[Feat] Azure Container Apps Sandboxes compute provider

.changeset/aca-sandboxes-compute-provider.md

@@ -0,0 +1,5 @@
+---
+'@roomote/web': minor
+---
+
+Add Azure Container Apps Sandboxes (preview) as a compute provider: sandboxes run as hardware-isolated microVMs with memory+disk snapshots, sub-second suspend/resume standby, deterministic preview URLs with on-demand wake, and configurable sandbox size (XS–XL) and egress TLS inspection. The worker disk image can be provisioned automatically during setup, including from private registries. Auth via service principal, managed identity, or ambient az login.

SELF_HOSTING.md

@@ -737,9 +737,46 @@ BL_API_KEY=...
 BL_WORKSPACE=...
 # Optional prebuilt Blaxel image override
 BLAXEL_IMAGE=sandbox/roomote-worker:<version>
-```
 
-`E2B_TEMPLATE_ID`, `DAYTONA_SNAPSHOT_NAME`, and `BLAXEL_IMAGE` can also be provisioned
+# Azure Container Apps (preview)
+DEFAULT_COMPUTE_PROVIDER=azure
+AZURE_SUBSCRIPTION_ID=...
+AZURE_RESOURCE_GROUP=...
+AZURE_SANDBOX_GROUP=...
+AZURE_SANDBOX_REGION=...
+AZURE_SANDBOX_DISK_IMAGE=...
+# Optional: user-assigned managed identity client ID for Azure-hosted
+# controllers; omit to use the ambient Azure credential chain
+AZURE_CLIENT_ID=...
+# Optional (recommended for Docker installs): service principal auth —
+# all three together. az login inside containers is impractical, so
+# Docker/compose deployments should use this or a managed identity.
+AZURE_TENANT_ID=...
+AZURE_CLIENT_ID=<service-principal-app-id>
+AZURE_CLIENT_SECRET=...
+# Optional: pull credentials for baking the worker disk image from a private
+# registry (GHCR: token owner's GitHub username + PAT with read:packages)
+AZURE_SANDBOX_REGISTRY_USERNAME=...
+AZURE_SANDBOX_REGISTRY_TOKEN=...
+```
+
+Azure auth uses the ambient Azure credential chain instead of an API key:
+`az login` for local runs, or a managed identity (optionally user-assigned via
+`AZURE_CLIENT_ID`) when the controller itself runs in Azure. Containerized
+installs (docker compose, including `deploy/install.sh`) cannot use `az
+login` inside the container — configure the service principal triple
+(`AZURE_TENANT_ID`/`AZURE_CLIENT_ID`/`AZURE_CLIENT_SECRET`), created with
+`az ad sp create-for-rbac --name <name> --skip-assignment` plus a
+`Container Apps SandboxGroup Data Owner` role assignment on the sandbox
+group, or run the controller on an Azure VM with a managed identity. One-time sandbox
+group bootstrap: `aca sandboxgroup create --name <group> --location <region>
+--set-config` — the calling principal is granted the Container Apps
+SandboxGroup Data Owner role automatically; grant it explicitly to any
+additional principal (for example a deployed controller's managed identity).
+Azure Container Apps sandboxes are in public preview, so expect API drift.
+
+`E2B_TEMPLATE_ID`, `DAYTONA_SNAPSHOT_NAME`, `BLAXEL_IMAGE`, and
+`AZURE_SANDBOX_DISK_IMAGE` can also be provisioned
 automatically during setup when a registry-qualified `DOCKER_WORKER_IMAGE`
 is configured — the setup wizard and the Settings → Sandboxes page build the
 worker base artifact in your provider account after credentials are saved.

apps/bullmq/src/scheduled-jobs/sleep-check.ts

@@ -167,6 +167,11 @@ async function createSleepCheckClient(provider: ComputeProvider) {
         provider: 'blaxel',
         envFallback: await resolveComputeProviderEnvValues('blaxel'),
       });
+    case 'azure':
+      return createComputeProviderClient({
+        provider: 'azure',
+        envFallback: await resolveComputeProviderEnvValues('azure'),
+      });
     case 'docker':
       return createComputeProviderClient({ provider: 'docker' });
     default:

apps/bullmq/src/scheduled-jobs/standby-retention.ts

@@ -13,7 +13,7 @@ import { activeRunStatuses, type RunStatus } from '@roomote/types';
 
 const LOG_PREFIX = '[standbyRetention]';
 const MS_PER_HOUR = 60 * 60 * 1_000;
-const STANDBY_PROVIDERS = ['docker', 'blaxel'] as const;
+const STANDBY_PROVIDERS = ['docker', 'blaxel', 'azure'] as const;
 
 type StandbyProvider = (typeof STANDBY_PROVIDERS)[number];
 
