Minor fixes #242

alex-akv · 2026-01-13T12:08:04Z

No description provided.

netlify · 2026-01-13T12:08:11Z

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	`782f53e`
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/697bf6a7355db300083151c5

k8s-ci-robot · 2026-01-13T12:08:15Z

Hi @alex-akv. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

revert

janetkuo

/lgtm

janetkuo · 2026-01-14T00:13:02Z

examples/composing-sandbox-nw-policies/README.md

 * **Using Helm:** Similar to KRO, we can use Helm to create a client side composition of resources and use the helm-cli to manage it.

-This example demonstrates the second approach, using KRO to define a new `AgenticSandbox` CRD that encapsulates a `Sandbox`, a `NetworkPolicy`, and a `Service`.
+This example demonstrates the second approach, using KRO to define a new `AgentSandbox` CRD that encapsulates a `Sandbox`, a `NetworkPolicy`, and a `Service`.


AgenticSandbox is the correct CRD. Please revert changes in this file. This CRD is defined using KRO, see https://github.com/kubernetes-sigs/agent-sandbox/blob/main/examples/composing-sandbox-nw-policies/rgd.yaml#L13

Reverted in commit: b8128d7

To avoid confusion, commit: 689ac3a is there since this change will be updated as agreed in PR from another community member.

Not all changes in this file are reverted. It should use AgenticSandbox instead of AgentSandbox. It is a separate CRD from the core CRD in this example.

Got it, reverted in commit: 369112a

examples/jupyterlab/files/download_models.py

k8s-ci-robot · 2026-01-14T00:18:35Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: alex-akv
Once this PR has been reviewed and has the lgtm label, please ask for approval from janetkuo. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

clients/python/agentic-sandbox-client/OWNERS
examples/OWNERS
site/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

janetkuo · 2026-01-14T00:19:35Z

/ok-to-test

…t-sandbox into minor-fixes

janetkuo · 2026-01-17T01:38:07Z

examples/composing-sandbox-nw-policies/README.md

 # Composing Sandbox with Network Policies

-The `Sandbox` API is a low-level primitive for creating secure sandboxes. In real-world scenarios, you often want to compose a `Sandbox` with other Kubernetes resources, such as `NetworkPolicy`, `Ingress` and `Service`, to create a more complete and secure "agentic sandbox" environment.
+The `Sandbox` API is a low-level primitive for creating secure sandboxes. In real-world scenarios, you often want to compose a `Sandbox` with other Kubernetes resources, such as `NetworkPolicy`, `Ingress` and `Service`, to create a more complete and secure "agent sandbox" environment.


Please keep the original text here.

Reverted the change in commit: f7e48e9

janetkuo · 2026-01-17T01:38:25Z

examples/composing-sandbox-nw-policies/README.md

-kubectl get agenticsandboxes
-kubectl get agenticsandboxes demo -o yaml
+kubectl get AgenticSandboxes
+kubectl get AgenticSandboxes demo -o yaml


