${{ steps.parse_tag.outputs.chart_version }}\""," if [ \"$CHART_VERSION\" != \"$EXPECTED_CHART_VERSION\" ]; then"," echo \"::error::Chart.yaml version '$CHART_VERSION' does not match requested chart version '$EXPECTED_CHART_VERSION'.\""," echo \"version=$CHART_VERSION\" >> $GITHUB_OUTPUT"," echo \"Verified chart version: $CHART_VERSION\""," - name: Update Chart.yaml with app version for manual release"," if: ${{ github.event_name == 'workflow_dispatch' }}"," APP_VERSION=\"${{ steps.parse_tag.outputs.app_version }}\""," # Only update appVersion, keep chart version as-is in Chart.yaml"," sed -i \"s/^appVersion:.*/appVersion: \\\"$APP_VERSION\\\"/\" $CHART_PATH/Chart.yaml"," echo \"Updated Chart.yaml:\""," cat $CHART_PATH/Chart.yaml"," - name: Get app version from Chart.yaml"," id: app_version"," APP_VERSION=$(grep '^appVersion:' $CHART_PATH/Chart.yaml | awk '{print $2}' | tr -d '\"')"," echo \"version=$APP_VERSION\" >> $GITHUB_OUTPUT"," echo \"App version: $APP_VERSION\""," - name: Build dependencies (for opensandbox all-in-one chart)"," if: ${{ steps.parse_tag.outputs.component == 'opensandbox' }}"," echo \"Building dependencies for all-in-one chart...\""," helm dependency build $CHART_PATH"," - name: Lint Helm chart"," helm lint $CHART_PATH"," - name: Package Helm chart"," helm package $CHART_PATH"," - name: Attest packaged Helm chart"," uses: actions/attest@v4"," subject-path: ${{ steps.parse_tag.outputs.component }}-*.tgz"," - name: Create GitHub Release"," uses: softprops/action-gh-release@v2"," tag_name: ${{ steps.parse_tag.outputs.release_tag }}"," name: Helm Chart ${{ steps.parse_tag.outputs.component }} ${{ steps.chart_version.outputs.version }} (App v${{ steps.app_version.outputs.version }})"," body: |"," ## ${{ steps.parse_tag.outputs.component }} Helm Chart"," **Chart Version:** ${{ steps.chart_version.outputs.version }}"," **App Version:** ${{ steps.app_version.outputs.version }}"," ### Installation"," 直接从 GitHub Release 安装:"," ```bash"," helm install ${{ steps.parse_tag.outputs.component }} \\"," https://github.com/${{ github.repository }}/releases/download/${{ steps.parse_tag.outputs.release_tag }}/${{ steps.parse_tag.outputs.component }}-${{ steps.chart_version.outputs.version }}.tgz \\"," --namespace opensandbox-system \\"," --create-namespace"," ```"," 或者先下载后安装:"," # 下载"," wget https://github.com/${{ github.repository }}/releases/download/${{ steps.parse_tag.outputs.release_tag }}/${{ steps.parse_tag.outputs.component }}-${{ steps.chart_version.outputs.version }}.tgz"," # 安装"," helm install ${{ steps.parse_tag.outputs.component }} ./${{ steps.parse_tag.outputs.component }}-${{ steps.chart_version.outputs.version }}.tgz \\"," ${{ steps.parse_tag.outputs.component == 'opensandbox' && '**Note**: This is an all-in-one chart that bundles controller and server. The packaged chart already includes all dependencies, no need to run `helm dependency build` when installing from release.' || '' }}"," ### What's Changed"," - Chart version: ${{ steps.chart_version.outputs.version }}"," - App version: ${{ steps.app_version.outputs.version }}"," files: |"," ${{ steps.parse_tag.outputs.component }}-*.tgz"," draft: false"," prerelease: false"," GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}","kubernetes/charts/opensandbox-server/values.yaml",[1080],{"_796":797,"_798":1081,"_400":1082,"_801":62},150,[1083,1084,207,1085,1086,1087,1088,207,1089,1090,207,1091,1092,207,1093,839,1094,1095,1096,1097,1098,1099,1100,207,1101,1102,1103,1104,207,1105,840,207,1106,1107,1108,1109,1110,1111,1112,1113,207,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,207,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,1150,1151,1152,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,207,1194,1195,1196,1197,1198,1199,207,1200,1201,207,1202,1203,1204,207,1205,1206,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217],"# Copyright 2026 Alibaba Group Holding Ltd.","# Default values for opensandbox-server.","# -- Override the name of the chart","nameOverride: \"\"","# -- Resource names and app.kubernetes.io/name are fixed to this value, independent of release name","fullnameOverride: \"opensandbox-server\"","# -- Override the namespace (default: opensandbox-system)","namespaceOverride: \"\"","# -- Image pull secrets for the server deployment. Each entry: {name: }.","imagePullSecrets: []","# Server configuration"," # -- Additional environment variables for the server container."," env: []"," # - name: OPENSANDBOX_SERVER_API_KEY"," # valueFrom:"," # secretKeyRef:"," # name: opensandbox-api-key"," # key: api-key"," # -- Server image configuration"," image:"," repository: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server"," tag: \"v0.2.2\""," # -- Number of server replicas"," # -- Resource requests and limits"," resources:"," limits:"," cpu: \"2\""," memory: 8Gi"," requests:"," cpu: \"1\""," memory: 4Gi"," tolerations: []"," affinity: {}"," volumeMounts: []"," volumes: []"," # -- Node selector for the server pod."," nodeSelector: {}"," # -- Pod-level security context for the server pod."," podSecurityContext: {}"," # -- Container-level security context for the server container."," containerSecurityContext: {}"," # -- Extra annotations for the server pod."," podAnnotations: {}"," # -- Extra labels for the server pod."," podLabels: {}"," # -- Priority class name for the server pod."," priorityClassName: \"\""," # -- Topology spread constraints for the server pod."," topologySpreadConstraints: []"," # Gateway (components/ingress): when enabled, writes config [ingress] and deploys the gateway"," gateway:"," enabled: false"," host: opensandbox.example.com"," gatewayRouteMode: \"header\""," image:"," repository: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/ingress"," tag: \"v1.0.10\""," replicaCount: 2"," port: 28888"," dataplaneNamespace: \"opensandbox\""," providerType: \"batchsandbox\""," logLevel: \"info\""," # -- Additional environment variables for the ingress-gateway container"," # (e.g. OTEL_EXPORTER_OTLP_ENDPOINT / OTEL_SERVICE_NAME for OTLP metrics)."," env: []"," resources:"," limits:"," cpu: \"2\""," memory: 8Gi"," requests:"," cpu: \"1\""," memory: 4Gi"," # OSEP-0011 signing keys shared between server and ingress."," # When keys are provided, the server signs route tokens with the active key"," # and the ingress gateway verifies them."," secureAccess:"," activeKey: \"\""," # List of signing keys. Each entry: { key_id: \"a\", key: \"\" }."," # key_id must be exactly one character in [0-9a-z]."," keys: []"," # -- Name of an existing Secret holding the signing keys, as an"," # alternative to plaintext `keys` above (mutually exclusive). The Secret"," # must carry two entries:"," # keys: the key ring, \"a=[,b=...]