feat(orch): add envd-version to LaunchDarkly sandbox context

[jakubno]

Enables targeting freeze-user-cgroup and other sandbox flags by the guest envd version.

[cursor]

PR Summary

Low Risk
Changes only how LaunchDarkly contexts are built for flag evaluation; pause/checkpoint may see richer targeting than before but no auth or persistence logic changes.

Overview
LaunchDarkly sandbox targeting now includes envd version alongside template, kernel, and Firecracker version so flags such as freeze-user-cgroup can roll out per guest envd build. Pause and checkpoint attach that full sandbox context from the live sandbox after lookup instead of a thin request-only context, and the pre-pause reclaim path sets the same context once rather than passing per-flag LD contexts.

^{Reviewed by Cursor Bugbot for commit 77c5372. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

This pull request introduces the SandboxEnvdVersionAttribute to feature flag contexts and updates the Create, Pause, and Checkpoint methods in the orchestrator server to populate LaunchDarkly contexts with detailed sandbox attributes (such as template, kernel, Firecracker, and envd versions) retrieved from the sandbox instance. There are no review comments, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
2969	2	2967	6

View the top 3 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/orchestrator::TestSandboxFilesystemPauseResumeIntegrity

Stack Traces | 0s run time

=== RUN   TestSandboxFilesystemPauseResumeIntegrity
=== PAUSE TestSandboxFilesystemPauseResumeIntegrity
=== CONT  TestSandboxFilesystemPauseResumeIntegrity
--- FAIL: TestSandboxFilesystemPauseResumeIntegrity (0.00s)

github.com/e2b-dev/infra/tests/integration/internal/tests/orchestrator::TestSandboxFilesystemPauseResumeIntegrity/scattered_write_hash_survives_pause

Stack Traces | 6.67s run time

=== RUN   TestSandboxFilesystemPauseResumeIntegrity/scattered_write_hash_survives_pause
=== PAUSE TestSandboxFilesystemPauseResumeIntegrity/scattered_write_hash_survives_pause
=== CONT  TestSandboxFilesystemPauseResumeIntegrity/scattered_write_hash_survives_pause
Executing command bash in sandbox i2ojf0jyyir8o3a3f19h3 (user: root)
    filesystem_pause_resume_integrity_test.go:43: Command [bash] output: event:{start:{pid:1134}}
Executing command bash in sandbox idgqz3lxwpjmglg595peb (user: root)
    filesystem_pause_resume_integrity_test.go:43: Command [bash] output: event:{end:{exited:true status:"exit status 0"}}
    filesystem_pause_resume_integrity_test.go:43: Command [bash] completed successfully in sandbox i4g05684ec0ub3k0u1eni
Executing command bash in sandbox i4g05684ec0ub3k0u1eni (user: root)
    filesystem_pause_resume_integrity_test.go:43: Command [bash] output: event:{start:{pid:1139}}
    filesystem_pause_resume_integrity_test.go:43: 
        	Error Trace:	.../tests/orchestrator/filesystem_pause_resume_integrity_test.go:114
        	            				.../tests/orchestrator/filesystem_pause_resume_integrity_test.go:132
        	            				.../tests/orchestrator/filesystem_pause_resume_integrity_test.go:43
        	Error:      	Received unexpected error:
        	            	failed to execute command bash in sandbox i4g05684ec0ub3k0u1eni: invalid_argument: protocol error: incomplete envelope: unexpected EOF
        	Test:       	TestSandboxFilesystemPauseResumeIntegrity/scattered_write_hash_survives_pause
--- FAIL: TestSandboxFilesystemPauseResumeIntegrity/scattered_write_hash_survives_pause (6.67s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestDeleteTemplateFromAnotherTeamAPIKey

Stack Traces | 158s run time

=== RUN   TestDeleteTemplateFromAnotherTeamAPIKey
=== PAUSE TestDeleteTemplateFromAnotherTeamAPIKey
=== CONT  TestDeleteTemplateFromAnotherTeamAPIKey
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Building template l0p5rut5pwnwm9lm7teg/7438a8c4-5296-46cd-9d0a-e3a630b34760
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] [base] FROM ubuntu:22.04 [905bb9b1f7b3e631aa9d97d25385b3bb55c45687cb0f33deab700d7906575727]
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Uncompressing layer sha256:40d16f30db405106ef8074779bdf41f012465c2a785bbeaa2eab9f2081099b47 30 MB
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Uncompressing layer sha256:0c256c75aee33809e4bab4d2f3fbfb8674c3d101d0c900f33dd678e153d84dae 13 MB
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Layers extracted
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib32, lib64, libx32, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Provisioning sandbox template
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] Sandbox template provisioned
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] [base] DEFAULT USER user [ea1d9e9a4e5e72b3edd251b28ade9fa6aa5a91811560507694d4964fdbac723b]
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] [builder 1/1] RUN echo 'Hello, World!' [3a7c1b087bdada710574e91a5484a97044150a027127d59c9b2df2bec44bdd33]
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] [builder 1/1] [stdout]: Hello, World!
    build_template_test.go:133: test-to-delete-another-team-api-key: [info] [finalize] Finalizing template build [bf952c855fff6cfdd2ac81baf7c186afcaf50eaeee6b2a47b347408b7390e652]
    build_template_test.go:133: test-to-delete-another-team-api-key: [error] Build failed: build was cancelled
    delete_template_test.go:51: Build failed: {<nil> build was cancelled <nil>}
--- FAIL: TestDeleteTemplateFromAnotherTeamAPIKey (157.85s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestDeleteTemplate

Stack Traces | 163s run time

=== RUN   TestDeleteTemplate
=== PAUSE TestDeleteTemplate
=== CONT  TestDeleteTemplate
    build_template_test.go:133: test-to-delete: [info] Building template kys0xh01w6r5wgqj81ja/7148b8f1-b244-4aa6-a45d-fabfae03f2e3
    build_template_test.go:133: test-to-delete: [info] [base] FROM ubuntu:22.04 [905bb9b1f7b3e631aa9d97d25385b3bb55c45687cb0f33deab700d7906575727]
    build_template_test.go:133: test-to-delete: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-to-delete: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-to-delete: [info] Uncompressing layer sha256:40d16f30db405106ef8074779bdf41f012465c2a785bbeaa2eab9f2081099b47 30 MB
    build_template_test.go:133: test-to-delete: [info] Uncompressing layer sha256:0c256c75aee33809e4bab4d2f3fbfb8674c3d101d0c900f33dd678e153d84dae 13 MB
    build_template_test.go:133: test-to-delete: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-to-delete: [info] Layers extracted
    build_template_test.go:133: test-to-delete: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib32, lib64, libx32, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-to-delete: [info] Provisioning sandbox template
    build_template_test.go:133: test-to-delete: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-to-delete: [info] Sandbox template provisioned
    build_template_test.go:133: test-to-delete: [info] [base] DEFAULT USER user [ea1d9e9a4e5e72b3edd251b28ade9fa6aa5a91811560507694d4964fdbac723b]
    build_template_test.go:133: test-to-delete: [info] [builder 1/1] RUN echo 'Hello, World!' [3a7c1b087bdada710574e91a5484a97044150a027127d59c9b2df2bec44bdd33]
    build_template_test.go:133: test-to-delete: [info] [builder 1/1] [stdout]: Hello, World!
    build_template_test.go:133: test-to-delete: [info] [finalize] Finalizing template build [bf952c855fff6cfdd2ac81baf7c186afcaf50eaeee6b2a47b347408b7390e652]
    build_template_test.go:133: test-to-delete: [error] Build failed: build was cancelled
    delete_template_test.go:18: Build failed: {<nil> build was cancelled <nil>}
--- FAIL: TestDeleteTemplate (163.39s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae0361e6c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

LGTM — small, mechanical addition of an LD context attribute; the FC-version raw-vs-resolved consistency nit is captured inline.

Extended reasoning...

Overview

This PR adds a new SandboxEnvdVersionAttribute ("envd-version") to the LaunchDarkly sandbox context across the Create, Pause, and Checkpoint gRPC handlers, with the goal of enabling LD flag targeting (e.g. freeze-user-cgroup) by guest envd version. The Pause/Checkpoint LD context construction is also moved to after the sandbox lookup so it can use config values from the resolved sbx (template-id, kernel/firecracker version, envd version) rather than the request fields only.

Security risks

None. This is a feature-flag context attribute addition; no auth, crypto, or permission boundaries are touched. Failure modes are limited to LD flags evaluating with extra/missing context attributes.

Level of scrutiny

Low. The change is a few lines of mechanical additions plus a small reorder of where the LD context is built in Pause/Checkpoint. The reorder is safe: the error paths between the old and new positions don't evaluate flags, and the new positions still cover all subsequent flag reads on those paths (MarkStopping, PeerToPeerAsyncCheckpointFlag, ExecutionMetricsOnWebhooksFlag, etc.). The new attribute is declared next to its peers in flags.go and consumed in the obvious places.

Other factors

One inline nit was filed about firecracker-version being set from the raw request value on the Create path while Pause/Checkpoint use the post-ResolveFirecrackerVersion value — a pre-existing asymmetry that this PR makes observable on more code paths but does not introduce. It is a real consistency issue, but only manifests when an operator actively remaps a version via the firecracker-versions JSON flag AND a flag targets firecracker-version. Worth filing for follow-up; not worth blocking this PR on. No other reviewer comments are outstanding (only a Cursor Bugbot placeholder summary).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 012302ef10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".