From 1f4be639f7e5d21a41c442deaee28cef554a29c0 Mon Sep 17 00:00:00 2001 From: r33drichards <57335981+r33drichards@users.noreply.github.com> Date: Wed, 12 Aug 2026 18:33:00 +0000 Subject: [PATCH 1/2] chore(sandbox): use public containerdisk images --- .../ci-public-containerdisk-refs.yml | 24 ++++++++++ .../sandbox/configure-pool-with-terraform.mdx | 4 +- .../sandbox/create-pool-with-python.mdx | 4 +- ...026-08-09-periodic-cua-sandbox-live-e2e.md | 6 +-- ...09-periodic-cua-sandbox-live-e2e-design.md | 2 +- infra/fleets-wif-smoke/main.tf | 2 +- .../tests/live/test_fleet_ephemeral.py | 4 +- tests/test_public_containerdisk_refs.py | 44 +++++++++++++++++++ 8 files changed, 79 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/ci-public-containerdisk-refs.yml create mode 100644 tests/test_public_containerdisk_refs.py diff --git a/.github/workflows/ci-public-containerdisk-refs.yml b/.github/workflows/ci-public-containerdisk-refs.yml new file mode 100644 index 0000000000..5a7bd2c201 --- /dev/null +++ b/.github/workflows/ci-public-containerdisk-refs.yml @@ -0,0 +1,24 @@ +name: "CI: Public ContainerDisk References" + +on: + pull_request: + paths: + - ".github/workflows/ci-public-containerdisk-refs.yml" + - "docs/content/docs/how-to-guides/sandbox/**" + - "docs/superpowers/plans/2026-08-09-periodic-cua-sandbox-live-e2e.md" + - "docs/superpowers/specs/2026-08-09-periodic-cua-sandbox-live-e2e-design.md" + - "infra/fleets-wif-smoke/**" + - "libs/fleet/backend/auth/**" + - "libs/python/cua-sandbox/tests/live/test_fleet_ephemeral.py" + - "tests/test_public_containerdisk_refs.py" + +permissions: + contents: read + +jobs: + guard: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - name: Reject private containerDisk references + run: python3 -m unittest tests.test_public_containerdisk_refs diff --git a/docs/content/docs/how-to-guides/sandbox/configure-pool-with-terraform.mdx b/docs/content/docs/how-to-guides/sandbox/configure-pool-with-terraform.mdx index a3d87d45d1..1383a9c912 100644 --- a/docs/content/docs/how-to-guides/sandbox/configure-pool-with-terraform.mdx +++ b/docs/content/docs/how-to-guides/sandbox/configure-pool-with-terraform.mdx @@ -65,7 +65,7 @@ resource "fleets_pool" "linux" { name = "linux-pool" cpu_cores = 4 memory = "8Gi" - container_disk_image = "296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo:main-38352d34" + container_disk_image = "public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04:main-e5d853a9" runtime = "kubevirt" firmware = "bios" @@ -117,7 +117,7 @@ resource "fleets_pool" "windows" { name = "windows-pool" cpu_cores = 4 memory = "4Gi" - container_disk_image = "296062593712.dkr.ecr.us-west-2.amazonaws.com/cua-server-windows:latest" + container_disk_image = "public.ecr.aws/k5j5w0x5/cua-windows-2022:latest" runtime = "kubevirt" firmware = "efi" diff --git a/docs/content/docs/how-to-guides/sandbox/create-pool-with-python.mdx b/docs/content/docs/how-to-guides/sandbox/create-pool-with-python.mdx index d5c205d339..35ac6da7a6 100644 --- a/docs/content/docs/how-to-guides/sandbox/create-pool-with-python.mdx +++ b/docs/content/docs/how-to-guides/sandbox/create-pool-with-python.mdx @@ -51,8 +51,8 @@ from cua_sandbox import Image, Pool IMAGE = ( - "296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo" - "@sha256:5b9cb82f482834f7541901b87be956e7544d0db13fabc0b372cbc5eca5a74180" + "public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04" + "@sha256:82702ebdd32d1f8fc05f2ea409a7c67d0ba9f8f8e4e9f1a89ce40989d5f4475d" ) POOL_NAME = os.environ.get("CUA_POOL_NAME", "cua-live-main-source-manual") diff --git a/docs/superpowers/plans/2026-08-09-periodic-cua-sandbox-live-e2e.md b/docs/superpowers/plans/2026-08-09-periodic-cua-sandbox-live-e2e.md index ccbea35f42..2aeb54fb3d 100644 --- a/docs/superpowers/plans/2026-08-09-periodic-cua-sandbox-live-e2e.md +++ b/docs/superpowers/plans/2026-08-09-periodic-cua-sandbox-live-e2e.md @@ -13,7 +13,7 @@ - Schedule must remain `7/15 * * * *`, running at `:07`, `:22`, `:37`, and `:52` UTC. - Scheduled runs execute both `main-source` and `published-package`; relevant pushes to `main` execute only `main-source`. - Manual dispatch accepts `both`, `main-source`, or `published-package`; only manual dispatch may set `force_failure=true`. -- Use image `296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo@sha256:5b9cb82f482834f7541901b87be956e7544d0db13fabc0b372cbc5eca5a74180`. +- Use image `public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04@sha256:82702ebdd32d1f8fc05f2ea409a7c67d0ba9f8f8e4e9f1a89ce40989d5f4475d`. - Provision with `cpu=4`, `memory_mb=4096`, `server_port=8000`, `time_to_start=900`, `request_timeout=60`, and `telemetry_enabled=False`. - Authenticate only with `CUA_CLIENT_ID`, `CUA_CLIENT_SECRET`, `CUA_FLEET_BASE_URL=https://run.cua.ai`, and the default Cyclops token endpoint. - Do not use `CUA_API_KEY`, legacy `/api/keys`, namespace-scoped key creation, repository-private SDK helpers, or mutable image tags. @@ -386,8 +386,8 @@ from tests.live.fleet_e2e_support import ( ) IMAGE = ( - "296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo" - "@sha256:5b9cb82f482834f7541901b87be956e7544d0db13fabc0b372cbc5eca5a74180" + "public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04" + "@sha256:82702ebdd32d1f8fc05f2ea409a7c67d0ba9f8f8e4e9f1a89ce40989d5f4475d" ) diff --git a/docs/superpowers/specs/2026-08-09-periodic-cua-sandbox-live-e2e-design.md b/docs/superpowers/specs/2026-08-09-periodic-cua-sandbox-live-e2e-design.md index ca5a6eaed9..755d8eca63 100644 --- a/docs/superpowers/specs/2026-08-09-periodic-cua-sandbox-live-e2e-design.md +++ b/docs/superpowers/specs/2026-08-09-periodic-cua-sandbox-live-e2e-design.md @@ -125,7 +125,7 @@ Event-and-lane concurrency serializes each deterministic claim. Provision with the exact certified image: ```text -296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo@sha256:5b9cb82f482834f7541901b87be956e7544d0db13fabc0b372cbc5eca5a74180 +public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04@sha256:82702ebdd32d1f8fc05f2ea409a7c67d0ba9f8f8e4e9f1a89ce40989d5f4475d ``` Use the public SDK with: diff --git a/infra/fleets-wif-smoke/main.tf b/infra/fleets-wif-smoke/main.tf index cd257524c8..8fc8833a45 100644 --- a/infra/fleets-wif-smoke/main.tf +++ b/infra/fleets-wif-smoke/main.tf @@ -24,7 +24,7 @@ resource "fleets_pool" "cua_cli_wif_smoke" { replicas = 0 cpu_cores = 4 memory = "8Gi" - container_disk_image = "296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo:latest" + container_disk_image = "public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04:latest" readiness_probe_json = jsonencode({ tcpSocket = { port = 8000 } }) service { diff --git a/libs/python/cua-sandbox/tests/live/test_fleet_ephemeral.py b/libs/python/cua-sandbox/tests/live/test_fleet_ephemeral.py index 228b01a3f7..aeac86809f 100644 --- a/libs/python/cua-sandbox/tests/live/test_fleet_ephemeral.py +++ b/libs/python/cua-sandbox/tests/live/test_fleet_ephemeral.py @@ -20,8 +20,8 @@ ) IMAGE = ( - "296062593712.dkr.ecr.us-west-2.amazonaws.com/desktop-workspace-duo" - "@sha256:5b9cb82f482834f7541901b87be956e7544d0db13fabc0b372cbc5eca5a74180" + "public.ecr.aws/k5j5w0x5/cua-ubuntu-24.04" + "@sha256:82702ebdd32d1f8fc05f2ea409a7c67d0ba9f8f8e4e9f1a89ce40989d5f4475d" ) diff --git a/tests/test_public_containerdisk_refs.py b/tests/test_public_containerdisk_refs.py new file mode 100644 index 0000000000..01de59b636 --- /dev/null +++ b/tests/test_public_containerdisk_refs.py @@ -0,0 +1,44 @@ +from pathlib import Path +import subprocess +import unittest + + +ROOT = Path(__file__).resolve().parent.parent +PRIVATE_REGISTRY = "296062593712.dkr.ecr.us-west-2.amazonaws.com" +PRIVATE_REPOSITORIES = ( + f"{PRIVATE_REGISTRY}/desktop-workspace-duo", + f"{PRIVATE_REGISTRY}/cua-server-windows", +) + + +class PublicContainerDiskReferenceTests(unittest.TestCase): + def test_tracked_files_do_not_reference_private_containerdisk_repositories(self) -> None: + tracked_files = subprocess.run( + ["git", "ls-files", "-z"], + cwd=ROOT, + check=True, + capture_output=True, + ).stdout.decode().split("\0") + violations = [] + for relative_path in tracked_files: + if not relative_path: + continue + path = ROOT / relative_path + if not path.is_file(): + continue + try: + text = path.read_text() + except UnicodeDecodeError: + continue + for repository in PRIVATE_REPOSITORIES: + if repository in text: + violations.append(f"{relative_path}: {repository}") + self.assertEqual( + violations, + [], + "Private containerDisk references remain:\n" + "\n".join(violations), + ) + + +if __name__ == "__main__": + unittest.main() From 356b5698ea2fc1925369fe4fc147e033c834f288 Mon Sep 17 00:00:00 2001 From: r33drichards <57335981+r33drichards@users.noreply.github.com> Date: Wed, 12 Aug 2026 18:36:38 +0000 Subject: [PATCH 2/2] test(sandbox): format containerdisk reference guard --- tests/test_public_containerdisk_refs.py | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/tests/test_public_containerdisk_refs.py b/tests/test_public_containerdisk_refs.py index 01de59b636..32877533d9 100644 --- a/tests/test_public_containerdisk_refs.py +++ b/tests/test_public_containerdisk_refs.py @@ -1,7 +1,6 @@ -from pathlib import Path import subprocess import unittest - +from pathlib import Path ROOT = Path(__file__).resolve().parent.parent PRIVATE_REGISTRY = "296062593712.dkr.ecr.us-west-2.amazonaws.com" @@ -13,12 +12,16 @@ class PublicContainerDiskReferenceTests(unittest.TestCase): def test_tracked_files_do_not_reference_private_containerdisk_repositories(self) -> None: - tracked_files = subprocess.run( - ["git", "ls-files", "-z"], - cwd=ROOT, - check=True, - capture_output=True, - ).stdout.decode().split("\0") + tracked_files = ( + subprocess.run( + ["git", "ls-files", "-z"], + cwd=ROOT, + check=True, + capture_output=True, + ) + .stdout.decode() + .split("\0") + ) violations = [] for relative_path in tracked_files: if not relative_path: