feat(kubernetes): add agent execution mode, executor-agent, sidecar refactor, GKE Sandbox, image & deps upgrades

.env.example

@@ -32,6 +32,8 @@ API_KEY_CACHE_TTL=300
 RATE_LIMIT_ENABLED=true
 
 # Redis Configuration
+# Deployment mode: standalone (default), cluster, or sentinel
+REDIS_MODE=standalone
 REDIS_HOST=localhost
 REDIS_PORT=6379
 REDIS_PASSWORD=
@@ -42,6 +44,28 @@ REDIS_MAX_CONNECTIONS=20
 REDIS_SOCKET_TIMEOUT=5
 REDIS_SOCKET_CONNECT_TIMEOUT=5
 
+# Optional key prefix — useful when sharing a Redis instance across environments
+# All keys will be stored as <prefix><key>  (e.g. "prod:sessions:abc")
+REDIS_KEY_PREFIX=
+
+# Redis Cluster Mode (REDIS_MODE=cluster)
+# Comma-separated list of host:port pairs for cluster startup nodes
+# REDIS_CLUSTER_NODES=node1:6379,node2:6379,node3:6379
+
+# Redis Sentinel Mode (REDIS_MODE=sentinel)
+# Comma-separated list of host:port pairs for Sentinel instances
+# REDIS_SENTINEL_NODES=sentinel1:26379,sentinel2:26379,sentinel3:26379
+# REDIS_SENTINEL_MASTER=mymaster
+# REDIS_SENTINEL_PASSWORD=
+
+# Redis TLS/SSL Configuration
+# Required for most managed Redis services (GCP Memorystore, AWS ElastiCache, Azure Cache)
+REDIS_TLS_ENABLED=false
+# REDIS_TLS_CA_CERT_FILE=/path/to/ca.crt
+# REDIS_TLS_CERT_FILE=/path/to/client.crt
+# REDIS_TLS_KEY_FILE=/path/to/client.key
+# REDIS_TLS_INSECURE=false
+
 # MinIO/S3 Configuration
 MINIO_ENDPOINT=localhost:9000
 MINIO_ACCESS_KEY=minioadmin
@@ -144,6 +168,37 @@ METRICS_ARCHIVE_RETENTION_DAYS=90
 ENABLE_NETWORK_ISOLATION=true
 ENABLE_FILESYSTEM_ISOLATION=true
 
+# Kubernetes Execution Configuration
+# Execution mode: 'agent' (default, recommended) or 'nsenter' (legacy)
+#   agent:   Executor-agent binary runs inside the main container.
+#            No nsenter, no capabilities, no privilege escalation.
+#            Compatible with GKE Sandbox (gVisor) and restricted Pod Security Standards.
+#   nsenter: Sidecar uses nsenter to enter the main container's mount namespace.
+#            Requires shareProcessNamespace, SYS_PTRACE/SYS_ADMIN/SYS_CHROOT caps,
+#            and allowPrivilegeEscalation: true. NOT compatible with GKE Sandbox.
+K8S_EXECUTION_MODE=agent
+# K8S_EXECUTOR_PORT=9090  # Port for the executor-agent HTTP server (agent mode only)
+
+# Sidecar image — must match the execution mode:
+#   agent mode:   aronmuon/kubecoderun-sidecar-agent:latest   (default)
+#   nsenter mode: aronmuon/kubecoderun-sidecar-nsenter:latest
+# K8S_SIDECAR_IMAGE=aronmuon/kubecoderun-sidecar-agent:latest
+
+# Image pull policy for execution pods (Always, IfNotPresent, Never)
+# K8S_IMAGE_PULL_POLICY=Always
+
+# Image pull secrets for private container registries (comma-separated secret names)
+# These Kubernetes secrets must already exist in the execution namespace.
+# Leave empty or unset if not using private registries.
+# K8S_IMAGE_PULL_SECRETS=my-registry-secret,another-secret
+
+# GKE Sandbox (gVisor) Configuration
+# Requires K8S_EXECUTION_MODE=agent (nsenter is incompatible with gVisor)
+# GKE_SANDBOX_ENABLED=false
+# GKE_SANDBOX_RUNTIME_CLASS=gvisor
+# GKE_SANDBOX_NODE_SELECTOR={}
+# GKE_SANDBOX_CUSTOM_TOLERATIONS=[]
+
 # WAN Network Access Configuration
 # When enabled, execution containers can access the public internet
 # but are blocked from accessing host, other containers, and private networks

.github/workflows/docker-publish.yml

@@ -145,7 +145,7 @@ jobs:
     uses: ./.github/workflows/docker-build-reusable.yml
     secrets: inherit
     with:
-      image_name: kubecoderun-sidecar
+      image_name: kubecoderun-sidecar-agent
       dockerfile: docker/sidecar/Dockerfile
       context: docker/sidecar
       image_tag: ${{ needs.changes.outputs.image_tag }}
@@ -344,7 +344,7 @@ jobs:
     uses: ./.github/workflows/docker-retag-reusable.yml
     secrets: inherit
     with:
-      image_name: kubecoderun-sidecar
+      image_name: kubecoderun-sidecar-agent
       new_tag: ${{ needs.changes.outputs.image_tag }}
       previous_tag: ${{ needs.changes.outputs.previous_tag }}
 

.gitignore

@@ -200,3 +200,5 @@ config/local.py
 
 # Hatch auto-generated version file
 _version.py
+
+.pdm-python

docker/c-cpp.Dockerfile

@@ -1,7 +1,8 @@
 # syntax=docker/dockerfile:1
 # C/C++ execution environment with Docker Hardened Images.
+# Uses -dev variant because compilers and dev libraries must be available at runtime.
 
-FROM dhi.io/debian-base:trixie
+FROM dhi.io/debian-base:trixie-debian13-dev
 
 ARG BUILD_DATE
 ARG VERSION

docker/d.Dockerfile

@@ -1,7 +1,8 @@
 # syntax=docker/dockerfile:1
 # D execution environment with Docker Hardened Images.
+# Uses -dev variant because compilers must be available at runtime.
 
-FROM dhi.io/debian-base:trixie
+FROM dhi.io/debian-base:trixie-debian13-dev
 
 ARG BUILD_DATE
 ARG VERSION

docker/fortran.Dockerfile

@@ -1,7 +1,8 @@
 # syntax=docker/dockerfile:1
 # Fortran execution environment with Docker Hardened Images.
+# Uses -dev variant because compilers and dev libraries must be available at runtime.
 
-FROM dhi.io/debian-base:trixie
+FROM dhi.io/debian-base:trixie-debian13-dev
 
 ARG BUILD_DATE
 ARG VERSION

docker/go.Dockerfile

@@ -3,7 +3,7 @@
 
 ################################
 # Stage 1: Build and download dependencies
-FROM dhi.io/golang:1.25-debian13-dev AS builder
+FROM dhi.io/golang:1.26-debian13-dev AS builder
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -26,7 +26,7 @@ RUN cd /tmp/gosetup && \
 
 ################################
 # Stage 2: Prepare runtime directories
-FROM dhi.io/golang:1.25-debian13-dev AS runtime-deps
+FROM dhi.io/golang:1.26-debian13-dev AS runtime-deps
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -35,7 +35,7 @@ RUN mkdir -p /mnt/data /mnt/data/go-build && chown -R 65532:65532 /mnt/data
 
 ################################
 # Stage 3: Minimal runtime image
-FROM dhi.io/golang:1.25-debian13 AS final
+FROM dhi.io/golang:1.26-debian13 AS final
 
 ARG BUILD_DATE
 ARG VERSION

docker/php.Dockerfile

@@ -2,8 +2,8 @@
 # PHP execution environment with Docker Hardened Images.
 
 # PHP version configuration - single source of truth
-ARG PHP_VERSION=8.4.17
-ARG PHP_MAJOR=8.4
+ARG PHP_VERSION=8.5.3
+ARG PHP_MAJOR=8.5
 ARG DEBIAN_VERSION=debian13
 
 ARG BUILD_DATE

docker/python.Dockerfile

@@ -83,33 +83,34 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN mkdir -p /usr/lib/x86_64-linux-gnu /usr/lib/aarch64-linux-gnu && \
     apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    # Runtime libraries (counterparts to -dev packages in builder)
-    libxml2 \
-    libxslt1.1 \
-    libffi8 \
-    libssl3t64 \
+    # Core System Utilities
+    libgomp1 \
+    liblz4-1 \
+    # Image Processing (Pillow, OpenCV)
+    ffmpeg \
     libjpeg62-turbo \
     libpng16-16t64 \
     libtiff6 \
+    libwebp7 \
     libopenjp2-7 \
-    libfreetype6 \
     liblcms2-2 \
-    libwebp7 \
-    libportaudio2 \
-    libpulse0 \
-    # External tools needed at runtime
+    # XML/HTML Processing (lxml, beautifulsoup4)
+    libxml2 \
+    libxslt1.1 \
+    # Cryptography (cryptography, PyOpenSSL)
+    libffi8 \
+    libssl3t64 \
+    # Font Support (Matplotlib, WordCloud)
+    libfreetype6 \
+    fontconfig \
+    # External Tools (Runtime executables)
     poppler-utils \
-    tesseract-ocr \
-    pandoc \
-    ffmpeg \
-    flac \
-    antiword \
-    unrtf \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* \
     && mkdir -p /mnt/data && chown 65532:65532 /mnt/data
 
+
 ################################
 # Final stage - minimal runtime image
 ################################
@@ -129,13 +130,7 @@ LABEL org.opencontainers.image.title="KubeCodeRun Python Environment" \
 COPY --from=runtime-deps /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu
 COPY --from=runtime-deps /usr/lib/aarch64-linux-gnu /usr/lib/aarch64-linux-gnu
 COPY --from=runtime-deps /usr/bin/pdftotext /usr/bin/pdftoppm /usr/bin/pdfinfo /usr/bin/
-COPY --from=runtime-deps /usr/bin/tesseract /usr/bin/
-COPY --from=runtime-deps /usr/bin/pandoc /usr/bin/
 COPY --from=runtime-deps /usr/bin/ffmpeg /usr/bin/ffprobe /usr/bin/
-COPY --from=runtime-deps /usr/bin/flac /usr/bin/
-COPY --from=runtime-deps /usr/bin/antiword /usr/bin/
-COPY --from=runtime-deps /usr/bin/unrtf /usr/bin/
-COPY --from=runtime-deps /usr/share/tesseract-ocr /usr/share/tesseract-ocr
 
