add blog and warning in readme for new breaking changes (microsoft#1380)

* add blog and warning in readme for new breaking changes * add version number to readme note * Update website/blog/2024-01-23-Code-execution-in-docker/index.mdx Co-authored-by: Jack Gerrits <[email protected]> * Update website/blog/2024-01-23-Code-execution-in-docker/index.mdx Co-authored-by: Jack Gerrits <[email protected]> * pr comments * Update website/blog/2024-01-23-Code-execution-in-docker/index.mdx Co-authored-by: Eric Zhu <[email protected]> * rephrase vulnterability * address pr comments * add doc for turning off code execution entirely * add more in docs about disabling code execution entirely * Update website/docs/FAQ.md Co-authored-by: Chi Wang <[email protected]> * Update website/docs/Installation.md Co-authored-by: Chi Wang <[email protected]> --------- Co-authored-by: Jack Gerrits <[email protected]> Co-authored-by: Eric Zhu <[email protected]> Co-authored-by: Chi Wang <[email protected]>
whiskyboy · Jan 24, 2024 · 6196a1d · 6196a1d
1 parent 49e72ea
commit 6196a1d
Show file tree

Hide file tree

Showing 5 changed files with 108 additions and 3 deletions.
diff --git a/README.md b/README.md
@@ -13,6 +13,8 @@
     <br>
 </p> -->
 
+:warning: Jan 23: **Breaking Change in Latest Release v0.2.8** `use_docker` defaults to `True` for code-execution. See [blog post](https://microsoft.github.io/autogen/blog/2024/01/23/Code-execution-in-docker) for details and [FAQ](https://microsoft.github.io/autogen/docs/FAQ#agents-are-throwing-due-to-docker-not-running-how-can-i-resolve-this) for troubleshooting any issues.
+
 :fire: Dec 31: [AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation Framework](https://arxiv.org/abs/2308.08155) is selected by [TheSequence: My Five Favorite AI Papers of 2023](https://thesequence.substack.com/p/my-five-favorite-ai-papers-of-2023).
 
 <!-- :fire: Nov 24: pyautogen [v0.2](https://github.com/microsoft/autogen/releases/tag/v0.2.0) is released with many updates and new features compared to v0.1.1. It switches to using openai-python v1. Please read the [migration guide](https://microsoft.github.io/autogen/docs/Installation#python). -->

