Skip to content

Commit 33c5a57

Browse files
dobracdobrac
committed
change firewall to network, save config in db
1 parent 4ba7bc7 commit 33c5a57

File tree

37 files changed

+547
-583
lines changed

37 files changed

+547
-583
lines changed

‎packages/api/internal/api/spec.gen.go‎

Lines changed: 114 additions & 114 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/api/internal/api/types.gen.go‎

Lines changed: 14 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/api/internal/handlers/sandbox.go‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ import (
1313
"go.uber.org/zap"
1414

1515
"github.com/e2b-dev/infra/packages/api/internal/api"
16-
"github.com/e2b-dev/infra/packages/api/internal/db/types"
17-
"github.com/e2b-dev/infra/packages/api/internal/utils"
16+
typesteam "github.com/e2b-dev/infra/packages/api/internal/db/types"
1817
"github.com/e2b-dev/infra/packages/db/queries"
18+
"github.com/e2b-dev/infra/packages/db/types"
1919
sbxlogger "github.com/e2b-dev/infra/packages/shared/pkg/logger/sandbox"
2020
"github.com/e2b-dev/infra/packages/shared/pkg/telemetry"
2121
)
@@ -29,7 +29,7 @@ func (a *APIStore) startSandbox(
2929
envVars map[string]string,
3030
metadata map[string]string,
3131
alias string,
32-
team *types.Team,
32+
team *typesteam.Team,
3333
build queries.EnvBuild,
3434
requestHeader *http.Header,
3535
isResume bool,
@@ -38,15 +38,12 @@ func (a *APIStore) startSandbox(
3838
autoPause bool,
3939
envdAccessToken *string,
4040
allowInternetAccess *bool,
41-
firewall *api.SandboxFirewallConfig,
41+
network *types.SandboxNetworkConfig,
4242
mcp api.Mcp,
4343
) (*api.Sandbox, *api.APIError) {
4444
startTime := time.Now()
4545
endTime := startTime.Add(timeout)
4646

47-
// Convert API firewall config to orchestrator firewall config
48-
orchFirewall := utils.APIToOrchestratorFirewall(firewall)
49-
5047
// Unique ID for the execution (from start/resume to stop/pause)
5148
executionID := uuid.New().String()
5249
sandbox, instanceErr := a.orchestrator.CreateSandbox(
@@ -67,7 +64,7 @@ func (a *APIStore) startSandbox(
6764
autoPause,
6865
envdAccessToken,
6966
allowInternetAccess,
70-
orchFirewall,
67+
network,
7168
)
7269
if instanceErr != nil {
7370
telemetry.ReportError(ctx, "error when creating instance", instanceErr.Err)

‎packages/api/internal/handlers/sandbox_connect.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,8 @@ func (a *APIStore) PostSandboxesSandboxIDConnect(c *gin.Context, sandboxID api.S
154154
autoPause,
155155
envdAccessToken,
156156
snap.AllowInternetAccess,
157-
utils.DBToAPIFirewall(&snap.Firewall), // firewall config from snapshot
158-
nil, // mcp
157+
snap.Config.Network,
158+
nil, // mcp
159159
)
160160
if createErr != nil {
161161
zap.L().Error("Failed to resume sandbox", zap.Error(createErr.Err))

‎packages/api/internal/handlers/sandbox_create.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,11 @@ import (
1313

1414
"github.com/e2b-dev/infra/packages/api/internal/api"
1515
"github.com/e2b-dev/infra/packages/api/internal/auth"
16-
"github.com/e2b-dev/infra/packages/api/internal/db/types"
16+
typesteam "github.com/e2b-dev/infra/packages/api/internal/db/types"
1717
"github.com/e2b-dev/infra/packages/api/internal/middleware/otel/metrics"
1818
"github.com/e2b-dev/infra/packages/api/internal/sandbox"
1919
"github.com/e2b-dev/infra/packages/api/internal/utils"
20+
"github.com/e2b-dev/infra/packages/db/types"
2021
"github.com/e2b-dev/infra/packages/shared/pkg/id"
2122
"github.com/e2b-dev/infra/packages/shared/pkg/logger"
2223
sbxlogger "github.com/e2b-dev/infra/packages/shared/pkg/logger/sandbox"
@@ -43,7 +44,7 @@ func (a *APIStore) PostSandboxes(c *gin.Context) {
4344
ctx := c.Request.Context()
4445

4546
// Get team from context, use TeamContextKey
46-
teamInfo := c.Value(auth.TeamContextKey).(*types.Team)
47+
teamInfo := c.Value(auth.TeamContextKey).(*typesteam.Team)
4748

4849
c.Set("teamID", teamInfo.Team.ID.String())
4950

@@ -156,7 +157,16 @@ func (a *APIStore) PostSandboxes(c *gin.Context) {
156157
}
157158