\""," # active-key: the active signing key id, one character in [0-9a-z]"," # The chart wires it into both containers as environment variables"," # (server: OPENSANDBOX_SECURE_ACCESS_*; gateway: $(...) expansion in the"," # --secure-access-keys arg), so key material never appears in values,"," # the server ConfigMap, or pod args."," # Env-sourced Secrets are read once at container start: after updating"," # the Secret in place, `kubectl rollout restart` the server and gateway"," # Deployments (or version the Secret name to get a spec-driven rollout)."," existingSecret: \"\""," # -- Node selector for the ingress gateway pod."," nodeSelector: {}"," # -- Pod-level security context for the ingress gateway pod."," podSecurityContext: {}"," # -- Container-level security context for the ingress gateway container."," containerSecurityContext: {}"," # -- Extra annotations for the ingress gateway pod."," podAnnotations: {}"," # -- Extra labels for the ingress gateway pod."," podLabels: {}"," # -- Priority class name for the ingress gateway pod."," priorityClassName: \"\""," # -- Topology spread constraints for the ingress gateway pod."," topologySpreadConstraints: []"," # -- Tolerations for the ingress gateway pod."," tolerations: []"," # -- Affinity for the ingress gateway pod."," affinity: {}","# -- Server config (TOML). Mounted at /etc/opensandbox/config.toml.","configToml: |"," [server]"," host = \"0.0.0.0\""," port = 80"," api_key = \"\""," [log]"," level = \"INFO\""," [runtime]"," type = \"kubernetes\""," execd_image = \"sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22\""," [kubernetes]"," kubeconfig_path = \"\""," namespace = \"opensandbox\""," informer_enabled = true"," informer_resync_seconds = 300"," informer_watch_timeout_seconds = 60"," snapshot_create_timeout_seconds = 900"," workload_provider = \"batchsandbox\""," batchsandbox_template_file = \"/etc/opensandbox/example.batchsandbox-template.yaml\""," "," [egress]"," image = \"sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.6\""," mode = \"dns+nft\"","kubernetes/charts/opensandbox-server/Chart.yaml",[1220],{"_796":797,"_798":1221,"_400":1222,"_801":62},47,[1083,1223,1224,1225,1226,1223,1227,1223,1228,1229,1230,1231,1232,207,1233,1234,1235,1236,1237,1238,1239,207,1240,1241,1242,1243,1244,1245,1246,1247,207,1248,1249,1250,1251,207,1252,1253,1254,207,1255,1256,207,1257,1258,1259,1260],"#","# Licensed under the Apache License, Version 2.0 (the \"License\");","# you may not use this file except in compliance with the License.","# You may obtain a copy of the License at","# http://www.apache.org/licenses/LICENSE-2.0","# Unless required by applicable law or agreed to in writing, software","# distributed under the License is distributed on an \"AS IS\" BASIS,","# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.","# See the License for the specific language governing permissions and","# limitations under the License.","apiVersion: v2","name: opensandbox-server","description: OpenSandbox Lifecycle API server for sandbox creation and management","type: application","version: 0.1.0","appVersion: \"0.2.2\"","# execd bootstrap.sh installed to /opt/opensandbox (flattened from /opt/opensandbox/bin)","keywords:"," - sandbox"," - kubernetes"," - api"," - lifecycle"," - batchsandbox"," - ingress"," - gateway","home: https://github.com/opensandbox-group/OpenSandbox","sources:"," - https://github.com/opensandbox-group/OpenSandbox/tree/main/server"," - https://github.com/opensandbox-group/OpenSandbox/tree/main/components/ingress","maintainers:"," - name: OpenSandbox Team"," email: opensandbox@example.com","# Kubernetes version constraints","kubeVersion: \">=1.21.1-0\"","annotations:"," artifacthub.io/category: integration-delivery"," artifacthub.io/license: Apache-2.0"," artifacthub.io/prerelease: \"false\"","kubernetes/charts/opensandbox-controller/templates/deployment.yaml",[1263],{"_796":797,"_798":1264,"_400":1265,"_801":62},174,[1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1283,1284,1285,1286,1287,1288,1286,1289,1290,1291,1288,1286,1292,1293,1294,1288,1295,1296,1297,1298,1288,1295,1299,1300,1295,1301,1302,1288,1295,1303,1304,1305,1306,1307,1308,1309,1310,1311,1286,1312,1313,1314,1315,1316,1286,1317,1318,1286,1319,1320,1286,1321,1322,1286,1284,1323,1286,1324,1325,1286,1326,1327,1286,1328,1329,1286,1330,1331,1286,1332,1333,1286,1334,1335,1286,1336,1337,1286,1338,1339,1340,1341,1314,1342,1343,1341,1286,1344,1345,1346,1286,1347,1348,1349,1350,1351,1352,1353,1354,1355,1356,1286,1357,1358,1349,1359,1360,1361,1362,1363,1364,1365,1286,1366,1367,1368,990,1369,1286,1370,1371,1284,1372,1373,1374,1286,1375,1288,1286,1286,1376,1377,1295,1378,1379,1380,1381,1382,1383,1295,1384,1377,1295,1295,1385,1386,1288,1295,1387,1388,1288,1295,1389,1390,1288,1295,1391],"{{- $metrics := .Values.controller.metrics | default dict -}}","apiVersion: apps/v1","kind: Deployment","metadata:"," name: opensandbox-controller-manager"," namespace: {{ include \"opensandbox.namespace\" . }}"," labels:"," {{- include \"opensandbox.labels\" . | nindent 4 }}"," app.kubernetes.io/component: controller-manager","spec:"," replicas: {{ .Values.controller.replicaCount }}"," selector:"," matchLabels:"," {{- include \"opensandbox.selectorLabels\" . | nindent 6 }}"," template:"," metadata:"," annotations:"," kubectl.kubernetes.io/default-container: manager"," {{- if .Values.controller.snapshot.imageCommitterPodTemplate }}"," checksum/image-committer-pod-template: {{ include (print $.Template.BasePath \"/image-committer-pod-template.yaml\") . | sha256sum }}"," {{- end }}"," {{- with .Values.controller.podAnnotations }}"," {{- toYaml . | nindent 8 }}"," labels:"," {{- include \"opensandbox.selectorLabels\" . | nindent 8 }}"," {{- with .Values.controller.podLabels }}"," spec:"," {{- with .Values.imagePullSecrets }}"," imagePullSecrets:"," {{- end }}"," serviceAccountName: {{ include \"opensandbox.serviceAccountName\" . }}"," {{- with .Values.controller.podSecurityContext }}"," securityContext:"," {{- with .Values.controller.priorityClassName }}"," priorityClassName: {{ . }}"," {{- with .Values.extraInitContainers }}"," initContainers:"," containers:"," - name: manager"," image: {{ include \"opensandbox.controllerImage\" . }}"," imagePullPolicy: {{ include \"opensandbox.imagePullPolicy\" . }}"," command:"," - /workspace/server"," args:"," {{- if .Values.controller.leaderElection.enabled }}"," - --leader-elect"," - --health-probe-bind-address=:8081"," - --zap-log-level={{ .Values.controller.logLevel }}"," {{- if $metrics.enabled }}"," - --metrics-bind-address=:{{ $metrics.port | default 8080 }}"," - --metrics-secure={{ $metrics.secure | default false }}"," {{- if and .Values.controller.kubeClient (gt (int .Values.controller.kubeClient.qps) 0) }}"," - --kube-client-qps={{ .Values.controller.kubeClient.qps }}"," {{- if and .Values.controller.kubeClient (gt (int .Values.controller.kubeClient.burst) 0) }}"," - --kube-client-burst={{ .Values.controller.kubeClient.burst }}"," {{- if .Values.controller.snapshot.imageCommitterImage }}"," - --image-committer-image={{ .Values.controller.snapshot.imageCommitterImage }}"," - --image-committer-pod-template-file=/etc/opensandbox/image-committer/pod-template.yaml"," {{- if .Values.controller.snapshot.containerdSocketPath }}"," - --containerd-socket-path={{ .Values.controller.snapshot.containerdSocketPath }}"," {{- if .Values.controller.snapshot.commitJobTimeout }}"," - --commit-job-timeout={{ .Values.controller.snapshot.commitJobTimeout }}"," {{- if .Values.controller.snapshot.registry }}"," - --snapshot-registry={{ .Values.controller.snapshot.registry }}"," {{- if .Values.controller.snapshot.registryInsecure }}"," - --snapshot-registry-insecure={{ .Values.controller.snapshot.registryInsecure }}"," {{- if .Values.controller.snapshot.snapshotPushSecret }}"," - --snapshot-push-secret={{ .Values.controller.snapshot.snapshotPushSecret }}"," {{- if .Values.controller.snapshot.imageCommitterPullSecret }}"," - --image-committer-pull-secret={{ .Values.controller.snapshot.imageCommitterPullSecret }}"," {{- if .Values.controller.snapshot.resumePullSecret }}"," - --resume-pull-secret={{ .Values.controller.snapshot.resumePullSecret }}"," ports:"," - name: health"," containerPort: 8081"," protocol: TCP"," - name: metrics"," containerPort: {{ $metrics.port | default 8080 }}"," {{- with .Values.controller.containerSecurityContext }}"," securityContext:"," {{- toYaml . | nindent 10 }}"," {{- if .Values.controller.livenessProbe.enabled }}"," livenessProbe:"," httpGet:"," path: {{ .Values.controller.livenessProbe.httpGet.path }}"," port: {{ .Values.controller.livenessProbe.httpGet.port }}"," initialDelaySeconds: {{ .Values.controller.livenessProbe.initialDelaySeconds }}"," periodSeconds: {{ .Values.controller.livenessProbe.periodSeconds }}"," timeoutSeconds: {{ .Values.controller.livenessProbe.timeoutSeconds }}"," successThreshold: {{ .Values.controller.livenessProbe.successThreshold }}"," failureThreshold: {{ .Values.controller.livenessProbe.failureThreshold }}"," {{- if .Values.controller.readinessProbe.enabled }}"," readinessProbe:"," path: {{ .Values.controller.readinessProbe.httpGet.path }}"," port: {{ .Values.controller.readinessProbe.httpGet.port }}"," initialDelaySeconds: {{ .Values.controller.readinessProbe.initialDelaySeconds }}"," periodSeconds: {{ .Values.controller.readinessProbe.periodSeconds }}"," timeoutSeconds: {{ .Values.controller.readinessProbe.timeoutSeconds }}"," successThreshold: {{ .Values.controller.readinessProbe.successThreshold }}"," failureThreshold: {{ .Values.controller.readinessProbe.failureThreshold }}"," resources:"," {{- toYaml .Values.controller.resources | nindent 10 }}"," {{- if .Values.extraEnv }}"," {{- toYaml .Values.extraEnv | nindent 8 }}"," {{- if or .Values.controller.snapshot.imageCommitterPodTemplate .Values.extraVolumeMounts }}"," volumeMounts:"," - name: image-committer-pod-template"," mountPath: /etc/opensandbox/image-committer"," readOnly: true"," {{- with .Values.extraVolumeMounts }}"," {{- with .Values.extraContainers }}"," {{- toYaml . | nindent 6 }}"," {{- if or .Values.controller.snapshot.imageCommitterPodTemplate .Values.extraVolumes }}"," volumes:"," {{- if .Values.controller.snapshot.imageCommitterPodTemplate }}"," - name: image-committer-pod-template"," configMap:"," name: {{ include \"opensandbox.imageCommitterPodTemplateName\" . }}"," {{- with .Values.extraVolumes }}"," {{- with .Values.controller.nodeSelector }}"," nodeSelector:"," {{- with .Values.controller.affinity }}"," affinity:"," {{- with .Values.controller.tolerations }}"," tolerations:"," terminationGracePeriodSeconds: 10","kubernetes/charts/opensandbox-controller/values.yaml",[1394],{"_796":797,"_798":799,"_400":1395,"_801":62},[1396,1397,1398,207,1085,1086,1399,1400,207,1401,1402,1090,207,1403,886,1404,1102,1405,1406,1407,1408,1409,1410,1214,1411,1412,1214,1413,1107,1108,1414,1415,1111,1416,1417,1214,1418,1419,207,1420,1421,887,1422,1134,1423,889,1424,1425,1426,207,1427,1428,1429,1430,1431,1432,207,1433,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1445,1446,1447,1448,1449,1450,1451,1452,1453,1454,207,1455,1456,888,1214,1457,1458,888,1459,1460,1461,1462,1463,1464,1465,1466,1214,1467,1468,888,1459,1469,1461,1470,1471,1464,1465,1466,1214,1472,1119,1214,1473,1114,1214,1474,1115,1214,1475,1476,1477,1478,1479,1214,1480,1481,1482,1483,1484,1485,1486,1214,1487,1127,1214,1488,1125,1214,1489,1129,207,1490,1092,1491,207,1492,1493,1494,1495,1496,1497,1498,1499,1500,207,1501,1502,1503,1495,207,1504,1505,1506,1507,1508,1509,1510,1497,207,207,1511,1512,1513,1514,207,1515,1516,1517,1518,207,1519,1520,1517,1521,207,1522,1523,207,1524,1525,207,1526,1527,1528,1529,1530],"# Default values for opensandbox-controller.","# This is a YAML-formatted file.","# Declare variables to be passed into your templates.","# -- Override the full name of the chart","fullnameOverride: \"\"","# -- Override the namespace where resources will be created","# If not set, defaults to \"opensandbox-system\"","# Controller configuration"," # -- Controller image configuration"," # -- Controller image repository"," repository: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/controller"," # -- Image pull policy"," pullPolicy: IfNotPresent"," # -- Overrides the image tag whose default is the chart appVersion"," tag: \"\""," # -- Number of controller replicas"," replicaCount: 1"," # -- Resource requests and limits for the controller"," cpu: 500m"," memory: 128Mi"," cpu: 10m"," memory: 64Mi"," # -- Log level for zap logger (debug, info, error)"," logLevel: info"," # -- controller-runtime metrics endpoint (Prometheus). Disabled by default to"," # preserve the current behavior (the binary defaults to --metrics-bind-address=0)."," # -- Expose the controller-runtime /metrics endpoint (sets --metrics-bind-address)"," # -- Port for the metrics endpoint"," # -- Serve metrics