Add Loop Runtime on GKE with isolated Sandbox Service workers by alexr17 · Pull Request #98 · braintrustdata/helm

Alex R (alexr17) · 2026-08-26T04:58:13Z

Adds an opt-in Loop Runtime for GKE. Sandboxes run on Sandbox Service workers in a separate isolated GKE cluster.
On AWS, Loop Runtime stays on ECS through the Terraform module, so the chart rejects other clouds.

The GCP Terraform module supplies the worker cluster, discovery zone, Loop Runtime service account, and reserved egress address.

The runtime reaches workers over mTLS at discovery.endpoint and mounts the sandbox-client-tls Secret.
Sandboxes reach Git through the runtime's forward proxy, exposed by <service>-egress: an internal load balancer on the reserved address that admits only worker ranges.
Environment, the 90s drain (120s grace period), and pinned images match the ECS Loop Runtime with Sandbox Service in the AWS module.
The API gets LOOP_RUNTIME_URL; the VirtualService routes /loop/runtime.
The worker release prepares local SSDs in an init container using the same configured Sandbox Service image as the worker. examples/gke-loop-runtime supplies worker values and the mTLS Secret setup script.

Input matrix

Input	Behavior
`loopRuntime.enabled` false, or `loopRuntime` missing (`--reuse-values`)	No Loop objects, URL, or route
`--reuse-values --set loopRuntime.enabled=true`, including partial sandbox overrides with missing default maps	Fails, pointing to `--reset-then-reuse-values`
`cloud: aws`, `azure`, or empty	Fails
`replicas` unset / null / empty / `0`	2 / 1 / 1 / 0
Missing service account, discovery endpoint, egress address or URL, image repository or tag; empty or non-CIDR source ranges	Fails
HTTP probes with an omitted port; default or custom runtime port/name	Probe port follows `loopRuntime.service.port`
Explicit numeric/named probe ports, null probes, or an exec probe	Retains the caller's probe configuration
IPv4 network ranges with octets 0–255 and prefixes 0–32	Renders unchanged
Invalid octets/prefixes, leading zeroes, host bits, missing octets, IPv6, blank/null/padded entries, or mixed valid/blank ranges	Fails
Node-init: fresh SSD / existing XFS / another filesystem	Formats XFS directly at the worker state path / preserves data across restart and remount / refuses to reformat
Node-init: missing SSD or KVM, or a mount of an XFS subdirectory	Fails before admitting worker capacity
`loopRuntime.enableSandboxAdmin` missing / null / false / true	Disabled / disabled / disabled / enabled for authorized sysadmins
Runtime cache and claims	256Mi in-memory cache budget; at most two concurrent conversations per pod
`global.orgName` empty	`ORG_NAME: "*"`
`locksBackend: objectStorage` / `redis`	GCS locks / Redis locks
Image tag: release, SHA (including all-digit), prerelease	Renders; no semver gate

Verified on GKE: cross-cluster mTLS and private DNS; sandbox create, execute, stop, and terminate; Git through the egress proxy; real Loop turns with SQL and shell tools; runtime pod replacement; and a worker upgrade with the node-preparation init container. Two concurrent turns peaked at 329MiB of runtime cgroup memory within the 2Gi pod limit. Larger histories and higher concurrency still need load testing; worker uninstall has not been exercised.

./test.sh passes (478 Helm cases, 33 Python tests, lint, cloud renders); the worker chart's three focused tests pass. Earlier Linux loop-device checks covered fresh XFS initialization, mount propagation, preservation across remounts, and rejection of ext4 and XFS subdirectory mounts. The TLS script retains the prior partial-failure recovery flow and now uses server-side apply, removing legacy key-bearing annotations.

