[PR #159] [MERGED] fix(gateway): proxy sandbox-routed envd metrics requests #216

New issue

Closed

opened 2026-10-29 14:21:06 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:21:06 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/159
Author: @feimingxliu
Created: 8/12/2026
Status: ✅ Merged
Merged: 8/17/2026
Merged by: @LSX-s-Software

Base: main ← Head: fix/gateway-envd-metrics

📝 Commits (1)

b1e9b0e fix(gateway): proxy sandbox-routed metrics requests

📊 Changes

4 files changed (+169 additions, -76 deletions)

View changed files

📝 services/gateway/internal/metrics.go (+5 -5)
📝 services/gateway/internal/metrics_test.go (+62 -0)
📝 services/gateway/internal/server.go (+10 -7)
📝 services/gateway/internal/server_test.go (+92 -64)

📄 Description

What

Allow exact /metrics requests carrying sandbox routing headers to follow the existing Gateway -> runtime node -> sandbox proxy path.
Allow host-based sandbox proxy domains to route /metrics to the selected sandbox port.
Keep unrouted /metrics unavailable on the Gateway public HTTP listener.
Include sandbox-routed /metrics requests in Gateway HTTP instrumentation while continuing to skip the local reserved endpoint.

Why

The Gateway currently returns 404 for every exact /metrics request before it parses host routing, sandbox headers, or scheduler bindings. This blocks the existing envd GET /metrics endpoint even when the caller supplies a valid sandbox ID and target port.

The runtime node proxy already supports the remaining path: the Gateway prefixes the request as /proxy/metrics, and the node strips /proxy before forwarding it to the sandbox interaction IP and requested port.

Closes #151

Related but not equivalent: #5 tracks the unimplemented E2B sandbox metrics API. This PR only fixes generic proxy access to the existing raw envd endpoint.

Scope and non-goals

Included:

Gateway classification for exact /health and /metrics reserved paths.
Header-based and host-based sandbox routing for /metrics.
Stable local and malformed-request behavior.
Gateway HTTP instrumentation classification.

Not included:

E2B GET /sandboxes/{sandboxID}/metrics or aggregate sandbox metrics endpoints.
Changes to envd, scheduler APIs, node proxy behavior, or Prometheus listener configuration.
New authentication, configuration, or generated protocol surface.

Design and behavior changes

For exact /health and /metrics, the Gateway now resolves the routing boundary before choosing local behavior:

sandbox headers or proxy host
  -> LookupNode
  -> runtime node /proxy/{path}
  -> sandbox service on the requested port

no sandbox route
  -> /health: 204 from the Gateway
  -> /metrics: 404 from the Gateway public HTTP listener

A routing header set that omits the sandbox ID continues to return 400. Invalid host-based routes continue through the existing proxy error mapping.

Gateway Prometheus metrics remain on the separate metrics listener, default :9102; this PR does not expose them from the public HTTP listener.

Compatibility and operations

Public API or generated protocol: no schema or generated-code changes.
Configuration or defaults: unchanged.
Snapshot manifest, artifact layout, or storage format: unchanged.
Upgrade and rollback: behavior-only Gateway change; rollback restores the previous unconditional 404.
Host requirements, permissions, ports, or dependencies: unchanged.

Validation

make fmt
make clippy
make test-unit
Relevant Rust integration tests
make -C services test (required when services/ changes)
Generated clients/server regenerated with the documented make target
Documentation updated
Benchmarks or performance comparison completed

Commands and results:

go test ./gateway/internal
ok   agentenv/services/gateway/internal

make -C services test
PASS: gateway and scheduler packages

make -C services fmt-check
PASS

make -C services vet
PASS

git diff --check
PASS

Skipped checks and reasons:

Rust formatting, clippy, unit, and integration checks: no Rust code changed.
Generated clients/server: no OpenAPI or protobuf source changed.
Documentation: existing proxy documentation already states that header-routed and host-routed sandbox requests forward their original paths; this fix makes /metrics conform to that contract.
Benchmarks: request classification adds no new I/O or algorithmic path.

Risks and reviewer notes

The main compatibility boundary is preserving the reserved local endpoints. Tests verify:

header-routed /health and /metrics reach /proxy/health and /proxy/metrics on the selected runtime node;
host-routed /health and /metrics inject the sandbox ID and target port;
unrouted /metrics remains 404;
target-port-only /health and /metrics remain 400;
only local /health and /metrics bypass Gateway HTTP instrumentation.

Checklist

The PR contains one coherent change and no unrelated formatting or refactoring.
New behavior is covered by tests, or I explained why testing is impractical.
Logs and examples contain no credentials, tokens, or private registry information.
I did not manually edit generated code without updating its source and regenerating it.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/159 **Author:** [@feimingxliu](https://github.com/feimingxliu) **Created:** 8/12/2026 **Status:** ✅ Merged **Merged:** 8/17/2026 **Merged by:** [@LSX-s-Software](https://github.com/LSX-s-Software) **Base:** `main` ← **Head:** `fix/gateway-envd-metrics` --- ### 📝 Commits (1) - [`b1e9b0e`](https://github.com/kvcache-ai/AgentENV/commit/b1e9b0ef6702b37fa57fa0ff57bc5cd8e6ed4437) fix(gateway): proxy sandbox-routed metrics requests ### 📊 Changes **4 files changed** (+169 additions, -76 deletions) <details> <summary>View changed files</summary> 📝 `services/gateway/internal/metrics.go` (+5 -5) 📝 `services/gateway/internal/metrics_test.go` (+62 -0) 📝 `services/gateway/internal/server.go` (+10 -7) 📝 `services/gateway/internal/server_test.go` (+92 -64) </details> ### 📄 Description ## What - Allow exact `/metrics` requests carrying sandbox routing headers to follow the existing Gateway -> runtime node -> sandbox proxy path. - Allow host-based sandbox proxy domains to route `/metrics` to the selected sandbox port. - Keep unrouted `/metrics` unavailable on the Gateway public HTTP listener. - Include sandbox-routed `/metrics` requests in Gateway HTTP instrumentation while continuing to skip the local reserved endpoint. ## Why The Gateway currently returns 404 for every exact `/metrics` request before it parses host routing, sandbox headers, or scheduler bindings. This blocks the existing envd `GET /metrics` endpoint even when the caller supplies a valid sandbox ID and target port. The runtime node proxy already supports the remaining path: the Gateway prefixes the request as `/proxy/metrics`, and the node strips `/proxy` before forwarding it to the sandbox interaction IP and requested port. ## Related issue Closes #151 Related but not equivalent: #5 tracks the unimplemented E2B sandbox metrics API. This PR only fixes generic proxy access to the existing raw envd endpoint. ## Scope and non-goals Included: - Gateway classification for exact `/health` and `/metrics` reserved paths. - Header-based and host-based sandbox routing for `/metrics`. - Stable local and malformed-request behavior. - Gateway HTTP instrumentation classification. Not included: - E2B `GET /sandboxes/{sandboxID}/metrics` or aggregate sandbox metrics endpoints. - Changes to envd, scheduler APIs, node proxy behavior, or Prometheus listener configuration. - New authentication, configuration, or generated protocol surface. ## Design and behavior changes For exact `/health` and `/metrics`, the Gateway now resolves the routing boundary before choosing local behavior: ```text sandbox headers or proxy host -> LookupNode -> runtime node /proxy/{path} -> sandbox service on the requested port no sandbox route -> /health: 204 from the Gateway -> /metrics: 404 from the Gateway public HTTP listener ``` A routing header set that omits the sandbox ID continues to return 400. Invalid host-based routes continue through the existing proxy error mapping. Gateway Prometheus metrics remain on the separate metrics listener, default `:9102`; this PR does not expose them from the public HTTP listener. ## Compatibility and operations - Public API or generated protocol: no schema or generated-code changes. - Configuration or defaults: unchanged. - Snapshot manifest, artifact layout, or storage format: unchanged. - Upgrade and rollback: behavior-only Gateway change; rollback restores the previous unconditional 404. - Host requirements, permissions, ports, or dependencies: unchanged. ## Validation - [ ] `make fmt` - [ ] `make clippy` - [ ] `make test-unit` - [ ] Relevant Rust integration tests - [x] `make -C services test` (required when `services/` changes) - [ ] Generated clients/server regenerated with the documented `make` target - [ ] Documentation updated - [ ] Benchmarks or performance comparison completed Commands and results: ```text go test ./gateway/internal ok agentenv/services/gateway/internal make -C services test PASS: gateway and scheduler packages make -C services fmt-check PASS make -C services vet PASS git diff --check PASS ``` Skipped checks and reasons: - Rust formatting, clippy, unit, and integration checks: no Rust code changed. - Generated clients/server: no OpenAPI or protobuf source changed. - Documentation: existing proxy documentation already states that header-routed and host-routed sandbox requests forward their original paths; this fix makes `/metrics` conform to that contract. - Benchmarks: request classification adds no new I/O or algorithmic path. ## Risks and reviewer notes The main compatibility boundary is preserving the reserved local endpoints. Tests verify: - header-routed `/health` and `/metrics` reach `/proxy/health` and `/proxy/metrics` on the selected runtime node; - host-routed `/health` and `/metrics` inject the sandbox ID and target port; - unrouted `/metrics` remains 404; - target-port-only `/health` and `/metrics` remain 400; - only local `/health` and `/metrics` bypass Gateway HTTP instrumentation. ## Checklist - [x] The PR contains one coherent change and no unrelated formatting or refactoring. - [x] New behavior is covered by tests, or I explained why testing is impractical. - [x] Logs and examples contain no credentials, tokens, or private registry information. - [x] I did not manually edit generated code without updating its source and regenerating it. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:21:06 +00:00