158159
allowInternetAccess := body.AllowInternetAccess
159-
firewall := body.Firewall
160+
161+
var network *types.SandboxNetworkConfig
162+
if body.Network != nil {
163+
network = &types.SandboxNetworkConfig{
164+
Egress: &types.SandboxNetworkEgressConfig{
165+
AllowedAddresses: sharedUtils.DerefOrDefault(body.Network.AllowOut, nil),
166+
BlockedAddresses: sharedUtils.DerefOrDefault(body.Network.BlockOut, nil),
167+
},
168+
}
169+
}
160170

161171
sbx, createErr := a.startSandbox(
162172
ctx,
@@ -174,7 +184,7 @@ func (a *APIStore) PostSandboxes(c *gin.Context) {
174184
autoPause,
175185
envdAccessToken,
176186
allowInternetAccess,
177-
firewall,
187+
network,
178188
mcp,
179189
)
180190
if createErr != nil {

‎packages/api/internal/handlers/sandbox_resume.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,8 +153,8 @@ func (a *APIStore) PostSandboxesSandboxIDResume(c *gin.Context, sandboxID api.Sa
153153
autoPause,
154154
envdAccessToken,
155155
snap.AllowInternetAccess,
156-
utils.DBToAPIFirewall(&snap.Firewall), // firewall config from snapshot
157-
nil, // mcp
156+
snap.Config.Network,
157+
nil, // mcp
158158
)
159159
if createErr != nil {
160160
zap.L().Error("Failed to resume sandbox", zap.Error(createErr.Err))

‎packages/api/internal/orchestrator/create_instance.go‎

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,25 +13,52 @@ import (
1313
"google.golang.org/protobuf/types/known/timestamppb"
1414

1515
"github.com/e2b-dev/infra/packages/api/internal/api"
16-
"github.com/e2b-dev/infra/packages/api/internal/db/types"
16+
teamtypes "github.com/e2b-dev/infra/packages/api/internal/db/types"
1717
"github.com/e2b-dev/infra/packages/api/internal/orchestrator/nodemanager"
1818
"github.com/e2b-dev/infra/packages/api/internal/orchestrator/placement"
1919
"github.com/e2b-dev/infra/packages/api/internal/sandbox"
2020
"github.com/e2b-dev/infra/packages/api/internal/utils"
2121
"github.com/e2b-dev/infra/packages/db/queries"
22+
"github.com/e2b-dev/infra/packages/db/types"
2223
"github.com/e2b-dev/infra/packages/shared/pkg/consts"
2324
"github.com/e2b-dev/infra/packages/shared/pkg/grpc/orchestrator"
2425
"github.com/e2b-dev/infra/packages/shared/pkg/logger"
2526
"github.com/e2b-dev/infra/packages/shared/pkg/telemetry"
2627
ut "github.com/e2b-dev/infra/packages/shared/pkg/utils"
2728
)
2829

30+
// buildNetworkConfig constructs the orchestrator network configuration from the input parameters
31+
func buildNetworkConfig(network *types.SandboxNetworkConfig, allowInternetAccess *bool) *orchestrator.SandboxNetworkConfig {
32+
orchNetwork := &orchestrator.SandboxNetworkConfig{
33+
Egress: &orchestrator.SandboxNetworkEgressConfig{},
34+
}
35+
36+
// Copy network configuration if provided
37+
if network != nil && network.Egress != nil {
38+
if len(network.Egress.AllowedAddresses) > 0 {
39+
orchNetwork.Egress.AllowedAddresses = network.Egress.AllowedAddresses
40+
}
41+
if len(network.Egress.BlockedAddresses) > 0 {
42+
orchNetwork.Egress.BlockedAddresses = network.Egress.BlockedAddresses
43+
}
44+
}
45+
46+
// Handle the case where internet access is explicitly disabled
47+
// This should be applied after copying the network config to preserve allowed addresses
48+
if allowInternetAccess != nil && !*allowInternetAccess {
49+
// Block all internet access - this overrides any other blocked addresses
50+
orchNetwork.Egress.BlockedAddresses = []string{"0.0.0.0/0"}
51+
}
52+
53+
return orchNetwork
54+
}
55+
2956
func (o *Orchestrator) CreateSandbox(
3057
ctx context.Context,
3158
sandboxID,
3259
executionID,
3360
alias string,
34-
team *types.Team,
61+
team *teamtypes.Team,
3562
build queries.EnvBuild,
3663
metadata map[string]string,
3764
envVars map[string]string,
@@ -44,7 +71,7 @@ func (o *Orchestrator) CreateSandbox(
4471
autoPause bool,
4572
envdAuthToken *string,
4673
allowInternetAccess *bool,
47-
firewall *orchestrator.SandboxFirewallConfig,
74+
network *types.SandboxNetworkConfig,
4875
) (sbx sandbox.Sandbox, apiErr *api.APIError) {
4976
ctx, childSpan := tracer.Start(ctx, "create-sandbox")
5077
defer childSpan.End()
@@ -139,10 +166,7 @@ func (o *Orchestrator) CreateSandbox(
139166
sbxDomain = cluster.SandboxDomain
140167
}
141168