🤖 Generated with Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3b7cd9e53

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-08-28T22:57:28Z

Codex (@codex) review

chatgpt-codex-connector · 2026-08-28T22:57:51Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T03:03:19.088859Z	`bc1c5bc`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e8a133ecc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-08-28T23:28:55Z

Codex (@codex) review

chatgpt-codex-connector · 2026-08-28T23:32:10Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 1bc6147080

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Context The Helm chart had no Loop Runtime workload, so external EKS deployments could not run the Kubernetes-hosted runtime. Description Add an opt-in AWS EKS Loop Runtime Deployment, Service, ServiceAccount, and ConfigMap. Wire the runtime to the existing data-plane Secret, API URL, AWS MicroVM sandbox settings, and optional Istio route. Squashed from #98 and rebased onto main.

Run Loop Runtime on cloud: google as well as cloud: aws. Storage URIs follow the Brainstore ConfigMaps (s3:// or gs://), and the ServiceAccount and pod use IRSA or GKE Workload Identity. Add loopRuntime.sandbox.backend. awsLambdaMicrovm keeps the AWS Lambda MicroVM settings under sandbox.awsLambdaMicrovm. sandboxService points the runtime at Braintrust Sandbox Service workers over mTLS, which is the GKE default and also works on AWS. An optional sandbox egress gateway opens the runtime's forward proxy behind its own Service. Treat a missing loopRuntime map as disabled so helm upgrade --reuse-values from earlier chart releases keeps rendering. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Drop the AWS Lambda MicroVM backend. Loop Runtime on EKS and GKE now sends every sandbox to Braintrust Sandbox Service workers. With a Sandbox Service endpoint and no EXO_SANDBOX_PROVIDER, the runtime uses the Sandbox Service for all sandboxes instead of the MicroVM default plus a LaunchDarkly rollout, as the CloudFormation mixed mode does. Flatten loopRuntime.sandbox.sandboxService.* into loopRuntime.sandbox.* and expose the sandbox egress mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Drop checks the runtime already enforces (urls type, egress mode, egress port collision, TLS key names), inline the one-use egress Service name helper, and shorten the values comments and README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Alex R (alexr17) · 2026-10-20T19:55:08Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e9322fa75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-20T21:44:01Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e459430706

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-21T07:38:36Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 922cc8a6ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-21T07:58:53Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d40b5ed21b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Erik Weathers (erikdw)

Yes, this looks like the right direction. Loop Runtime in the Braintrust chart, the shared Sandbox Service chart as a separate release, and infrastructure outside Helm are sensible ownership boundaries.

Three integration fixes before it's ready (inline comments below):

Shutdown time: the Deployment gets the default 30s grace period, but Loop takes up to 90s to drain (CFN uses StopTimeout: 120). Rollouts can cut off turns still draining after 30 seconds.
FUNCTION_SECRET_KEY: it's only mapped into SERVICE_TOKEN_SECRET_KEY. The runtime also needs FUNCTION_SECRET_KEY itself, or MCP servers that use stored credentials break.
Empty orgName: the chart allows it for multi-org installs, but with no allowedOrgIds the runtime refuses to start.

Resource/version contract:

Give the runtime's disk cache an explicit budget: BRAINSTORE_OBJECT_STORE_CACHE_FILE_SIZE, an emptyDir sizeLimit, and an ephemeral-storage request so scheduling accounts for it on the shared system nodes.
Pin a tested runtime/worker/sandbox image combination. The chart's runtime default (latest-2.x) and the sandbox guest image currently float.

Then a real EKS lifecycle test: create a sandbox, use Git through the proxy, run a Loop turn, replace a runtime pod, and upgrade/drain/uninstall workers. That's the main evidence still missing. The GKE instructions also depend on unmerged Terraform work in terraform-google-braintrust-data-plane (draft braintrustdata/terraform-google-braintrust-data-plane#28, stacked on jeff/gke-standard), so make that dependency explicit.

All of this is integration and rollout work within the proposed design. The overall split makes sense.