over HTTPS with authn/authz (--metrics-secure). Set to false"," # to serve plain HTTP for scraping without TLS/RBAC (e.g. PodMonitoring)."," secure: false"," # -- Kubernetes client rate limiter configuration"," kubeClient:"," # -- QPS for Kubernetes client rate limiter."," qps: 100"," # -- Burst for Kubernetes client rate limiter."," burst: 200"," # -- Pause/Resume snapshot configuration"," snapshot:"," # -- Image used for commit operations"," # DockerHub: opensandbox/image-committer:v0.1.1"," imageCommitterImage: \"sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/image-committer:v0.1.1\""," # -- PodTemplateSpec overlay for image-committer commit Job Pods."," imageCommitterPodTemplate: {}"," # -- Containerd socket path of host. Defaults to empty so the controller uses its built-in default (/var/run/containerd/containerd.sock) without passing --containerd-socket-path flag."," containerdSocketPath: \"\""," # -- Timeout duration for commit jobs"," commitJobTimeout: \"10m\""," # -- OCI registry prefix used for snapshot images."," registry: \"\""," # -- Use insecure registry mode when pushing snapshot images."," registryInsecure: false"," # -- Secret name used by commit Jobs to push snapshot images."," snapshotPushSecret: \"\""," # -- Secret name for pulling the image-committer image in commit Jobs."," # Required when imageCommitterImage is stored in a private registry."," imageCommitterPullSecret: \"\""," # -- Secret name injected into resumed sandboxes for pulling snapshot images."," resumePullSecret: \"\""," # -- Enable leader election for controller manager"," leaderElection:"," # -- Liveness probe configuration"," livenessProbe:"," httpGet:"," path: /healthz"," port: 8081"," initialDelaySeconds: 15"," periodSeconds: 20"," timeoutSeconds: 1"," successThreshold: 1"," failureThreshold: 3"," # -- Readiness probe configuration"," readinessProbe:"," path: /readyz"," initialDelaySeconds: 5"," periodSeconds: 10"," # -- Node labels for controller pod assignment"," # -- Tolerations for controller pod assignment"," # -- Affinity for controller pod assignment"," # -- Pod security context"," podSecurityContext:"," runAsNonRoot: true"," seccompProfile:"," type: RuntimeDefault"," # -- Container security context"," containerSecurityContext:"," allowPrivilegeEscalation: false"," capabilities:"," drop:"," - \"ALL\""," readOnlyRootFilesystem: false"," # -- Additional labels for controller pods"," # -- Additional annotations for controller pods"," # -- Priority class name for controller pods","# -- Image pull secrets for private registries","# - name: myregistrykey","# ServiceAccount configuration","serviceAccount:"," # -- Specifies whether a service account should be created"," create: true"," # -- Annotations to add to the service account"," annotations: {}"," # -- The name of the service account to use."," # If not set and create is true, a name is generated using the fullname template"," name: \"\"","# RBAC configuration","rbac:"," # -- Specifies whether RBAC resources should be created","# CRD configuration","crds:"," # -- Specifies whether CRDs should be installed"," install: true"," # -- Keep CRDs on chart uninstall (adds helm.sh/resource-policy: keep annotation)"," keep: true"," # -- Additional annotations to add to CRDs (will be merged with resource-policy if keep is true)","# -- Additional environment variables for the controller","extraEnv: []","# - name: CUSTOM_VAR","# value: \"custom-value\"","# -- Additional volumes for the controller","extraVolumes: []","# - name: custom-volume","# emptyDir: {}","# -- Additional volume mounts for the controller","extraVolumeMounts: []","# mountPath: /custom-path","# -- Additional init containers","extraInitContainers: []","# -- Additional sidecar containers","extraContainers: []","# Example values for different environments","# You can create separate values files for different environments:","# - values-dev.yaml","# - values-staging.yaml","# - values-prod.yaml","kubernetes/charts/opensandbox/Chart.yaml",[1533],{"_796":797,"_798":1534,"_400":1535,"_801":62},61,[1083,1223,1224,1225,1226,1223,1227,1223,1228,1229,1230,1231,1232,207,1233,1536,1537,1236,1538,1238,207,1240,1241,1242,1539,1243,1244,1245,207,1248,1249,1540,207,1252,1253,1254,207,1255,1256,207,1541,1542,1543,1544,1545,1546,1547,1548,1546,1549,1550,207,1257,1258,1259,1260,1551,1552,1553,1554,1555],"name: opensandbox","description: All-in-one Helm chart for deploying OpenSandbox controller and server","version: 0.2.2"," - operator"," - https://github.com/opensandbox-group/OpenSandbox/tree/main/kubernetes","dependencies:"," - name: opensandbox-controller"," version: \"0.2.1\""," repository: \"file://../opensandbox-controller\""," - name: opensandbox-server"," version: \"0.1.0\""," repository: \"file://../opensandbox-server\""," - name: opensandbox-node-agent"," repository: \"file://../opensandbox-node-agent\""," condition: opensandbox-node-agent.enabled"," artifacthub.io/links: |"," - name: Documentation"," url: https://github.com/opensandbox-group/OpenSandbox/blob/main/kubernetes/README.md"," - name: Support"," url: https://github.com/opensandbox-group/OpenSandbox/issues","kubernetes/charts/opensandbox-controller/Chart.yaml",[1558],{"_796":797,"_798":1559,"_400":1560,"_801":62},44,[1233,1561,1562,1236,1563,1564,207,1240,1241,1242,1539,1565,1566,1567,207,1248,1249,1540,207,1252,1253,1254,207,1568,207,1255,1256,207,1257,1569,1258,1259,1570,1571,1260,1572,1573,1574,1575,1551,1552,1553,1554,1555],"name: opensandbox-controller","description: A Kubernetes operator for managing sandbox environments with resource pooling and batch delivery","version: 0.2.1","appVersion: \"0.2.0\""," - resource-pool"," - batch-sandbox"," - task-orchestration","icon: https://raw.githubusercontent.com/opensandbox-group/OpenSandbox/main/kubernetes/images/logo.png"," # Category for Artifact Hub"," artifacthub.io/signKey: |"," fingerprint: [your-gpg-fingerprint]"," artifacthub.io/operator: \"true\""," artifacthub.io/operatorCapabilities: Full Lifecycle"," artifacthub.io/recommendations: |"," - url: https://github.com/kubernetes-sigs/kind",[1577,1578,1579,1580,1581,1582,1583,1584,1585,1586,1587,1588,1589,1590,1591],{"_767":49,"_49":1612},{"_767":1593,"_168":1556,"_796":1610,"_798":1611},{"_767":49,"_49":1609},{"_767":1593,"_168":1531,"_796":1608,"_798":1559},{"_767":49,"_49":1607},{"_767":1593,"_168":1392,"_796":324,"_798":1606},{"_767":1593,"_168":1261,"_796":1604,"_798":1605},{"_767":49,"_49":1603},{"_767":1593,"_168":1218,"_796":1601,"_798":1602},{"_767":1593,"_168":1078,"_796":1600,"_798":1594},{"_767":49,"_49":1599},{"_767":1593,"_168":920,"_796":1597,"_798":1598},{"_767":49,"_49":1596},{"_767":1593,"_168":790,"_796":1594,"_798":1595},{"_767":49,"_49":1592},"\n\n**Checks**\n- ✅ `git diff --check ebb85d8e89fa6463a1d386e4642945a4e696b479..HEAD`\n- ✅ `git status --short`\n- ⚠️ `cd kubernetes && make helm-lint` (not run successfully because Helm is unavailable in this environment: `helm: command not found`)\n\nNo code changes were necessary, so no commit or follow-up pull request was created.","repo_file_citation",28,37,"\n- Documentation consistently constructs release URLs using the chart version. ",125,157,"\n- Tag-triggered publishing validates the committed chart version and reads the committed application version for release metadata. ",26,19,20,"\n- The server chart’s `appVersion` now matches its pinned default server image version. ",75,77,66,"\n- The controller socket path now defaults to empty, so the unsupported flag is omitted unless explicitly configured. ",41,"\n- The umbrella chart depends on controller chart `0.2.1`. ",5,6,"## Review Result\n\nNo additional actionable findings on commit `d6dc9097e7e79f9403f7bc77bcaa76850588f972`.\n\nThe current head addresses the earlier versioning concerns:\n\n- The standalone controller fix is published under chart version `0.2.1`, while preserving controller application version `0.2.0`. ",{"_95":317,"_45":87,"_99":317,"_1615":1616,"_1617":1618,"_1619":1620,"_135":-5,"_122":1621},[86],"input_items",[1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651],"external_post_config",{"_1622":1623,"_253":254,"_1624":297,"_265":-5,"_1625":248,"_1626":-5,"_1627":-5,"_1628":1629,"_1630":1631,"_1632":-5,"_1633":-5,"_1634":1635,"_1636":18,"_1637":62,"_1638":57,"_1639":18},"user_model_slug","slug",1787058101.575975,"installation_id",137937460,"pr_number","repo_id","gitlab_service_account_project_id","review_trigger","comment_id",5328526238,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",399791998,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_95":408,"_99":317,"_400":1670},{"_304":305,"_306":307,"_1667":311,"_1668":132,"_313":-5,"_95":1669},{"_95":1652,"_306":1666,"_168":1392,"_1654":1655,"_1656":1606},{"_95":1652,"_306":1665,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1664,"_168":790,"_1654":1655,"_1656":1662},{"_95":1652,"_306":1658,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1663,"_168":1392,"_1654":1655,"_1656":1606},{"_95":1652,"_306":1661,"_168":790,"_1654":1655,"_1656":1662},{"_95":1652,"_306":1660,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1659,"_168":920,"_1654":1655,"_1656":1657},{"_95":1652,"_306":1658,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1653,"_168":920,"_1654":1655,"_1656":1657},"pull_request_comment","Fixed on the current head (`d6dc9097e7e79f9403f7bc77bcaa76850588f972`) by updating `kubernetes/charts/opensandbox-server/Chart.yaml` to `appVersion: \"0.2.2\"`, matching the chart's effective default `server.image.tag: \"v0.2.2\"`. This is a one-time metadata backfill: `scripts/bump-server-chart.sh` already updates both the pinned image tag and `appVersion` for future server releases.\n\nVerified that `helm show chart` reports app version `0.2.2` for both the standalone chart and the packaged umbrella dependency, and that both rendered deployments use `opensandbox/server:v0.2.2` with `app.kubernetes.io/version: \"0.2.2\"`. `make helm-lint`, workflow YAML parsing, and the full docs build also pass.","side","RIGHT","line",154,"\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `4bb7ec3730`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Report the server version that the chart actually deploys**\n\nWhen a tag-triggered `opensandbox-server` release runs, this reads `0.1.0` from `Chart.yaml`, while `kubernetes/charts/opensandbox-server/values.yaml:28` pins the default server image to `v0.2.2`. The updated deployment guide tells users to copy this advertised app version and explicitly pass it as `server.image.tag`, so following the release instructions deploys the wrong server version; align `appVersion` with the pinned image or derive the reported version from the chart's effective image tag.\n\nAGENTS.md reference: [AGENTS.md:L42-L46](https://github.com/opensandbox-group/OpenSandbox/blob/4bb7ec373006949ae1ae59bb9309028e2371a341/AGENTS.md#L42-L46)\n\nUseful? React with 👍 / 👎.","@codex /review","No additional compatibility note is needed because there are no legacy `opensandbox-server` Helm releases or tags to preserve. I checked the complete GitHub release list (`gh release list --limit 500`) and the remote tag namespace (`refs/tags/helm/opensandbox-server/*`); both contain zero matches. The only four historical `helm/*` releases are controller/umbrella `0.1.0` and `0.2.0`, and their tag, chart, and app versions are equal.\n\nTherefore this documentation describes the first future `opensandbox-server` chart release under the corrected chart-version URL convention; it cannot turn any previously published server URL into a 404. Adding a cutoff or migration path would document artifacts that never existed.",31,"Fixed on the current head (`4bb7ec373006949ae1ae59bb9309028e2371a341`). The standalone `opensandbox-controller` chart is now version `0.2.1` while retaining `appVersion: \"0.2.0\"`; the umbrella dependency is `0.2.1`, and `Chart.lock` was regenerated. I also restored independent chart/app version handling in the publish workflow so a `helm/opensandbox-controller/0.2.1` tag preserves the committed controller app version instead of rewriting it to a nonexistent image version.\n\nVerified with `make helm-lint`, `helm dependency list charts/opensandbox`, standalone and umbrella render assertions (both default to `controller:v0.2.0` and omit `--containerd-socket-path`; an explicit socket override still renders the flag), workflow YAML parsing, and the docs build. All checks on the current head are green.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Preserve URLs for previously published server charts**\n\nFor any `opensandbox-server` release published before this change where the app and chart versions differ, this URL points to a nonexistent tag: the previous publishing workflow explicitly used `app_version` in `release_tag`, while the artifact filename used `CHART_VERSION`. Existing artifacts are not relocated by changing the workflow, so users who follow “Choose a published” release can receive a 404; retain the legacy URL instructions for older releases or document a cutoff/migration alongside the new convention.