[PR #67] [MERGED] fix(template): provision a missing default user at the end of a build #152

New issue

Closed

opened 2026-10-29 14:20:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:20:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/67
Author: @nblintao
Created: 7/29/2026
Status: ✅ Merged
Merged: 7/31/2026
Merged by: @LSX-s-Software

Base: main ← Head: fix/provision-default-user

📝 Commits (6)

5d0deae fix(template): provision a missing default user at the end of a build
b34d9fd fix(template): provision the default user via /bin/sh
9ee24cd fix(template): validate the account name and propagate executor errors
0a0245a fix(template): provision the default user's named group as well
b5a01df fix(template): bound the default-user provisioning command with a timeout
a5a627f fix(template): only downgrade provisioning failure when the image lacks tooling

📊 Changes

2 files changed (+371 additions, -3 deletions)

View changed files

📝 docs/src/concepts/templates.md (+1 -1)
📝 src/template/runner.rs (+370 -2)

📄 Description

Background

We work on miles, an RL training framework, and are integrating AgentENV as a sandbox backend for agentic RL environments through its E2B-compatible API. Running Dockerfile-defined task suites (Harbor tasks) against an AgentENV server via the stock e2b Python SDK, sandboxes came up but every SDK filesystem call failed with:

e2b.exceptions.AuthenticationException: invalid default user: 'user'

Problem

envd resolves SDK operations against the template's default user. E2B Cloud guarantees that account exists through its base images, and the e2b SDK bakes the convention in: from_dockerfile injects USER user whenever a Dockerfile does not set one (dockerfile_parser.py, "Set the user and workdir to the E2B defaults"). Templates built from arbitrary OCI images do not ship that account — ubuntu:24.04 has no user — so the injected default breaks every envd operation that resolves it at runtime.

The chain on the AgentENV side: the template's user metadata lands in config.common.default_user (src/sandbox/firecracker/factory.rs) and is handed to envd at init; envd then rejects operations because the account does not exist in the guest (e2b-dev/infra, packages/envd/internal/permissions/authenticate.go).

Fix

Provision the missing account inside the build sandbox after the build steps finish:

id -u <user> || useradd -m <user> || adduser -D <user>

covering GNU and BusyBox userlands. Deliberate scoping:

Numeric USER values are left alone — Docker allows a UID with no passwd entry.
user:group forms target the account before the colon.
Failure to create is a warning, not a build failure — an image without useradd/adduser built fine before this provisioning existed; only envd calls that resolve the default user will fail, exactly as today.

Alternatives considered: patching envd to fall back to root when the default user is missing (touches the vendored e2b-dev/infra build via tools-image/, and loosens envd's contract for every deployment), or validating at build submission (breaks previously-working builds). Creating the account aligns AgentENV templates with what E2B-compatible clients already assume; happy to rework toward another layer if you prefer.

Validation

cargo test --lib template — 35 passed (new: provisioning skips absent/root/numeric users, creates missing named users, targets the account before the colon, and a failed creation warns without failing the build).
E2E: rebuilt aenv-server with this fix and re-ran a previously failing Harbor task (FROM ubuntu:24.04, no USER instruction, SDK filesystem uploads/downloads) through harbor run -e e2b against the patched server: the previously failing trial now passes end-to-end (verifier reward 1.0). Validated together with #66 on the same rebuilt server; each fix addresses an independent failure the task hits in sequence.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/67 **Author:** [@nblintao](https://github.com/nblintao) **Created:** 7/29/2026 **Status:** ✅ Merged **Merged:** 7/31/2026 **Merged by:** [@LSX-s-Software](https://github.com/LSX-s-Software) **Base:** `main` ← **Head:** `fix/provision-default-user` --- ### 📝 Commits (6) - [`5d0deae`](https://github.com/kvcache-ai/AgentENV/commit/5d0deae8859f6793d2822bfb8d771e8c0b9c9965) fix(template): provision a missing default user at the end of a build - [`b34d9fd`](https://github.com/kvcache-ai/AgentENV/commit/b34d9fd5141254ea782d43ddb0622b6ebf833954) fix(template): provision the default user via /bin/sh - [`9ee24cd`](https://github.com/kvcache-ai/AgentENV/commit/9ee24cd494db558ecbd97645840bc41ced463845) fix(template): validate the account name and propagate executor errors - [`0a0245a`](https://github.com/kvcache-ai/AgentENV/commit/0a0245ae821c1417924308b256149af7977239d2) fix(template): provision the default user's named group as well - [`b5a01df`](https://github.com/kvcache-ai/AgentENV/commit/b5a01df69078ec81129c1e6f232b5312a93f8e9b) fix(template): bound the default-user provisioning command with a timeout - [`a5a627f`](https://github.com/kvcache-ai/AgentENV/commit/a5a627f0dd20fa7853c79749a3f5d036c4f3e252) fix(template): only downgrade provisioning failure when the image lacks tooling ### 📊 Changes **2 files changed** (+371 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `docs/src/concepts/templates.md` (+1 -1) 📝 `src/template/runner.rs` (+370 -2) </details> ### 📄 Description ## Background We work on [miles](https://github.com/radixark/miles), an RL training framework, and are integrating AgentENV as a sandbox backend for agentic RL environments through its E2B-compatible API. Running Dockerfile-defined task suites (Harbor tasks) against an AgentENV server via the stock e2b Python SDK, sandboxes came up but every SDK filesystem call failed with: ``` e2b.exceptions.AuthenticationException: invalid default user: 'user' ``` ## Problem envd resolves SDK operations against the template's default user. E2B Cloud guarantees that account exists through its base images, and the e2b SDK bakes the convention in: `from_dockerfile` injects `USER user` whenever a Dockerfile does not set one (`dockerfile_parser.py`, "Set the user and workdir to the E2B defaults"). Templates built from arbitrary OCI images do not ship that account — `ubuntu:24.04` has no `user` — so the injected default breaks every envd operation that resolves it at runtime. The chain on the AgentENV side: the template's user metadata lands in `config.common.default_user` (`src/sandbox/firecracker/factory.rs`) and is handed to envd at init; envd then rejects operations because the account does not exist in the guest (`e2b-dev/infra`, `packages/envd/internal/permissions/authenticate.go`). ## Fix Provision the missing account inside the build sandbox after the build steps finish: ``` id -u <user> || useradd -m <user> || adduser -D <user> ``` covering GNU and BusyBox userlands. Deliberate scoping: - **Numeric `USER` values are left alone** — Docker allows a UID with no passwd entry. - **`user:group` forms target the account before the colon.** - **Failure to create is a warning, not a build failure** — an image without `useradd`/`adduser` built fine before this provisioning existed; only envd calls that resolve the default user will fail, exactly as today. Alternatives considered: patching envd to fall back to root when the default user is missing (touches the vendored `e2b-dev/infra` build via `tools-image/`, and loosens envd's contract for every deployment), or validating at build submission (breaks previously-working builds). Creating the account aligns AgentENV templates with what E2B-compatible clients already assume; happy to rework toward another layer if you prefer. ## Validation - `cargo test --lib template` — 35 passed (new: provisioning skips absent/root/numeric users, creates missing named users, targets the account before the colon, and a failed creation warns without failing the build). - E2E: rebuilt `aenv-server` with this fix and re-ran a previously failing Harbor task (`FROM ubuntu:24.04`, no `USER` instruction, SDK filesystem uploads/downloads) through `harbor run -e e2b` against the patched server: the previously failing trial now passes end-to-end (verifier reward 1.0). Validated together with #66 on the same rebuilt server; each fix addresses an independent failure the task hits in sequence. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:20:18 +00:00