…rkers Loop Runtime on AWS stays on ECS through the Terraform module, so the chart now rejects every cloud except google. Workers run in the isolated GKE cluster from the GCP Terraform module; the runtime reaches them through the discovery endpoint and exposes its Git forward proxy on an internal load balancer bound to an address Terraform reserves. - Drop AWS (IRSA, s3:// URIs), sandbox.urls, and the EKS example - Always mount the client TLS Secret and run the egress gateway - Match the ECS Sandbox Service environment and pinned images - Default runtime pods to 1 vCPU / 2 GiB with two replicas - Add a GKE example with a TLS Secret script and worker chart values Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The worker chart expects node-local storage at /var/lib/braintrust-sandboxes/1, /run/netns, and /dev/kvm. EKS node bootstrap provides these; GKE node pools have no bootstrap hook, so the example adds a node-init DaemonSet that formats and mounts the raw local SSDs (striping them when there are several) in the host mount namespace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Give pods 120s to stop and set the runtime's 90s drain explicitly - Pass FUNCTION_SECRET_KEY so stored MCP credentials decrypt - Render ORG_NAME as * when orgName is empty, as the API does - Bound the Brainstore file cache, size-limit the state and cache emptyDirs, and request matching ephemeral storage - Reject blank, null, padded, and non-CIDR egress source ranges - Node init: mount the SSD at the parent and create the worker directory on it, so workers cannot start before the mount - TLS script: check both clusters first and write the worker server Secret last, so a failed run can be retried - Note the dependency on terraform-google-braintrust-data-plane#28 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

An empty, null, or missing repository or tag rendered an invalid image reference that only failed when pods started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Alex R (alexr17) · 2026-10-26T05:55:38Z

Codex (@codex) review

Model loopRuntime on the AI Gateway: the same value shapes, probes in values, and fixed defaults for settings with one correct value (state and cache paths and limits, security contexts, the 120s grace period, the TLS Secret name, the Git proxy port, in-cluster service URLs). Drop knobs no install needs and the tests that only covered them, and shorten the docs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Alex R (alexr17) · 2026-10-26T06:03:05Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a858ef5645

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-26T17:31:25Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 61788e2e30

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-26T17:44:09Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2f725580eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-26T19:10:33Z

Codex (@codex) review

chatgpt-codex-connector · 2026-10-26T19:13:53Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 414595e258

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Alex R (alexr17) · 2026-10-26T22:24:41Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e22a347c29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Erik Weathers (erikdw) · 2026-10-26T23:40:30Z

+          image: alpine:3.22
+          command: [sh, -ec]
+          args:
+            - |
+              apk add --no-cache bash util-linux xfsprogs mdadm


This privileged container on the sandbox hosts uses alpine:3.22 with no digest and runs apk add from the internet on every start, with the host /dev mounted. Please use a prebuilt image pinned by digest.

It also needs one maintained owner. terraform-google #28's design doc says the worker release prepares the disks, but here it's an example manifest applied with kubectl. Whether that owner is the worker chart or node provisioning is a choice to settle across this PR and #28.

Node preparation now belongs to the pinned worker release as an init container, using a prebuilt image pinned by digest. Removed the separate example DaemonSet. The worker starts only after the existing KVM/XFS checks complete; a GKE worker upgrade completed with the init container exiting successfully and the replacement worker becoming ready.

Erik Weathers (erikdw)

Note

This is a summary comment for the inline comments above

Keep this architecture. Loop Runtime in the Braintrust chart, the Sandbox Service workers as a separate release in an isolated GKE cluster, and infrastructure in Terraform are the right ownership boundaries.

Status: no confirmed P1 in the findings below. It isn't ready yet: it depends on terraform-google-braintrust-data-plane #30 → #27 → #28, which are still in progress (#28 is a draft), and nothing has run end to end on GKE.

Fixed since the last review: 120-second grace period with a 90-second drain, FUNCTION_SECRET_KEY, empty orgName rendered as *, and an explicit disk-cache budget. Thanks!