142-
if allowInternetAccess != nil && !*allowInternetAccess {
143-
firewall.Egress = firewall.GetEgress()
144-
firewall.Egress.BlockedCidrs = []string{"0.0.0.0/0"}
145-
}
169+
orchNetwork := buildNetworkConfig(network, allowInternetAccess)
146170

147171
sbxRequest := &orchestrator.SandboxCreateRequest{
148172
Sandbox: &orchestrator.SandboxConfig{
@@ -166,7 +190,7 @@ func (o *Orchestrator) CreateSandbox(
166190
Snapshot: isResume,
167191
AutoPause: autoPause,
168192
AllowInternetAccess: allowInternetAccess,
169-
Firewall: firewall,
193+
Network: orchNetwork,
170194
TotalDiskSizeMb: ut.FromPtr(build.TotalDiskSizeMb),
171195
},
172196
StartTime: timestamppb.New(startTime),
@@ -244,7 +268,7 @@ func (o *Orchestrator) CreateSandbox(
244268
allowInternetAccess,
245269
baseTemplateID,
246270
sbxDomain,
247-
utils.OrchestratorToDBFirewall(firewall),
271+
network,
248272
)
249273

250274
o.sandboxStore.Add(ctx, sbx, true)

‎packages/api/internal/orchestrator/nodemanager/sandboxes.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
"github.com/e2b-dev/infra/packages/api/internal/sandbox"
1212
"github.com/e2b-dev/infra/packages/api/internal/utils"
13+
"github.com/e2b-dev/infra/packages/db/types"
1314
"github.com/e2b-dev/infra/packages/shared/pkg/consts"
1415
)
1516

@@ -46,6 +47,13 @@ func (n *Node) GetSandboxes(ctx context.Context) ([]sandbox.Sandbox, error) {
4647
return nil, fmt.Errorf("failed to parse build ID '%s' for job: %w", config.GetBuildId(), parseErr)
4748
}
4849

50+
network := &types.SandboxNetworkConfig{
51+
Egress: &types.SandboxNetworkEgressConfig{
52+
AllowedAddresses: config.GetNetwork().GetEgress().GetAllowedAddresses(),
53+
BlockedAddresses: config.GetNetwork().GetEgress().GetBlockedAddresses(),
54+
},
55+
}
56+
4957
sandboxesInfo = append(
5058
sandboxesInfo,
5159
sandbox.NewSandbox(
@@ -73,7 +81,7 @@ func (n *Node) GetSandboxes(ctx context.Context) ([]sandbox.Sandbox, error) {
7381
config.AllowInternetAccess, //nolint:protogetter // we need the nil check too
7482
config.GetBaseTemplateId(),
7583
n.SandboxDomain,
76-
utils.OrchestratorToDBFirewall(config.GetFirewall()),
84+
network,
7785
),
7886
)
7987
}

‎packages/api/internal/orchestrator/pause_instance.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,10 @@ func (o *Orchestrator) pauseSandbox(ctx context.Context, node *nodemanager.Node,
4343
EnvdSecured: sbx.EnvdAccessToken != nil,
4444
AllowInternetAccess: sbx.AllowInternetAccess,
4545
AutoPause: sbx.AutoPause,
46-
Firewall: sbx.Firewall,
46+
Config: &types.PausedSandboxConfig{
47+
Version: types.PausedSandboxConfigVersion,
48+
Network: sbx.Network,
49+
},
4750
}
4851

4952
envBuild, err := o.dbClient.NewSnapshotBuild(

‎packages/api/internal/sandbox/sandbox.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ func NewSandbox(
3535
allowInternetAccess *bool,
3636
baseTemplateID string,
3737
domain *string,
38-
firewall *types.SandboxFirewallConfig,
38+
network *types.SandboxNetworkConfig,
3939
) Sandbox {
4040
return Sandbox{
4141
SandboxID: sandboxID,
@@ -64,7 +64,7 @@ func NewSandbox(
6464
AutoPause: autoPause,
6565
State: StateRunning,
6666
BaseTemplateID: baseTemplateID,
67-
Firewall: firewall,
67+
Network: network,
6868
}
6969
}
7070

@@ -94,7 +94,7 @@ type Sandbox struct {
9494
NodeID string
9595
ClusterID uuid.UUID
9696
AutoPause bool
97-
Firewall *types.SandboxFirewallConfig
97+
Network *types.SandboxNetworkConfig
9898

9999
State State
100100
}

0 commit comments

Comments
 (0)