@@ -42,6 +42,8 @@ export function selectStandbyEvictions(
 const DEFAULT_POLICY = {
   docker: { maxCount: 10, maxAgeHours: 24 },
   blaxel: { maxCount: 25, maxAgeHours: 168 },
+  // Suspended ACA sandboxes cost almost nothing, so azure retention is generous.
+  azure: { maxCount: 50, maxAgeHours: 720 },
 } as const;
 
 function parsePolicyInteger(
@@ -63,7 +65,12 @@ export function resolveStandbyRetentionPolicy(
   maxCount: number;
   maxAgeMs: number;
 } {
-  const prefix = provider === 'docker' ? 'DOCKER' : 'BLAXEL';
+  const prefix =
+    provider === 'docker'
+      ? 'DOCKER'
+      : provider === 'azure'
+        ? 'AZURE'
+        : 'BLAXEL';
   const defaults = DEFAULT_POLICY[provider];
   const maxCount = parsePolicyInteger(
     env[`${prefix}_STANDBY_MAX_COUNT`],
@@ -74,7 +81,9 @@ export function resolveStandbyRetentionPolicy(
     env[`${prefix}_STANDBY_MAX_AGE_HOURS`],
     defaults.maxAgeHours,
     1,
-    168,
+    // Providers with a higher default keep their ceiling (azure: 720h);
+    // others stay capped at 168h as before.
+    Math.max(168, defaults.maxAgeHours),
   );
 
   return { maxCount, maxAgeMs: maxAgeHours * MS_PER_HOUR };
@@ -85,6 +94,13 @@ async function createClient(provider: StandbyProvider) {
     return createComputeProviderClient({ provider: 'docker' });
   }
 
+  if (provider === 'azure') {
+    return createComputeProviderClient({
+      provider: 'azure',
+      envFallback: await resolveComputeProviderEnvValues('azure'),
+    });
+  }
+
   return createComputeProviderClient({
     provider: 'blaxel',
     envFallback: await resolveComputeProviderEnvValues('blaxel'),

apps/controller/src/RoomoteController.ts

@@ -21,6 +21,7 @@ import {
   DOCKER_SPAWN_TIMEOUT_MS,
   spawnE2bWorker,
   spawnBlaxelWorker,
+  spawnAzureWorker,
   spawnModalWorker,
 } from './compute-providers';
 
@@ -306,6 +307,60 @@ export class RoomoteController extends BaseController {
         });
         return;
       }
+      case 'azure': {
+        const azureSubscriptionId = resolvedEnv.AZURE_SUBSCRIPTION_ID;
+        const azureResourceGroup = resolvedEnv.AZURE_RESOURCE_GROUP;
+        const azureSandboxGroup = resolvedEnv.AZURE_SANDBOX_GROUP;
+        const azureRegion = resolvedEnv.AZURE_SANDBOX_REGION;
+        const azureDiskImage = resolvedEnv.AZURE_SANDBOX_DISK_IMAGE;
+
+        if (!azureSubscriptionId) {
+          throw new Error(
+            'AZURE_SUBSCRIPTION_ID is required to spawn Azure workers',
+          );
+        }
+
+        if (!azureResourceGroup) {
+          throw new Error(
+            'AZURE_RESOURCE_GROUP is required to spawn Azure workers',
+          );
+        }
+
+        if (!azureSandboxGroup) {
+          throw new Error(
+            'AZURE_SANDBOX_GROUP is required to spawn Azure workers',
+          );
+        }
+
+        if (!azureRegion) {
+          throw new Error(
+            'AZURE_SANDBOX_REGION is required to spawn Azure workers',
+          );
+        }
+
+        if (!azureDiskImage) {
+          throw new Error(
+            'AZURE_SANDBOX_DISK_IMAGE is required to spawn Azure workers',
+          );
+        }
+
+        await spawnAzureWorker(taskRun, authToken, {
+          deploymentSlug,
+          azureTags: this.buildSandboxTags(),
+          azureSubscriptionId,
+          azureResourceGroup,
+          azureSandboxGroup,
+          azureRegion,
+          azureDiskImage,
+          azureClientId: resolvedEnv.AZURE_CLIENT_ID,
+          azureTenantId: resolvedEnv.AZURE_TENANT_ID,
+          azureClientSecret: resolvedEnv.AZURE_CLIENT_SECRET,
+          azureSize: resolvedEnv.AZURE_SANDBOX_SIZE,
+          azureTimeoutMs: timeoutMs,
+          localTarballPath: this.localWorkerReleasePath,
+        });
+        return;
+      }
       default: {
         const _exhaustive: never = provider;
         throw new Error(`Unsupported compute provider: ${_exhaustive}`);

apps/controller/src/compute-providers/index.ts

@@ -7,3 +7,4 @@ export { cleanupStaleDockerSandboxes } from './docker-sandbox-security';
 export { spawnDaytonaWorker } from './spawn-daytona-worker';
 export { spawnE2bWorker } from './spawn-e2b-worker';
 export { spawnBlaxelWorker } from './spawn-blaxel-worker';
+export { spawnAzureWorker } from './spawn-azure-worker';