Repository navigation
isb 3.0.0: workspaces are removed; a dev box is a stack you deploy; every org gets the org API listener - #67
Merged
Merged
Conversation
…lts get their own home
isb no longer has a built-in workspace (the one-per-org long-lived machine
with a home, an isb_ws_ token, herdr terminals, published ports and
previews, setup scripts, secret delivery, workspace image builds and the
Docker nesting exception). A persistent dev box is a one-replica stack the
org deploys itself, reached with isb ssh-config ORG/INSTANCE.
- The org API listener (bridge gateway :8481, /orgs/<org>/{mcp,api/v1},
own subnet only, org API tokens only) now runs for every org.
--workspace-mcp-port is --org-api-port (ISB_ORG_API_PORT).
- Sandbox lifetime moved out of the workspace code: sandbox_life (model),
daemon::sandboxes (activity, reaper, sandbox_settings tool), stored in
<org root>/sandboxes.json and carried over from workspaces/settings.json.
- isb sandbox ls|extend|settings replaces isb workspace sandboxes|extend|settings.
- Nothing in an org may nest; ensure drops the workspace-homes and
allow-nesting project keys.
- Leftover workspace containers are left running; the daemon logs once how
to remove them.
- Web UI: a Sandboxes page (list, extend, delete, shell, defaults) replaces
the workspace page. Docs, SKILL.md, guide topics and the API snapshot
follow.
Claude-Session: https://claude.ai/code/session_01JGncQcm5oCvqHnJ7m4Fodu
A stack replica is replaced by every deploy, with a new name and new host keys, so a long-lived box deployed as a stack needs a target that outlives its replicas. ORG/STACK/SERVICE reaches the service's running replica (in rotation first, then the lowest slot); its ssh-config block is `<service>.<stack>.<org>.isb` and checks host keys strictly through `KnownHostsCommand isb ssh-proxy --known-hosts`, which asks isb for the current replica's keys at each connection, instead of pinning keys a deploy makes stale. Claude-Session: https://claude.ai/code/session_01JGncQcm5oCvqHnJ7m4Fodu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Breaking: isb no longer has a built-in workspace (the one-per-org long-lived machine with a home, an
isb_ws_token, herdr terminals, published ports and previews, setup scripts, secret delivery, workspace image builds and the Docker nesting exception). A persistent dev box is a one-replica stack the org deploys itself.http://<org gateway>:8481/orgs/<org>/{mcp,api/v1}, own subnet only, org API tokens only.--workspace-mcp-portis--org-api-port(ISB_ORG_API_PORT).sandbox_life+daemon::sandboxes(activity, reaper), thesandbox_settingstool,isb sandbox ls|extend|settings, a Sandboxes web page (list, extend, delete, shell, defaults). Per-org defaults live in<org root>/sandboxes.json, carried over fromworkspaces/settings.jsonon first read.isb ssh-config ORG/STACK/SERVICEandisb ssh-proxy ORG/STACK/SERVICEreach the service's current replica; the block checks host keys strictly throughKnownHostsCommand isb ssh-proxy --known-hostsinstead of pinning keys a deploy makes stale.isb org update/create drops the workspace-homes and allow-nesting project keys. Leftover workspace containers keep running; the daemon logs once how to remove them.isb workspace, 22workspace_*tools,org_nesting,isb org nesting,--workspace-pool,--workspace-home-root,--preview-domain, the workspace REST resource, the terminalsession=parameter.Verified: cargo test/clippy/doc, web tests and build, docs check; on a preview VM (org API listener from inside an org with an org token, refusals, sandbox defaults carry-over, extend, leftover warning, Sandboxes page and shell); the new SSH service target against titan's exa devbox.
Titan's 8 org workspaces were moved to devbox stacks on isb 2.4.0 beforehand (titan-iac branch
isb-devboxes).https://claude.ai/code/session_01JGncQcm5oCvqHnJ7m4Fodu