It conventional to use lower cases in kubectl commands

Using lower cases in commands now: f7e48e9

janetkuo · 2026-01-17T01:38:32Z

examples/composing-sandbox-nw-policies/README.md


 ```
-kubectl delete agenticsandbox demo
+kubectl delete AgenticSandbox demo


Fixed in commit: f7e48e9

janetkuo · 2026-01-17T01:42:38Z

examples/jupyterlab/jupyterlab-full.yaml

+            - --ip=0.0.0.0
+            - --port=8888
+            - --notebook-dir=/home/jovyan/work
+            - --ServerApp.token=''


This disables authentication, which is a security risk if the pod is exposed.

Warning users about this in commit: 782f53e

janetkuo · 2026-01-17T01:42:58Z

examples/jupyterlab/jupyterlab.yaml

+            - --ip=0.0.0.0
+            - --port=8888
+            - --notebook-dir=/home/jovyan/work
+            - --ServerApp.token=''


Same comment about security risks

Warning users about this in commit: 782f53e

janetkuo · 2026-01-17T01:46:29Z

examples/jupyterlab/jupyterlab-full.yaml

+  namespace: default
+type: Opaque
+stringData:
+  token: "HF_TOKEN"  # Replace with actual token or use --from-literal


It's better to document a kubectl create secret command in the doc rather than providing a Secret manifest here that requires editing.

Updated approach in commit: f7e48e9

janetkuo · 2026-01-17T01:49:53Z

examples/jupyterlab/jupyterlab-full.yaml

+              memory: "4Gi"
+              ephemeral-storage: "1Gi"
+          securityContext:
+            runAsUser: 0  # Need root for chown


Is chown truly needed? Could you instead configure the init container to run as the jovyan user? Something like:

securityContext: runAsUser: 1000

I did exactly that in commit: f7e48e9

barney-s

This is a solid addition to the examples. I have identified several areas for improvement:

Maintainability: The manifests hardcode the Python 3.12 path. This will break if the base image is updated to a newer Python version.
Correctness: The jupyterlab.yaml manifest appears to rely on a ConfigMap that it doesn't define. Also, the initContainer in both manifests is missing PYTHONPATH, which will cause the download script to fail.
Security: The JupyterLab configuration disables XSRF checks and allows all origins. While acceptable for a demo, a warning is warranted.
Consistency: The pre-download script misses the model used in the experiment notebook.

Please review the detailed comments below.

barney-s · 2026-01-20T22:01:39Z

examples/langchain/README.md

 ```

-### 5. Use the Agent
+### 6. Use the Agent


Typo in the following block: interraction should be interaction.

