Skip to content

feat(sandbox): add Aliyun AgentRun sandbox client #3732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
iridescentWen wants to merge 1 commit into from
Closed

feat(sandbox): add Aliyun AgentRun sandbox client #3732

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/ref/extensions/sandbox/aliyun/sandbox.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# `Sandbox`

::: agents.extensions.sandbox.aliyun.sandbox
3 changes: 3 additions & 0 deletions docs/sandbox/clients.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ For provider-specific setup notes and links for the checked-in extension example

| Client | Install | Example |
| --- | --- | --- |
| `AliyunSandboxClient` | `openai-agents[aliyun]` | [Aliyun runner](https://github.com/openai/openai-agents-python/blob/main/examples/sandbox/extensions/aliyun_runner.py) |
| `BlaxelSandboxClient` | `openai-agents[blaxel]` | [Blaxel runner](https://github.com/openai/openai-agents-python/blob/main/examples/sandbox/extensions/blaxel_runner.py) |
| `CloudflareSandboxClient` | `openai-agents[cloudflare]` | [Cloudflare runner](https://github.com/openai/openai-agents-python/blob/main/examples/sandbox/extensions/cloudflare_runner.py) |
| `DaytonaSandboxClient` | `openai-agents[daytona]` | [Daytona runner](https://github.com/openai/openai-agents-python/blob/main/examples/sandbox/extensions/daytona/daytona_runner.py) |
Expand All @@ -114,6 +115,7 @@ Hosted sandbox clients expose provider-specific mount strategies. Choose the bac
| `E2BSandboxClient` | Supports rclone-backed cloud storage mounts with `E2BCloudBucketMountStrategy`; use it with `S3Mount`, `GCSMount`, `R2Mount`, `AzureBlobMount`, and `BoxMount`. |
| `RunloopSandboxClient` | Supports rclone-backed cloud storage mounts with `RunloopCloudBucketMountStrategy`; use it with `S3Mount`, `GCSMount`, `R2Mount`, `AzureBlobMount`, and `BoxMount`. |
| `VercelSandboxClient` | No hosted-specific mount strategy is currently exposed. Use manifest files, repos, or other workspace inputs instead. |
| `AliyunSandboxClient` | No hosted-specific mount strategy is currently exposed. AgentRun also does not expose tunneled ports. Use manifest files or workspace inputs instead. |

</div>

Expand All @@ -131,6 +133,7 @@ The table below summarizes which remote storage entries each backend can mount d
| `E2BSandboxClient` | ✓ | ✓ | ✓ | ✓ | ✓ | - |
| `RunloopSandboxClient` | ✓ | ✓ | ✓ | ✓ | ✓ | - |
| `VercelSandboxClient` | - | - | - | - | - | - |
| `AliyunSandboxClient` | - | - | - | - | - | - |

</div>

Expand Down
57 changes: 55 additions & 2 deletions examples/sandbox/extensions/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ They intentionally keep the flow simple:

1. Build a tiny manifest in memory.
2. Create a `SandboxAgent` that inspects that workspace through one shell tool.
3. Run the agent against E2B, Modal, Daytona, Cloudflare, Runloop, Blaxel, or Vercel.
3. Run the agent against E2B, Modal, Daytona, Cloudflare, Runloop, Blaxel, Vercel, or Aliyun.

All of these examples require `OPENAI_API_KEY`, because they call the model through the normal `Runner` path. Each cloud backend also needs its own provider credentials.

Expand Down Expand Up @@ -350,4 +350,57 @@ The runner also includes standalone demos for individual features. Pass
- `pty` -- agent-driven interactive Python session via PTY
- `drive` -- [Blaxel Drive mount](https://docs.blaxel.ai/Agent-drive/Overview) (persistent storage, requires `--drive-name`)

Blaxel sandboxes support cloud bucket mounts (S3, R2, GCS) through `BlaxelCloudBucketMountStrategy` and persistent drive mounts through `BlaxelDriveMountStrategy`. See the [Blaxel Drive docs](https://docs.blaxel.ai/Agent-drive/Overview) for details.
Blaxel sandboxes support cloud bucket mounts (S3, R2, GCS) through
`BlaxelCloudBucketMountStrategy` and persistent drive mounts through
`BlaxelDriveMountStrategy`. See the
[Blaxel Drive docs](https://docs.blaxel.ai/Agent-drive/Overview) for details.

## Aliyun

### Setup

Install the repo extra:

```bash
uv sync --extra aliyun
```

Create an Alibaba Cloud account, enable AgentRun, and obtain access credentials.
The official references are:

- <https://www.alibabacloud.com/help/en/agentrun>
- <https://help.aliyun.com/document_detail/2839106.html>

Export the required environment variables:

```bash
export OPENAI_API_KEY=...
export ALIBABA_CLOUD_ACCESS_KEY_ID=...
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
Comment on lines +377 to +379

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Require an AgentRun account id in the Aliyun setup

Following the documented setup with only ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET passes the runner's credential check, but the AgentRun SDK still needs an account id (or an explicit data endpoint) to construct the data-plane endpoint before sandbox creation. Users who copy these required env vars will fail later with a configuration error; include AGENTRUN_ACCOUNT_ID/equivalent here and enforce it in the runner unless --api-key/data-endpoint auth is being used.

Useful? React with 👍 / 👎.

@iridescentWen iridescentWen Jul 6, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 76c1d207. Confirmed the SDK's Config.get_data_endpoint() builds https://{account_id}.agentrun-data.{region}.aliyuncs.com and get_account_id() raises account id is not set when it's missing and no data endpoint is set. Updated the README setup to export AGENTRUN_ACCOUNT_ID (or FC_ACCOUNT_ID / AGENTRUN_DATA_ENDPOINT, or --account-id), and _require_aliyun_credentials in the runner now enforces an account id (or data endpoint) up front with a clear message instead of letting users fail later at sandbox creation.

# AgentRun builds its data-plane endpoint from the account id, so set one of these
# (or pass `--account-id`) — otherwise sandbox creation fails with "account id is not set":
export AGENTRUN_ACCOUNT_ID=... # or FC_ACCOUNT_ID, or AGENTRUN_DATA_ENDPOINT
```

`agentrun-sdk` resolves credentials through the standard Alibaba Cloud
credential providers, so any of the supported credential sources (env vars,
config file, RAM role) will work. You can also pass credentials explicitly via
CLI flags below.

### Run

```bash
uv run python examples/sandbox/extensions/aliyun_runner.py --stream
```

Useful flags:

- `--region cn-hangzhou` -- AgentRun region. Default `cn-hangzhou`.
- `--template-name code-interpreter` -- AgentRun template to launch.
- `--sandbox-idle-timeout-seconds 3600` -- Idle timeout before the remote sandbox is reclaimed.
- `--access-key-id` / `--access-key-secret` / `--account-id` / `--api-key` -- override credentials per run.
- `--stream` -- stream model output to the terminal.

The Aliyun example stays on the non-PTY path. It covers command execution,
workspace materialization, and stop/resume persistence. AgentRun does not
currently expose tunneled ports or hosted-specific mount strategies.
Loading