 # Copy installed Python packages from builder
 # DHI Python is installed in /opt/python, not /usr/local

docker/r.Dockerfile

@@ -9,7 +9,7 @@ ARG VCS_REF
 ################################
 # Builder stage - install R and compile packages
 ################################
-FROM dhi.io/debian-base:trixie AS builder
+FROM dhi.io/debian-base:trixie-debian13-dev AS builder
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -40,7 +40,7 @@ RUN R -e "options(repos = c(CRAN = 'https://packagemanager.posit.co/cran/__linux
 ################################
 # Final stage - runtime image
 ################################
-FROM dhi.io/debian-base:trixie AS final
+FROM dhi.io/debian-base:trixie-debian13-dev AS final
 
 ARG BUILD_DATE
 ARG VERSION

docker/requirements/go.mod

@@ -1,18 +1,22 @@
 module preload
 
-go 1.25
+go 1.26
 
 require (
-	github.com/gorilla/mux v1.8.1
+	github.com/davidbyttow/govips/v2 v2.16.0
+	github.com/fatih/color v1.18.0
 	github.com/gin-gonic/gin v1.11.0
-	github.com/sirupsen/logrus v1.9.4
+	github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1
 	github.com/google/uuid v1.6.0
-	github.com/shopspring/decimal v1.4.0
-	gonum.org/v1/gonum v0.17.0
+	github.com/gorilla/mux v1.8.1
 	github.com/montanaflynn/stats v0.7.1
-	github.com/xuri/excelize/v2 v2.10.0
+	github.com/shopspring/decimal v1.4.0
+	github.com/sirupsen/logrus v1.9.4
 	github.com/spf13/cobra v1.10.2
-	github.com/fatih/color v1.18.0
-	github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1
 	github.com/tidwall/gjson v1.18.0
+	github.com/unidoc/unioffice/v2 v2.8.0
+	github.com/xuri/excelize/v2 v2.10.0
+	github.com/yuin/goldmark v1.7.16
+	gonum.org/v1/gonum v0.17.0
+	gopkg.in/yaml.v3 v3.0.1
 )

docker/requirements/nodejs.txt

@@ -1,34 +1,58 @@
-# Node.js global packages
-# One package per line for npm install -g
+# Node.js packages
+# One package per line: npm install -g <package>
 
-lodash
+# Core utilities
+archiver
 axios
-moment
-uuid
 chalk
 commander
-express
-fs-extra
-csv-parser
-json2csv
-papaparse
-archiver
-yauzl
-pdf-lib
+crypto-js
 date-fns
+fs-extra
+lodash
+luxon
+uuid
 validator
-crypto-js
+zod
+
+# Web scraping & parsing
+cheerio
+
+# Data processing
+papaparse
 mathjs
 ml-matrix
 simple-statistics
-sharp
+
+# File formats - Office documents
+exceljs
+xlsx
+pptxgenjs
+mammoth
+
+# File formats - Other
+js-yaml
+marked
+pdf-lib
+
+# Images
 jimp
+sharp
+
+# Compression
+yauzl
+
+# TypeScript (recommended local + global)
 typescript
 ts-node
-xlsx
-exceljs
-luxon
-zod
+@types/node
+
+# Web frameworks
+express
 handlebars
-cheerio
-marked
+
+# UI libraries
+jquery
+jquery-ui-dist
+three
+p5

docker/requirements/python-analysis.txt

@@ -1,19 +1,18 @@
-# Math, science, and analysis packages
-
-scipy>=1.11
-scikit-learn>=1.3
-statsmodels>=0.14
-sympy>=1.12
-mpmath>=1.3
-numba>=0.58
-llvmlite>=0.41
-numexpr>=2.8
-networkx>=3.2
-lifelines>=0.27
-autograd>=1.6
-autograd-gamma>=0.5
-formulaic>=1.0
-patsy>=0.5
-kiwisolver>=1.4
-joblib>=1.3
-threadpoolctl>=3.2
+# Math, science, and analysis
+autograd-gamma>=0.5.0
+autograd>=1.7.0
+formulaic>=1.0.2
+joblib>=1.4.2
+kiwisolver>=1.4.7
+lifelines>=0.30.0
+llvmlite>=0.44.0
+mpmath>=1.3.0
+networkx>=3.4.2
+numba>=0.61.0
+numexpr>=2.10.2
+patsy>=1.0.1
+scikit-learn>=1.7.2
+scipy>=1.16.1
+statsmodels>=0.14.4
+sympy>=1.13.3
+threadpoolctl>=3.5.0