Docs: sandbox cap, job log size, and job tokens' package reads (#84)
Covers #80 beyond its own pages: the 5-open-sandbox limit and its 429 on the Sandboxes page, the 16 MiB job log limit on Runners, and the permissions table's description of which images a job token pulls. Claude-Session: https://claude.ai/code/session_016q5wwBFck8JHq14gHUM2CL Co-authored-by: Claude <noreply@anthropic.com>
Canberk Demirci authored · GitHub committed signed1 parent 797793ecommit ad2fbf5abbf71cd4f54b09ada594f18a4fb10438Browse files
3 files changed+4−1
modifiedapps/diffinery/docs/accounts/permissions.md+1−1View file
| @@ -213,7 +213,7 @@ | ||
| 213 | 213 | |
| 214 | 214 | | Token | Prefix | Where it comes from | What it can do on the repository | |
| 215 | 215 | | --- | --- | --- | --- | |
| 216 | -| Job token | `djt_` | Each workflow job gets one as `GITHUB_TOKEN` (also `DIFFINERY_TOKEN`) | Act as `diffinery-actions[bot]` with what the workflow's `permissions:` grant (see below). Container images follow the job's `permissions: packages`: it pulls its owner's images and pushes only to images linked to its own repository (creating them, linked, on first push) | | |
| 216 | +| Job token | `djt_` | Each workflow job gets one as `GITHUB_TOKEN` (also `DIFFINERY_TOKEN`) | Act as `diffinery-actions[bot]` with what the workflow's `permissions:` grant (see below). Container images follow the job's `permissions: packages`: it pulls its own repository's images, its owner's images not linked to a repository and public images, and pushes only to images linked to its own repository (creating them, linked, on first push) | | |
| 217 | 217 | | Sandbox token | `dst_` | Each agent sandbox gets one | Act as the person or agent that started the sandbox, capped at `write`, on that repository | |
| 218 | 218 | |
| 219 | 219 | Both can also read other public repositories (as anyone can), but no other private repository. They stop working when the job completes or the sandbox closes. See [Secrets and variables](/docs/actions/secrets-and-variables) and [Sandboxes](/docs/agents/sandboxes). |
modifiedapps/diffinery/docs/actions/runners.md+1−0View file
| @@ -141,6 +141,7 @@ | ||
| 141 | 141 | | Step timeout | `steps[*].timeout-minutes`, no default | The step fails with "The step has timed out after N minutes." | |
| 142 | 142 | | Matrix size | 256 jobs per matrix | The job fails with "A matrix may produce at most 256 jobs." | |
| 143 | 143 | | Log line length | 16,384 characters | Longer lines are cut and end with `…` | |
| 144 | +| Log size | 16 MiB of text per job | The log ends with "The log is cut off here: a job's log is limited to 16 MiB of text." Later lines are dropped; the job keeps running. | | |
| 144 | 145 | | Platform updates | A deploy doesn't replace the container of a running job: running jobs finish on the version they started with. If the platform replaces a container anyway, the job keeps going for up to 13 minutes | The log shows "This runner is being replaced by a new version. The job keeps running for up to 13 minutes before it is cancelled." | |
| 145 | 146 | |
| 146 | 147 | If the container stops unexpectedly (for example it runs out of memory), the job fails with `The runner stopped unexpectedly (exit code N).` |
modifiedapps/diffinery/docs/agents/sandboxes.md+2−0View file
| @@ -184,6 +184,7 @@ | ||
| 184 | 184 | | Request body (REST) | 64 MiB | |
| 185 | 185 | | File size for reads | 64 MiB | |
| 186 | 186 | | Git access from inside | The creator's role, at most write | |
| 187 | +| Open sandboxes | 5 per account in each repository, until each is closed or its credentials expire after 24 hours (agent task sandboxes don't count) | | |
| 187 | 188 | |
| 188 | 189 | ## Example: test a change and push it |
| 189 | 190 | |
| @@ -205,6 +206,7 @@ | ||
| 205 | 206 | | Message | Cause and fix | |
| 206 | 207 | | --- | --- | |
| 207 | 208 | | `write access required` | Sandboxes need write access, and a token with the `write` or `admin` scope. | |
| 209 | +| `you have 5 open sandboxes in this repository, the most allowed; close one first` (`429`) | Close a sandbox you no longer need (`sandbox_close`, or the REST `close` action), or wait for one to expire. | | |
| 208 | 210 | | `the sandbox container did not start; try again` (`503`) | The container didn't start within about 3 minutes, which can happen right after a deploy while the host pulls the image. Create the sandbox again. | |
| 209 | 211 | | `sandbox_create` or the REST call seems to hang | The first sandbox after a deploy can take a few minutes to start. Wait, and keep your client's timeout above 3 minutes. | |
| 210 | 212 | | `unknown ref` | The `ref` isn't a branch, tag or commit in the repository. | |