Still to decide (inline comments): TLS Secret writes, runtime sizing, node-prep ownership and pinning, and the sandbox admin default. On images: the runtime and worker use commit-specific tags, and the sandbox guest is pinned by digest. A commit-named tag can be re-pushed unless the registry enforces immutability, so moving to release tags (or digest pins, if the contents must stay fixed) is optional.

GKE validation still needed: create a sandbox, use Git through the egress proxy, run a real Loop turn, replace a runtime pod, and upgrade, drain, and uninstall the workers.

Checks: helm unittest (470 tests) and helm lint --strict pass, and the GKE example renders on the Autopilot values.

Alex R (alexr17) · 2026-10-27T01:16:26Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 96d1639deb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

chatgpt-codex-connector · 2026-10-27T01:20:06Z

+  BRAINSTORE_CONTROL_PLANE_TELEMETRY: {{ .Values.global.controlPlaneTelemetry | quote }}
+  NO_COLOR: "1"
+  EXO_SANDBOX_SERVICE_DNS_URL: {{ $sandbox.dnsUrl | quote }}
+  EXO_SANDBOX_SERVICE_IMAGE: {{ $sandbox.image | quote }}


Validate the sandbox image before rendering

When an enabled deployment sets loopRuntime.sandbox.image to null or an empty string, validation still succeeds and this emits an empty EXO_SANDBOX_SERVICE_IMAGE; the runtime then starts but cannot create any sandbox. Require a non-empty sandbox image and cover its missing, null, and empty forms.

AGENTS.md reference: AGENTS.md:L15-L17

Useful? React with 👍 / 👎.

Alex R (alexr17) · 2026-10-27T01:39:41Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c6f9817322

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

chatgpt-codex-connector · 2026-10-27T01:43:01Z

+  ports:
+    - name: {{ .Values.loopRuntime.service.portName }}
+      protocol: TCP
+      port: {{ .Values.loopRuntime.service.port }}


Reject invalid runtime service ports

Validate loopRuntime.service.port before rendering it. When an enabled configuration explicitly sets this value to null, an empty string, 0, or a value above 65535, Helm still renders the Service and Deployment, but Kubernetes rejects their required port fields; the same value also produces unusable internal URLs and probe configuration. Add range/type validation and cover the empty and boundary cases required by the repository's input-matrix policy.

AGENTS.md reference: AGENTS.md:L15-L17

Useful? React with 👍 / 👎.

Alex R (alexr17) · 2026-10-27T02:59:39Z

Codex (@codex) review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc1c5bc2df

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

chatgpt-codex-connector · 2026-10-27T03:03:15Z

+{{- range $key := list "sandbox" "image" "service" "serviceAccount" "resources" "annotations" -}}
+{{- if not (kindIs "map" (get $.Values.loopRuntime $key)) -}}
+{{- fail "loopRuntime defaults are missing. Values reused from a chart release that predates Loop Runtime omit them; upgrade with --reset-then-reuse-values." -}}
+{{- end -}}


Validate nested defaults on reused-value upgrades

When a pre-Loop-Runtime release is upgraded with --reuse-values and partial overrides supply each outer map but omit nested defaults such as image.pullPolicy, service.type, service.portName, or serviceAccount.name, this guard passes because it checks only the map types. The templates then emit empty Kubernetes fields or an unnamed ServiceAccount, so admission fails instead of returning the intended --reset-then-reuse-values guidance; validate the required nested structure or overlay template defaults before rendering.

AGENTS.md reference: AGENTS.md:L14-L17

Useful? React with 👍 / 👎.

