feat: add lockfiles for reproducible sandbox builds

dockerfiles/Dockerfile.sandbox

@@ -12,6 +12,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# =============================================================================
+# Dependency Locking
+# =============================================================================
+# The sandbox uses pinned dependencies from two lock files:
+#   - requirements/sandbox-core.lock  (from code_execution.txt — used on CI / arm64)
+#   - requirements/sandbox.lock       (from code_execution.txt + stem.txt — used otherwise; superset of core)
+#
+# To regenerate after changing code_execution.txt or stem.txt:
+#     uv pip compile requirements/code_execution.txt \
+#         --python-version 3.10 -o requirements/sandbox-core.lock
+#     uv pip compile requirements/code_execution.txt requirements/stem.txt \
+#         --python-version 3.10 \
+#         --extra-index-url https://download.pytorch.org/whl/cpu \
+#         -o requirements/sandbox.lock
+# =============================================================================
+
 # Use the base image with Python 3.10 and Flask
 FROM tiangolo/uwsgi-nginx-flask:python3.10
 
@@ -59,26 +75,26 @@ RUN cd /lean4/my_project && \
 ENV LEAN_PATH="/lean4/my_project"
 ENV PATH="/lean4/my_project:$PATH"
 
-# Set up application code and install Python dependencies
-COPY requirements/code_execution.txt /app/requirements.txt
-RUN pip install --no-cache-dir -r /app/requirements.txt
-
-
-# Install STEM related libraries
-COPY requirements/stem.txt /app/stem_requirements.txt
-
-
 # Speed/size/env hygiene
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
     UV_SYSTEM_PYTHON=1 \
     PATH="/root/.local/bin:${PATH}"
 
+# Install uv (pinned for reproducibility)
+RUN curl -LsSf https://astral.sh/uv/0.9.7/install.sh | sh
+
+# Set up application code directory
+WORKDIR /app
 
-# Install uv (adds to ~/.local/bin), then install deps
+# Install Python dependencies from lock file
+# - On CI/arm64: core dependencies only (sandbox-core.lock)
+# - Otherwise: full dependencies including STEM (sandbox.lock)
+COPY requirements/sandbox-core.lock /app/requirements-core.lock
+COPY requirements/sandbox.lock /app/requirements.lock
 RUN if [ "$GITHUB_CI" != "1" ] && [ "$TARGETARCH" != "arm64" ]; then \
-        curl -LsSf https://astral.sh/uv/install.sh | sh  && \
-        uv pip install --upgrade pip && \
-        uv pip install -r /app/stem_requirements.txt --no-cache-dir --extra-index-url https://download.pytorch.org/whl/cpu; \
+        uv pip install --system -r /app/requirements.lock --extra-index-url https://download.pytorch.org/whl/cpu; \
+    else \
+        uv pip install --system -r /app/requirements-core.lock; \
     fi
 
 # For scicode eval - create data directory and download test data
@@ -132,9 +148,6 @@ RUN gcc -shared -fPIC -o /usr/lib/libblock_network.so /tmp/block_network.c -ldl
 COPY dockerfiles/sandbox/start-with-nginx.sh /start-with-nginx.sh
 RUN chmod +x /start-with-nginx.sh
 
-# Set the working directory to /app
-WORKDIR /app
-
 # Environment variables for multi-worker setup
 ENV NGINX_PORT=6000
 

requirements/code_execution.txt

@@ -15,6 +15,8 @@
 
 # this are requirements for code execution - put all packages that LLM should have access to in here
 annotated-types>=0.7.0
+flask
+gunicorn
 h5py
 # needed for persistent sessions
 ipython

requirements/sandbox-core.lock

@@ -0,0 +1,91 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile requirements/code_execution.txt --python-version 3.10 -o requirements/sandbox-core.lock
+annotated-types==0.7.0
+    # via -r requirements/code_execution.txt
+asttokens==3.0.1
+    # via stack-data
+blinker==1.9.0
+    # via flask
+click==8.3.1
+    # via flask
+decorator==5.2.1
+    # via ipython
+exceptiongroup==1.3.1
+    # via ipython
+executing==2.2.1
+    # via stack-data
+flask==3.1.2
+    # via -r requirements/code_execution.txt
+gunicorn==25.0.3
+    # via -r requirements/code_execution.txt
+h5py==3.15.1
+    # via -r requirements/code_execution.txt
+ipython==8.38.0
+    # via -r requirements/code_execution.txt
+itsdangerous==2.2.0
+    # via flask
+jedi==0.19.2
+    # via ipython
+jinja2==3.1.6
+    # via flask
+markupsafe==3.0.3
+    # via
+    #   flask
+    #   jinja2
+    #   werkzeug
+matplotlib-inline==0.2.1
+    # via ipython
+mpmath==1.3.0
+    # via sympy
+numpy==2.2.6
+    # via
+    #   -r requirements/code_execution.txt
+    #   h5py
+    #   pandas
+    #   scipy
+packaging==26.0
+    # via gunicorn
+pandas==2.3.3
+    # via -r requirements/code_execution.txt
+parso==0.8.6
+    # via jedi
+pexpect==4.9.0
+    # via ipython
+prompt-toolkit==3.0.52
+    # via ipython
+psutil==7.2.2
+    # via -r requirements/code_execution.txt
+ptyprocess==0.7.0
+    # via pexpect
+pure-eval==0.2.3
+    # via stack-data
+pygments==2.19.2
+    # via ipython
+python-dateutil==2.9.0.post0
+    # via pandas
+pytz==2025.2
+    # via pandas
+scipy==1.15.3
+    # via -r requirements/code_execution.txt
+six==1.17.0
+    # via python-dateutil
+stack-data==0.6.3
+    # via ipython
+sympy==1.14.0
+    # via -r requirements/code_execution.txt
+tqdm==4.67.3
+    # via -r requirements/code_execution.txt
+traitlets==5.14.3
+    # via
+    #   ipython
+    #   matplotlib-inline
+typing-extensions==4.15.0
+    # via
+    #   exceptiongroup
+    #   ipython
+tzdata==2025.3
+    # via pandas
+wcwidth==0.6.0
+    # via prompt-toolkit
+werkzeug==3.1.5
+    # via flask