Fixed typo in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/composing-sandbox-nw-policies/README.md

 ```
-kubectl get agenticsandboxes
-kubectl get agenticsandboxes demo -o yaml
+kubectl get AgenticSandboxes


Conventionally, Kubernetes resource names in kubectl commands are lowercase (e.g., agenticsandboxes). Using CamelCase AgenticSandboxes is supported but unusual.

Corrected in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/jupyterlab-full.yaml

+              echo "Installing Python dependencies to persistent storage..."
+              pip install --no-cache-dir \
+                --target=/home/jovyan/.local/lib/python3.12/site-packages \
+                -r /config/requirements.txt


The path /home/jovyan/.local/lib/python3.12/site-packages hardcodes the Python version (3.12). If the base image jupyterhub/k8s-singleuser-sample is updated to a version with a different Python version, this path will be incorrect. Consider determining the path dynamically or ensuring it matches the image's Python version.

Pushed the change in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/jupyterlab-full.yaml

+                -r /config/requirements.txt
+
+              python /config/download_models.py /home/jovyan/.cache/huggingface
+


The initContainer installs packages to a custom target directory but does not set PYTHONPATH to include it. The execution of download_models.py (which imports huggingface_hub) will likely fail with an ImportError. Please add PYTHONPATH to the initContainer environment variables.

Addressed in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/jupyterlab-full.yaml

+              echo "Initialization complete!"
+          env:
+            - name: HF_TOKEN
+              valueFrom:


The path /home/jovyan/.cache/huggingface is repeated in the command arguments. Consider using the $HF_HOME environment variable in the command for better maintainability (e.g., python ... $HF_HOME).

Corrected in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/jupyterlab.yaml

+              echo "Installing Python dependencies to persistent storage..."
+              pip install --no-cache-dir \
+                --target=/home/jovyan/.local/lib/python3.12/site-packages \
+                -r /config/requirements.txt


Hardcoded Python version python3.12. See comment on jupyterlab-full.yaml.

Fixed in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/jupyterlab.yaml

+                -r /config/requirements.txt
+
+              python /config/download_models.py /home/jovyan/.cache/huggingface
+


Missing PYTHONPATH in initContainer. See comment on jupyterlab-full.yaml.

Taken care of in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/jupyterlab.yaml

+
+      volumes:
+        - name: init-files
+          configMap:


This manifest references a ConfigMap named jupyter-init-files in the volumes section, but unlike jupyterlab-full.yaml, this ConfigMap is not defined in this file. If applied as is, the Pod will fail to start. Please document that the ConfigMap must be created separately or include it here.

This is intended - jupyterlab-full.yaml is including all the configmaps in it's yaml, while jupyterlab.yaml is minimalistic and istructs users in the README.md -> Method B: Modular Deployment -> to create the configmap using kubectl. Added comment on top of the jupyterlab.yaml in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/files/download_models.py

+
+if __name__ == "__main__":
+    model_names = [
+        "Qwen/Qwen3-Embedding-0.6B",


This script only downloads Qwen/Qwen3-Embedding-0.6B. However, experiment.ipynb uses distilbert-base-uncased-finetuned-sst-2-english. If the sandbox is run in an environment without internet access, the experiment notebook will fail. Consider adding the model used in the experiment to this pre-download list.

Added missing model in commit: f7e48e9

barney-s · 2026-01-20T22:01:39Z

examples/jupyterlab/files/welcome.ipynb

+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": 5,


The notebook contains execution outputs. It is generally recommended to clear outputs before committing notebooks to version control to keep the diff clean and reduce repository size.

Removed outputs in commit: f7e48e9

k8s-ci-robot · 2026-01-30T00:09:27Z

@alex-akv: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
presubmit-test-autogen-up-to-date	`782f53e`	link	true	`/test presubmit-test-autogen-up-to-date`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

alex-akv and others added 4 commits December 26, 2025 03:18

Applying several minor fixes in the guides

b01ecc9

Applying several minor fixes in the guides

e0ff71a

Applying several minor fixes in the guides

e9a8033

Merge branch 'kubernetes-sigs:main' into minor-fixes

bf5016b

k8s-ci-robot requested review from barney-s and janetkuo January 13, 2026 12:08

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 13, 2026

k8s-ci-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jan 13, 2026

Fix typo in gVisor guide description

1900ac6

revert

janetkuo approved these changes Jan 14, 2026

View reviewed changes

k8s-ci-robot assigned janetkuo Jan 14, 2026

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jan 14, 2026

janetkuo removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 14, 2026

janetkuo reviewed Jan 14, 2026

View reviewed changes

janetkuo requested changes Jan 14, 2026

View reviewed changes

examples/jupyterlab/files/download_models.py Show resolved Hide resolved

k8s-ci-robot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 14, 2026

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 14, 2026

alex-akv added 3 commits January 14, 2026 18:24

Revert for AgenticSandbox

b8128d7

Merge branch 'minor-fixes' of https://github.com/volatilemolotov/agen…

689ac3a

…t-sandbox into minor-fixes

Revert for AgenticSandbox

369112a

janetkuo reviewed Jan 17, 2026

View reviewed changes

barney-s reviewed Jan 22, 2026

View reviewed changes

Applying multiple fixes for comment resolution

f7e48e9

Updating warning with info about authentication

782f53e

		-r /config/requirements.txt

		python /config/download_models.py /home/jovyan/.cache/huggingface

Minor fixes #242

Are you sure you want to change the base?

Minor fixes #242

Uh oh!

Conversation

alex-akv commented Jan 13, 2026

Uh oh!

netlify bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for agent-sandbox canceled.

Uh oh!

k8s-ci-robot commented Jan 13, 2026

Uh oh!

janetkuo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

janetkuo Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

k8s-ci-robot commented Jan 14, 2026

Uh oh!

janetkuo commented Jan 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alex-akv Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barney-s left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

netlify bot commented Jan 13, 2026 •

edited

Loading

janetkuo Jan 14, 2026 •

edited

Loading

alex-akv Jan 30, 2026 •

edited

Loading

k8s-ci-robot commented Jan 30, 2026 •

edited

Loading