diff --git a/website/blog/2024-01-23-Code-execution-in-docker/index.mdx b/website/blog/2024-01-23-Code-execution-in-docker/index.mdx
@@ -0,0 +1,63 @@
+---
+title: "Code execution is now by default inside docker container"
+authors:
+  - olgavrou
+tags: [AutoGen]
+---
+
+
+## TLDR
+
+AutoGen 0.2.8 enhances operational safety by making 'code execution inside a Docker container' the default setting, focusing on informing users about its operations and empowering them to make informed decisions regarding code execution.
+
+The new release introduces a breaking change where the `use_docker` argument is set to `True` by default in code executing agents. This change underscores our commitment to prioritizing security and safety in AutoGen.
+
+## Introduction
+
+AutoGen has code-executing agents, usually defined as a `UserProxyAgent`, where code execution is by default ON. Until now, unless explicitly specified by the user, any code generated by other agents would be executed by code-execution agents locally, i.e. wherever AutoGen was being executed. If AutoGen happened to be run in a docker container then the risks of running code were minimized. However, if AutoGen runs outside of Docker, it's easy particularly for new users to overlook code-execution risks.
+
+AutoGen has now changed to by default execute any code inside a docker container (unless execution is already happening inside a docker container). It will launch a Docker image (either user-provided or default), execute the new code, and then terminate the image, preparing for the next code execution cycle.
+
+We understand that not everyone is concerned about this especially when playing around with AutoGen for the first time. We have provided easy ways to turn this requirement off. But we believe that making sure that the user is aware of the fact that code will be executed locally, and prompting them to think about the security implications of running code locally is the right step for AutoGen.
+
+## Example
+
+The example shows the default behaviour which is that any code generated by assistant agent and executed by user_proxy agent, will attempt to use a docker container to execute the code. If docker is not running, it will throw an error. User can decide to activate docker or opt in for local code execution.
+
+```python
+from autogen import AssistantAgent, UserProxyAgent, config_list_from_json
+assistant = AssistantAgent("assistant", llm_config={"config_list": config_list})
+user_proxy = UserProxyAgent("user_proxy", code_execution_config={"work_dir": "coding"})
+user_proxy.initiate_chat(assistant, message="Plot a chart of NVDA and TESLA stock price change YTD.")
+```
+
+To opt out of from this default behaviour there are some options.
+
+### Diasable code execution entirely
+
+- Set `code_execution_config` to `False` for each code-execution agent. E.g.:
+
+```python
+user_proxy = autogen.UserProxyAgent(name="user_proxy", llm_config=llm_config, code_execution_config=False)
+```
+
+### Run code execution locally
+
+- `use_docker` can be set to `False` in `code_execution_config` for each code-execution agent.
+- To set it for all code-execution agents at once: set `AUTOGEN_USE_DOCKER` to `False` as an environment variable.
+
+E.g.:
+
+```python
+user_proxy = autogen.UserProxyAgent(name="user_proxy", llm_config=llm_config,
+    code_execution_config={"work_dir":"coding", "use_docker":False})
+```
+
+## Related documentation
+
+- [Code execution with docker](https://microsoft.github.io/autogen/docs/Installation#code-execution-with-docker-default)
+- [How to disable code execution in docker](https://microsoft.github.io/autogen/docs/FAQ#agents-are-throwing-due-to-docker-not-running-how-can-i-resolve-this)
+
+## Conclusion
+
+AutoGen 0.2.8 now improves the code execution safety and is ensuring that the user is properly informed of what autogen is doing and can make decisions around code-execution.
diff --git a/website/blog/authors.yml b/website/blog/authors.yml
@@ -99,3 +99,9 @@ skzhang1:
   title: PhD student at the Pennsylvania State University
   url: https://github.com/skzhang1
   image_url: https://github.com/skzhang1.png
+
+olgavrou:
+  name: Olga Vrousgou
+  title: Senior Software Engineer at Microsoft Research
+  url: https://github.com/olgavrou/
+  image_url: https://github.com/olgavrou.png
diff --git a/website/docs/FAQ.md b/website/docs/FAQ.md
@@ -222,8 +222,32 @@ You can also disable the cache. See [here](./Use-Cases/agent_chat.md#llm-caching
 
 ## Agents are throwing due to docker not running, how can I resolve this?
 
-If running AutoGen locally the default for agents who execute code is for them to try and perform code execution within a docker container. If docker is not running, this will cause the agent to throw an error. To resolve this you have the below options:
+If running AutoGen locally the default for agents who execute code is for them to try and perform code execution within a docker container. If docker is not running, this will cause the agent to throw an error. To resolve this you have some options.
+
+### If you want to disable code execution entirely
+
+- Set `code_execution_config` to `False` for each code-execution agent. E.g.:
+
+```python
+user_proxy = autogen.UserProxyAgent(
+    name="agent",
+    llm_config=llm_config,
+    code_execution_config=False)
+```
+
+### If you want to run code execution in docker
 
 - **Recommended**: Make sure docker is up and running.
-- If you want to run the code locally then `use_docker` can be set to `False` in `code_execution_config` for each code-execution agent.
-- If you want to run the code locally for all code-execution agents: set `AUTOGEN_USE_DOCKER` to `False` as an environment variable.
+
+### If you want to run code execution locally
+
+- `use_docker` can be set to `False` in `code_execution_config` for each code-execution agent.
+- To set it for all code-execution agents at once: set `AUTOGEN_USE_DOCKER` to `False` as an environment variable.
+
+E.g.:
+
+```python
+user_proxy = autogen.UserProxyAgent(
+    name="agent", llm_config=llm_config,
+    code_execution_config={"work_dir":"coding", "use_docker":False})
+```
diff --git a/website/docs/Installation.md b/website/docs/Installation.md
@@ -185,6 +185,16 @@ Otherwise, reply CONTINUE, or the reason why the task is not solved yet."""
 )
 ```
 
+**Turn off code execution entirely**: if you want to turn off code execution entirely, set `code_execution_config` to `False`. E.g.:
+
+```python
+user_proxy = autogen.UserProxyAgent(
+    name="agent",
+    llm_config=llm_config,
+    code_execution_config=False,
+)
+```
+
 ### Migration guide to v0.2
 
 openai v1 is a total rewrite of the library with many breaking changes. For example, the inference requires instantiating a client, instead of using a global class method.