Cloud IDE (ide-ubuntu)
OpenVSCode browser IDE with baked agent CLIs; LLM via KeyHive or LLM Gateway per SANDBOX_LLM_EGRESS.
The ide-ubuntu profile is a Cloud IDE for trainers — not a bare remote editor.
Create and open
curl -fsS -H "X-Api-Key: $SANDBOX_API_KEY" \
-H "X-Sandbox-Tenant-Id: $TENANT" \
-H "X-Sandbox-Project-Id: $PROJECT" \
-H "Content-Type: application/json" \
-d '{"profile":"ide-ubuntu","autostop_sec":7200,"ttl_sec":28800}' \
"$SANDBOX_GATEWAY_URL/sandbox/sandboxes/v1"Dev testing: use ctp / sandbox headers. LLM credentials follow
SANDBOX_LLM_EGRESS: KeyHive may inject provider keys when direct; Gateway mode
uses URL hints and trainer→Gateway auth.
Poll until status=running, then open viewer.url (viewer.mode=openvscode).
Workspace and durability
Only /workspace is durable (PVC + GCS). Home and system paths are ephemeral.
Autosave checkpoints run every 15 minutes when the workspace changed (SANDBOX_WORKSPACE_AUTOSAVE_SEC).
Agents and the integrated terminal
Cloud IDE is one remote environment (like Codespaces). No baked platform CLI — the integrated terminal is the default surface for trainers.
Terminal CLIs (claude, opencode, codex) plus pre-installed Claude Code and Codex
sidebar extensions. Built-in OpenVSCode agent chat stays off.
| Path | When |
|---|---|
| Integrated terminal | claude, opencode run …, codex exec … — KeyHive keys or Gateway tokens per mode |
| VS Code Tasks | Terminal → Run Task |
| Agent attach (L4) | POST /sandbox/agent/v1/runs with sandbox_id — orchestration from product UI |
| Harbor / CodeEdit API | curl from terminal only if you export gateway URL + API key; trials run on separate pods |
Interactive work stays in workspace mode (one session slot). Full Harbor eval is eval mode — same HTTP API as from CI or Postman, not a special IDE integration. The platform does not inject gateway API keys into IDE pods.
Repo detail: CLOUD_IDE.md.
Quota
Each running IDE session uses one slot on the project concurrency cap (GET /sandbox/v1/quota).
Terminal agents do not add slots; Harbor jobs from curl do. Stop the sandbox to free capacity.
See Errors and limits.
Autoscaling
sandbox-sandboxesservice — CPU autoscaling (same HPA pattern as gateway) for create/viewer API load.- Session pods — one pod per user in
sandbox-jobs; bounded by namespace ResourceQuota and per-project L2 admit, not by HPA. ide-ubuntu— no warm pool; burst = cold starts.
Repo: CLOUD_IDE.md — Autoscaling and capacity.
LLM credentials (ADR 0020)
Sandbox does not inject ANTHROPIC_API_KEY / OPENAI_API_KEY. User → LLM Gateway
for BYOK, budgets, and usage. Sandbox /admin/credential-plane/* and /admin/keyhive/*
return HTTP 410.
Clipboard
Default paste-in-only: trainers can paste instructions in; copy/cut out is blocked
(best-effort).
Verify
SANDBOX_TENANT_ID=ctp SANDBOX_PROJECT_ID=sandbox \
SANDBOX_GATEWAY_URL=... SANDBOX_API_KEY=... \
bash scripts/verify-viewer-ide-dev.shRelated
- Desktop sandboxes
- Agent runs
- Repo:
docs/sandbox/desktop/CLOUD_IDE.md