\n\nAGENTS.md reference: [AGENTS.md:L44-L47](https://github.com/opensandbox-group/OpenSandbox/blob/4bb7ec373006949ae1ae59bb9309028e2371a341/AGENTS.md#L44-L47)\n\nUseful? React with 👍 / 👎.","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `45bbe5b40c`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Publish the controller fix under a new chart version**\n\nWhen users install the standalone `opensandbox-controller` release rather than building the repository checkout, this corrected default remains unavailable: the edited chart still declares `version: 0.2.0` in `kubernetes/charts/opensandbox-controller/Chart.yaml`, which is already the documented release package, while `publish-helm-chart.yml` derives the artifact version from that unchanged field and explicitly does not bump it. Bump the controller chart version and update the umbrella dependency/lock so this CrashLoop fix is shipped as a distinct artifact.\n\nAGENTS.md reference: [AGENTS.md:L46-L46](https://github.com/opensandbox-group/OpenSandbox/blob/45bbe5b40c64a9b4e214f04011a9f8b0dfaadb47/AGENTS.md#L46-L46)\n\nUseful? React with 👍 / 👎.","base_ref","head_ref","pull_request_info",[1671],{"_767":49,"_49":1660},[1945,1946],[],{"_772":773,"_49":774,"_775":776},{"_747":1936},{"_331":1935},{"_331":1711},{"_296":297,"_286":298,"_299":300,"_301":18,"_302":62,"_303":18,"_304":305,"_306":307,"_308":258,"_309":130,"_310":311,"_312":132,"_313":314,"_315":-5,"_316":-5,"_317":1710,"_319":320,"_321":322,"_323":324,"_325":326},{"_45":126,"_201":202,"_203":204,"_205":18,"_206":207,"_208":209,"_210":1697,"_212":-5,"_213":-5,"_214":18,"_215":1698,"_217":1699,"_219":1700,"_221":1701,"_223":1702,"_225":1703,"_227":-5,"_228":229,"_230":231,"_232":233,"_234":1704,"_58":-5,"_122":236,"_237":1705,"_239":1706,"_241":242,"_243":18,"_244":18},{"_136":1692},[1682,1683,1684,1685,1686,1687,1688,1689,1690,1691],{"_155":185,"_157":158,"_159":160,"_161":170,"_163":177,"_165":166,"_167":35,"_168":-5},{"_155":183,"_157":158,"_159":160,"_161":170,"_163":184,"_165":166,"_167":35,"_168":-5},{"_155":181,"_157":158,"_159":160,"_161":162,"_163":182,"_165":166,"_167":35,"_168":-5},{"_155":180,"_157":158,"_159":160,"_161":162,"_163":173,"_165":166,"_167":35,"_168":-5},{"_155":178,"_157":158,"_159":160,"_161":172,"_163":173,"_165":166,"_167":179,"_168":-5},{"_155":176,"_157":158,"_159":160,"_161":170,"_163":177,"_165":166,"_167":35,"_168":-5},{"_155":175,"_157":158,"_159":160,"_161":162,"_163":173,"_165":166,"_167":35,"_168":-5},{"_155":171,"_157":158,"_159":160,"_161":172,"_163":173,"_165":166,"_167":174,"_168":-5},{"_155":169,"_157":158,"_159":160,"_161":170,"_163":164,"_165":166,"_167":35,"_168":-5},{"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":35,"_168":-5},[1693,1694],{"_189":1696,"_191":198},{"_189":1695,"_191":192},{"_193":194,"_95":195,"_122":196},{"_193":199,"_95":195,"_122":200},{"_288":289,"_290":291,"_292":207,"_293":-5,"_294":-5,"_295":-5},[248],[207],[207],{"_248":1707},{},{},[],{"_247":62},{"_245":62,"_246":207},{"_45":250,"_193":204,"_251":1708,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264,"_265":67,"_266":18,"_267":-5,"_268":-5,"_269":-5,"_270":-5,"_271":-5,"_272":-5,"_167":273,"_274":-5,"_58":1709},{"_280":281,"_45":282,"_95":283,"_284":285,"_286":287},{"_276":18,"_277":18,"_278":18,"_279":18},{"_280":327,"_193":327,"_328":-5,"_284":329,"_45":330},[1712,1713,1714,1715,1716,1717,1718,1719,1720,1721,1722,1723,1724,1725,1726,1727,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1751],{"_161":719,"_374":1931},{"_161":391,"_374":1928},{"_161":709,"_374":1925},{"_161":395,"_374":1919},{"_161":395,"_374":1914},{"_161":395,"_374":1909},{"_161":395,"_374":1903},{"_161":395,"_374":1898},{"_161":413,"_374":1893},{"_161":413,"_374":1889},{"_161":395,"_374":1884},{"_161":395,"_374":1881},{"_161":395,"_374":1874},{"_161":413,"_374":1870},{"_161":413,"_374":1866},{"_161":395,"_374":1861},{"_161":395,"_374":1858},{"_161":413,"_374":1854},{"_161":395,"_374":1847},{"_161":413,"_374":1843},{"_161":395,"_374":1838},{"_161":395,"_374":1835},{"_161":413,"_374":1831},{"_161":395,"_374":1824},{"_161":413,"_374":1820},{"_161":395,"_374":1814},{"_161":395,"_374":1811},{"_161":395,"_374":1804},{"_161":413,"_374":1800},{"_161":413,"_374":1796},{"_161":395,"_374":1791},{"_161":395,"_374":1788},{"_161":413,"_374":1781},{"_161":395,"_374":1774},{"_161":413,"_374":1770},{"_161":395,"_374":1764},{"_161":413,"_374":1762},{"_161":395,"_374":1757},{"_161":391,"_374":1755},{"_161":373,"_374":1752},{"_376":377,"_90":1753},{"_379":380,"_381":382,"_106":-5,"_45":383,"_384":1754,"_386":387,"_388":389,"_390":116},[],{"_390":1756,"_376":377},{"_95":394},{"_397":1758,"_376":377,"_399":383},{"_400":1759,"_402":-5,"_45":403,"_404":1760,"_406":407,"_99":96,"_95":408},[1761],{"_409":383},{"_49":411,"_95":412},{"_415":416,"_397":1763,"_376":377,"_399":383},{"_45":403,"_406":407,"_49":411,"_95":418},{"_397":1765,"_376":377,"_399":383},{"_400":-5,"_421":422,"_45":423,"_404":1766,"_425":1767,"_95":427},{"_409":383},[1768,1769],{"_49":432,"_95":431},{"_49":430,"_95":431},{"_415":434,"_397":1771,"_376":377,"_399":383},{"_400":1772,"_45":423,"_425":1773,"_95":427},[],[432,430],{"_397":1775,"_376":377,"_399":383},{"_440":441,"_45":-5,"_404":1776,"_193":-5,"_443":1777,"_95":445},{"_409":383},{"_306":1778,"_447":-5},[1779,1780],{"_49":452,"_95":451},{"_49":450,"_95":451},{"_415":454,"_397":1782,"_376":377,"_399":383},{"_456":450,"_457":458,"_459":1783,"_461":462,"_381":35,"_463":35,"_45":464,"_465":466,"_467":468,"_390":116,"_95":469},[1784,1785,1786,1787],{"_457":484,"_193":485,"_168":486,"_95":477},{"_457":481,"_193":482,"_168":483,"_95":477},{"_457":478,"_193":479,"_168":480,"_95":477},{"_457":474,"_193":475,"_168":476,"_95":477},{"_397":1789,"_376":377,"_399":383},{"_440":441,"_45":489,"_490":491,"_404":1790,"_193":493,"_494":-5,"_390":116,"_95":495},{"_409":383},{"_397":1792,"_376":377,"_399":383},{"_400":-5,"_421":498,"_45":499,"_404":1793,"_425":1794,"_95":427},{"_409":383},[1795],{"_49":503,"_95":431},{"_415":505,"_397":1797,"_376":377,"_399":383},{"_400":1798,"_45":499,"_425":1799,"_95":427},[],[503],{"_415":510,"_397":1801,"_376":377,"_399":383},{"_456":512,"_457":513,"_459":1802,"_461":462,"_381":515,"_463":516,"_45":517,"_465":518,"_467":468,"_390":519,"_95":469},[1803],{"_457":521,"_95":522},{"_397":1805,"_376":377,"_399":383},{"_440":525,"_45":-5,"_404":1806,"_193":-5,"_443":1807,"_95":445},{"_409":383},{"_306":1808,"_447":-5},[1809,1810],{"_49":532,"_95":451},{"_49":531,"_95":451},{"_397":