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread braintrust/templates/loop-runtime-deployment.yaml Outdated

Comment thread braintrust/templates/loop-runtime-serviceaccount.yaml Outdated

chatgpt-codex-connector Bot reviewed Aug 28, 2026

View reviewed changes

Comment thread braintrust/values.yaml Outdated

Alex R (alexr17) and others added 2 commits October 20, 2026 19:26

Alex R (alexr17) force-pushed the feat/loop-runtime-eks branch from 1bc6147 to b97b95f Compare October 20, 2026 19:40

Alex R (alexr17) changed the title ~~Add Loop Runtime workload for EKS~~ Add Loop Runtime workload for EKS and GKE Oct 20, 2026

Alex R (alexr17) and others added 2 commits October 20, 2026 19:44

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread braintrust/templates/loop-runtime-egress-service.yaml Outdated

Comment thread braintrust/templates/loop-runtime-deployment.yaml Outdated

Fix Loop Runtime egress port collision and label coverage

e459430

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread braintrust/templates/_helpers.tpl Outdated

Comment thread braintrust/values.yaml

Add an EKS installation using the shared Sandbox Service chart

922cc8a

Alex R (alexr17) changed the title ~~Add Loop Runtime workload for EKS and GKE~~ Add Loop Runtime with a shared Sandbox Service installation Oct 21, 2026

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread braintrust/templates/loop-runtime-deployment.yaml Outdated

Trim Loop Runtime examples and test scaffolding

d40b5ed

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread braintrust/templates/loop-runtime-serviceaccount.yaml Outdated

Comment thread braintrust/templates/loop-runtime-deployment.yaml

Erik Weathers (erikdw) requested changes Oct 21, 2026

View reviewed changes

Alex R (alexr17) mentioned this pull request Oct 24, 2026

Add external EKS Loop Runtime support braintrustdata/terraform-aws-braintrust-data-plane#353

Closed

Alex R (alexr17) and others added 2 commits October 26, 2026 04:51

Alex R (alexr17) changed the title ~~Add Loop Runtime with a shared Sandbox Service installation~~ Add Loop Runtime on GKE with isolated Sandbox Service workers Oct 26, 2026

Alex R (alexr17) mentioned this pull request Oct 26, 2026

Isolated-workload for loop braintrustdata/terraform-google-braintrust-data-plane#28

Draft

Alex R (alexr17) and others added 2 commits October 26, 2026 05:52

Require the Loop Runtime image repository and tag

c1b084e

An empty, null, or missing repository or tag rendered an invalid image reference that only failed when pods started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread braintrust/values.yaml Outdated

Comment thread braintrust/templates/_helpers.tpl Outdated

Fix GKE worker storage and Loop Runtime validation

61788e2

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread braintrust/examples/gke-loop-runtime/node-init.yaml Outdated

Trim Loop Runtime tests and fix worker init dependencies

2f72558

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread braintrust/templates/_helpers.tpl Outdated

Validate egress CIDRs for strict Kubernetes admission

414595e

Wire Git authorization to the sandbox egress URL

e22a347

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread braintrust/templates/_helpers.tpl Outdated

Erik Weathers (erikdw) reviewed Oct 26, 2026

View reviewed changes

Address GKE Loop Runtime deployment review

96d1639

chatgpt-codex-connector Bot reviewed Oct 27, 2026

View reviewed changes

Use worker chart with multiarch node preparation

c6f9817

chatgpt-codex-connector Bot reviewed Oct 27, 2026

View reviewed changes

Alex R (alexr17) added 2 commits October 26, 2026 19:33

Use worker chart with GKE disk discovery fix

d7d5b87

Use shared Sandbox Service image for node prep

bc1c5bc

chatgpt-codex-connector Bot reviewed Oct 27, 2026

View reviewed changes

Conversation

Alex R (alexr17) commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Alex R (alexr17) commented Aug 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Alex R (alexr17) commented Aug 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 28, 2026

Uh oh!

Alex R (alexr17) commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Alex R (alexr17) commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Alex R (alexr17) commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Alex R (alexr17) commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Erik Weathers (erikdw) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Alex R (alexr17) commented Oct 26, 2026

Uh oh!

Alex R (alexr17) commented Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Alex R (alexr17) commented Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Alex R (alexr17) commented Aug 26, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 28, 2026 •

edited

Loading