1812,"_376":377,"_399":383},{"_440":525,"_45":535,"_490":536,"_404":1813,"_193":493,"_494":-5,"_390":116,"_95":495},{"_409":383},{"_397":1815,"_376":377,"_399":383},{"_400":-5,"_421":540,"_45":541,"_404":1816,"_425":1817,"_95":427},{"_409":383},[1818,1819],{"_49":547,"_95":431},{"_49":546,"_95":431},{"_415":549,"_397":1821,"_376":377,"_399":383},{"_400":1822,"_45":541,"_425":1823,"_95":427},[],[547,546],{"_397":1825,"_376":377,"_399":383},{"_440":555,"_45":-5,"_404":1826,"_193":-5,"_443":1827,"_95":445},{"_409":383},{"_306":1828,"_447":-5},[1829,1830],{"_49":452,"_95":451},{"_49":561,"_95":451},{"_415":563,"_397":1832,"_376":377,"_399":383},{"_456":561,"_457":565,"_459":1833,"_461":462,"_381":35,"_463":35,"_45":567,"_465":568,"_467":468,"_390":116,"_95":469},[1834],{"_457":570,"_95":522},{"_397":1836,"_376":377,"_399":383},{"_440":555,"_45":573,"_490":574,"_404":1837,"_193":493,"_494":-5,"_390":116,"_95":495},{"_409":383},{"_397":1839,"_376":377,"_399":383},{"_400":-5,"_421":578,"_45":579,"_404":1840,"_425":1841,"_95":427},{"_409":383},[1842],{"_49":583,"_95":431},{"_415":585,"_397":1844,"_376":377,"_399":383},{"_400":1845,"_45":579,"_425":1846,"_95":427},[],[583],{"_397":1848,"_376":377,"_399":383},{"_440":591,"_45":-5,"_404":1849,"_193":-5,"_443":1850,"_95":445},{"_409":383},{"_306":1851,"_447":-5},[1852,1853],{"_49":452,"_95":451},{"_49":597,"_95":451},{"_415":599,"_397":1855,"_376":377,"_399":383},{"_456":597,"_457":601,"_459":1856,"_461":462,"_381":35,"_463":35,"_45":603,"_465":604,"_467":468,"_390":116,"_95":469},[1857],{"_457":606,"_95":522},{"_397":1859,"_376":377,"_399":383},{"_440":591,"_45":609,"_490":610,"_404":1860,"_193":493,"_494":-5,"_390":116,"_95":495},{"_409":383},{"_397":1862,"_376":377,"_399":383},{"_400":-5,"_421":614,"_45":615,"_404":1863,"_425":1864,"_95":427},{"_409":383},[1865],{"_49":619,"_95":431},{"_415":621,"_397":1867,"_376":377,"_399":383},{"_400":1868,"_45":615,"_425":1869,"_95":427},[],[619],{"_415":626,"_397":1871,"_376":377,"_399":383},{"_456":628,"_457":629,"_459":1872,"_461":462,"_381":631,"_463":35,"_45":632,"_465":633,"_467":468,"_390":116,"_95":469},[1873],{"_457":635,"_95":522},{"_397":1875,"_376":377,"_399":383},{"_440":638,"_45":-5,"_404":1876,"_193":-5,"_443":1877,"_95":445},{"_409":383},{"_306":1878,"_447":-5},[1879,1880],{"_49":645,"_95":451},{"_49":644,"_95":451},{"_397":1882,"_376":377,"_399":383},{"_440":638,"_45":648,"_490":649,"_404":1883,"_193":493,"_494":-5,"_390":116,"_95":495},{"_409":383},{"_397":1885,"_376":377,"_399":383},{"_400":-5,"_421":653,"_45":654,"_404":1886,"_425":1887,"_95":427},{"_409":383},[1888],{"_49":658,"_95":431},{"_415":660,"_397":1890,"_376":377,"_399":383},{"_400":1891,"_45":654,"_425":1892,"_95":427},[],[658],{"_415":665,"_397":1894,"_376":377,"_399":383},{"_667":-5,"_400":1895,"_45":669,"_95":670},[1896],{"_49":672,"_673":1897,"_95":49},[],{"_397":1899,"_376":377,"_399":383},{"_400":1900,"_402":-5,"_45":-5,"_404":1901,"_406":-5,"_99":317,"_95":408},[1902],{"_409":383},{"_49":672,"_95":451},{"_397":1904,"_376":377,"_399":383},{"_400":1905,"_402":-5,"_45":-5,"_404":1906,"_406":-5,"_99":317,"_95":408},[1907,1908],{"_409":383},{"_49":687,"_95":451},{"_49":686,"_95":451},{"_397":1910,"_376":377,"_399":383},{"_400":1911,"_402":-5,"_45":-5,"_404":1912,"_406":-5,"_99":692,"_95":408},[1913],{"_409":383},{"_49":694,"_95":451},{"_397":1915,"_376":377,"_399":383},{"_400":1916,"_402":-5,"_45":-5,"_404":1917,"_406":-5,"_99":692,"_95":408},[1918],{"_409":383},{"_49":700,"_95":451},{"_397":1920,"_376":377,"_399":383},{"_400":1921,"_402":-5,"_45":-5,"_404":1922,"_406":-5,"_99":692,"_95":408},[1923,1924],{"_409":383},{"_49":708,"_95":451},{"_49":707,"_95":451},{"_376":377,"_90":1926},{"_106":-5,"_45":383,"_384":1927,"_386":387,"_388":389,"_390":713},[],{"_390":1929,"_376":377},{"_716":1930,"_95":718},[],{"_721":1932},{"_723":-5,"_724":-5,"_725":726,"_727":389,"_461":462,"_728":18,"_729":-5,"_730":-5,"_731":-5,"_732":733,"_45":377,"_734":735,"_193":-5,"_736":-5,"_168":737,"_738":207,"_739":389,"_740":377,"_467":741,"_390":1933,"_743":-5,"_80":1934,"_745":389},{"_95":394},[],[],[1937],{"_45":750,"_751":1938,"_753":754,"_755":754,"_400":1939,"_390":757,"_402":-5,"_758":35,"_759":1940,"_761":291,"_762":-5},{"_99":317,"_193":-5,"_759":1944},{"_767":49,"_768":1943},{"_763":1941},{"_765":1942},[],[770],{},{"_95":408,"_99":96,"_400":1980},{"_95":779,"_780":1947},[1948,1949,1950,1951,1952,1953,1954,1955],{"_168":1556,"_791":-5,"_792":1977,"_794":-5},{"_168":1531,"_791":-5,"_792":1974,"_794":-5},{"_168":1392,"_791":-5,"_792":1971,"_794":-5},{"_168":1261,"_791":-5,"_792":1968,"_794":-5},{"_168":1218,"_791":-5,"_792":1965,"_794":-5},{"_168":1078,"_791":-5,"_792":1962,"_794":-5},{"_168":920,"_791":-5,"_792":1959,"_794":-5},{"_168":790,"_791":-5,"_792":1956,"_794":-5},[1957],{"_796":797,"_798":799,"_400":1958,"_801":62},[802,803,804,802,207,805,207,806,207,807,207,808,809,810,207,811,207,812,207,813,207,814,207,815,207,816,207,817,818,819,820,821,207,822,823,824,207,825,207,826,207,827,828,829,207,830,831,832,833,834,835,821,207,836,207,837,838,839,840,841,842,843,844,845,846,821,207,847,207,848,207,849,207,850,207,817,851,821,207,852,207,817,853,832,854,855,821,207,856,207,817,857,832,858,207,859,832,860,821,207,861,207,817,862,821,207,863,207,864,865,866,867,868,869,870,871,872,207,873,207,874,207,875,207,817,876,832,854,855,821,207,877,207,878,207,879,207,880,207,881,882,883,884,885,207,837,886,887,888,889,890,821,207,891,892,893,894,207,895,207,896,207,897,207,827,898,821,207,899,207,900,901,902,903,904,905,207,906,207,907,207,908,909,910,911,912,913,914,207,915,207,916,917,918,919],[1960],{"_796":797,"_798":923,"_400":1961,"_801":62},[925,207,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,931,941,942,943,931,941,944,945,946,207,947,948,949,207,950,951,952,953,954,955,956,957,958,959,960,961,962,207,963,964,965,966,207,967,968,961,969,207,970,971,964,972,973,974,975,976,977,975,978,979,975,980,981,982,983,984,985,986,987,988,207,989,990,991,964,992,993,994,207,995,996,988,207,995,997,998,988,207,999,1000,998,988,207,1001,207,1002,1003,964,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,983,1014,998,988,1005,1015,207,1016,1017,964,1018,1019,1020,207,1021,1022,998,988,207,1023,1024,207,1025,1026,964,1027,1018,1005,1028,1029,1005,1030,1031,207,1032,1033,964,1018,1034,1035,1036,207,1037,1038,964,1018,1039,1040,207,1041,964,1018,1042,207,1043,964,1018,1044,207,1045,1046,961,1047,207,1048,1049,961,1050,1051,1052,1053,975,1054,1055,975,1056,975,1057,975,1058,1059,1060,1061,1062,1063,975,1064,975,1058,1065,1066,975,1067,1068,1061,1062,1063,975,1069,975,1070,975,1071,1072,1073,1074,1075,1076,990,1077],[1963],{"_796":797,"_798":1081,"_400":1964,"_801":62},[1083,1084,207,1085,1086,1087,1088,207,1089,1090,207,1091,1092,207,1093,839,1094,1095,1096,1097,1098,1099,1100,207,1101,1102,1103,1104,207,1105,840,207,1106,1107,1108,1109,1110,1111,1112,1113,207,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,207,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,1150,1151,1152,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,207,1194,1195,1196,1197,1198,1199,207,1200,1201,207,1202,1203,1204,207,1205,1206,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217],[1966],{"_796":797,"_798":1221,"_400":1967,"_801":62},[1083,1223,1224,1225,1226,1223,1227,1223,1228,1229,1230,1231,1232,207,1233,1234,1235,1236,1237,1238,1239,207,1240,1241,1242,1243,1244,1245,1246,1247,207,1248,1249,1250,1251,207,1252,1253,1254,207,1255,1256,207,1257,1258,1259,1260],[1969],{"_796":797,"_798":1264,"_400":1970,"_801":62},[1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1283,1284,1285,1286,1287,1288,1286,1289,1290,1291,1288,1286,1292,1293,1294,1288,1295,1296,1297,1298,1288,1295,1299,1300,1295,1301,1302,1288,1295,1303,1304,1305,1306,1307,1308,1309,1310,1311,1286,1312,1313,1314,1315,1316,1286,1317,1318,1286,1319,1320,1286,1321,1322,1286,1284,1323,1286,1324,1325,1286,1326,1327,1286,1328,1329,1286,1330,1331,1286,1332,1333,1286,1334,1335,1286,1336,1337,1286,1338,1339,1340,1341,1314,1342,1343,1341,1286,1344,1345,1346,1286,1347,1348,1349,1350,1351,1352,1353,1354,1355,1356,1286,1357,1358,1349,1359,1360,1361,1362,1363,1364,1365,1286,1366,1367,1368,990,1369,1286,1370,1371,1284,1372,1373,1374,1286,1375,1288,1286,1286,1376,1377,1295,1378,1379,1380,1381,1382,1383,1295,1384,1377,1295,1295,1385,1386,1288,1295,1387,1388,1288,1295,1389,1390,1288,1295,1391],[1972],{"_796":797,"_798":799,"_400":1973,"_801":62},[1396,1397,1398,207,1085,1086,1399,1400,207,1401,1402,1090,207,1403,886,1404,1102,1405,1406,1407,1408,1409,1410,1214,1411,1412,1214,1413,1107,1108,1414,1415,1111,1416,1417,1214,1418,1419,207,1420,1421,887,1422,1134,1423,889,1424,1425,1426,207,1427,1428,1429,1430,1431,1432,207,1433,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1445,1446,1447,1448,1449,1450,1451,1452,1453,1454,207,1455,1456,888,1214,1457,1458,888,1459,1460,1461,1462,1463,1464,1465,1466,1214,1467,1468,888,1459,1469,1461,1470,1471,1464,1465,1466,1214,1472,1119,1214,1473,1114,1214,1474,1115,1214,1475,1476,1477,1478,1479,1214,1480,1481,1482,1483,1484,1485,1486,1214,1487,1127,1214,1488,1125,1214,1489,1129,207,1490,1092,1491,207,1492,1493,1494,1495,1496,1497,1498,1499,1500,207,1501,1502,1503,1495,207,1504,1505,1506,1507,1508,1509,1510,1497,207,207,1511,1512,1513,1514,207,1515,1516,1517,1518,207,1519,1520,1517,1521,207,1522,1523,207,1524,1525,207,1526,1527,1528,1529,1530],[1975],{"_796":797,"_798":1534,"_400":1976,"_801":62},[1083,1223,1224,1225,1226,1223,1227,1223,1228,1229,1230,1231,1232,207,1233,1536,1537,1236,1538,1238,207,1240,1241,1242,1539,1243,1244,1245,207,1248,1249,1540,207,1252,1253,1254,207,1255,1256,207,1541,1542,1543,1544,1545,1546,1547,1548,1546,1549,1550,207,1257,1258,1259,1260,1551,1552,1553,1554,1555],[1978],{"_796":797,"_798":1559,"_400":1979,"_801":62},[1233,1561,1562,1236,1563,1564,207,1240,1241,1242,1539,1565,1566,1567,207,1248,1249,1540,207,1252,1253,1254,207,1568,207,1255,1256,207,1257,1569,1258,1259,1570,1571,1260,1572,1573,1574,1575,1551,1552,1553,1554,1555],[1981,1982,1983,1984,1985,1986,1987,1988,1989,1990,1991,1992,1993,1994,1995],{"_767":49,"_49":1612},{"_767":1593,"_168":1556,"_796":1610,"_798":1611},{"_767":49,"_49":1609},{"_767":1593,"_168":1531,"_796":1608,"_798":1559},{"_767":49,"_49":1607},{"_767":1593,"_168":1392,"_796":324,"_798":1606},{"_767":1593,"_168":1261,"_796":1604,"_798":1605},{"_767":49,"_49":1603},{"_767":1593,"_168":1218,"_796":1601,"_798":1602},{"_767":1593,"_168":1078,"_796":1600,"_798":1594},{"_767":49,"_49":1599},{"_767":1593,"_168":920,"_796":1597,"_798":1598},{"_767":49,"_49":1596},{"_767":1593,"_168":790,"_796":1594,"_798":1595},{"_767":49,"_49":1592},[1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009],{"_1622":1623,"_253":254,"_1624":297,"_265":-5,"_1625":248,"_1626":-5,"_1627":-5,"_1628":1629,"_1630":1631,"_1632":-5,"_1633":-5,"_1634":1635,"_1636":18,"_1637":62,"_1638":57,"_1639":18},{"_95":408,"_99":317,"_400":2010},{"_304":305,"_306":307,"_1667":311,"_1668":132,"_313":-5,"_95":1669},{"_95":1652,"_306":1666,"_168":1392,"_1654":1655,"_1656":1606},{"_95":1652,"_306":1665,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1664,"_168":790,"_1654":1655,"_1656":1662},{"_95":1652,"_306":1658,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1663,"_168":1392,"_1654":1655,"_1656":1606},{"_95":1652,"_306":1661,"_168":790,"_1654":1655,"_1656":1662},{"_95":1652,"_306":1660,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1659,"_168":920,"_1654":1655,"_1656":1657},{"_95":1652,"_306":1658,"_168":-5,"_1654":-5,"_1656":-5},{"_95":1652,"_306":1653,"_168":920,"_1654":1655,"_1656":1657},[2011],{"_767":49,"_49":1660},"task_e_6a8457b4b0508329ac4513490de18cb3",1787058100.68881,"GitHub Mention: fix(chart): default containerdSocketPath to empty and bump opensandbox chart to 0.2.2","has_generated_title","has_unread_turn","denormalized_metadata",{"_2042":35,"_2043":2044,"_2045":-5,"_2046":-5,"_2037":2047,"_2048":-5,"_2049":-5,"_2050":-5,"_2051":-5},"task_status_display",{"_2031":2032,"_2033":204,"_133":130,"_2034":-5,"_2035":2036},"creator_workspace","external_pull_requests",[2024],{"_45":2025,"_2026":86,"_2027":2028,"_2029":132},"github-1118085970-1557","assistant_turn_id","pull_request",{"_296":297,"_286":298,"_299":300,"_301":18,"_302":62,"_303":18,"_304":305,"_306":307,"_308":258,"_309":130,"_310":311,"_312":132,"_313":314,"_315":-5,"_316":-5,"_317":2030,"_319":320,"_321":322,"_323":324,"_325":326},"codex_updated_sha",{"_280":327,"_193":327,"_328":-5,"_284":329,"_45":330},"latest_turn_status_display",{"_409":86,"_115":116,"_2037":-5,"_97":2038,"_2039":-5,"_2040":-5,"_2041":2036,"_117":-5},"environment_label","fix_task_id","initial_intent","pr","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_2052":-5,"_2053":-5,"_2054":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_2069":2070,"_2071":2072},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","manageRootRouteStylesheet","mobileWebHandoffEnabled","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",2068],"traceId","14062792930521804516","traceTime",1787099630494]