Preview feature sandbox#333
Merged
torosent merged 5 commits intoJun 18, 2026
Merged
Conversation
Align the .NET and Python guides and the overview README with the preview-feature-sandbox samples, which are the source of truth. - .NET: SandboxWorkerProfileOptions with Image.ImageRef, Image.ManagedIdentityClientId, and SchedulerManagedIdentityClientId; AddDurableTaskSchedulerSandboxActivitiesClient + EnableSandboxActivitiesAsync; UseWorkItemFilters; preview package names. Adds the missing managed identity. - Python: durabletask.azuremanaged.preview.sandboxes namespace (SandboxWorkerProfile, sandbox_worker_profile, SandboxActivitiesClient, SandboxWorker), image.image_ref / managed identity options, install from preview source. - README: managed-identity prerequisite, image-ref/identity rows in the worker profile reference table, and a Configure the scheduler identity for image pull section. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove all references to building the Durable Task SDK from source and links to the unreleased preview PRs (microsoft/durabletask-python#151, microsoft/durabletask-dotnet#736) so nothing referencing private/unreleased sources goes to public source control. - Docs and sample install steps now use published preview packages: .NET 1.25.0-preview.2, Python durabletask==1.6.0 / durabletask-azuremanaged==1.6.0. - .NET sample: csproj ProjectReferences -> PackageReferences, Directory.Build.props now centralizes DtsSdkVersion, sandbox-worker Containerfile drops the sdk build context and DtsSdkRoot. - Python sample: requirements.txt and Containerfile install from packages; READMEs drop the from-source steps. Note: the .NET package wiring (including Microsoft.DurableTask.Generators) and exact versions need a build validation once the published packages are confirmed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The main-app declares the sandbox worker profile and runs an in-process worker, but never hosts a sandbox worker (UseSandboxWorker lives in sandbox-worker). It only needs Client.AzureManaged[.Sandboxes] and Worker.AzureManaged, so drop the unused Worker.AzureManaged.Sandboxes package reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds Azure Developer CLI (azd) deployment to the .NET and Python on-demand sandbox samples so they can run in the cloud: - AKS hosts the main-app orchestrator (workload identity); DTS starts the sandbox worker image on demand (never deployed to the cluster). - The Durable Task Scheduler is taken as an existing resource (schedulerName + schedulerResourceGroupName) and patched out of band for the preview; the template never creates one. A postprovision hook attaches the workload identity to the scheduler (merge-safe PATCH). - Azure OpenAI gpt-5.1 (2025-11-13, GlobalStandard) in East US backs the in-process GenerateCode activity. - ACR builds both images server-side; a single user-assigned identity covers AKS workload identity, ACR pull, and sandbox connect-back. - Pin Microsoft.DurableTask.Generators to its own version line to avoid the NU1603 restore warning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
torosent
approved these changes
Jun 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the On-demand Sandboxes (private preview) documentation and end-to-end
samples for Azure Durable Task Scheduler under
preview-features/on-demand-sandboxes/,covering both the .NET and Python standalone Durable Task SDKs.
On-demand Sandboxes let you offload individual activities from your orchestrator
process into managed, isolated, microVM-backed compute, while the orchestrator stays
where it is. You declare a sandbox worker profile (which activities to offload + the
worker image) and DTS handles provisioning, scaling, and teardown.
What's included
(AcrPull + attach identity to the scheduler), and the worker profile configuration
reference.
docs/dotnet.md) and Python guide (docs/python.md) — declare asandbox worker profile, build the worker image, and view logs in the DTS dashboard.
an LLM generates a pandas script, the untrusted script runs in a DTS-managed sandbox
(fanned out per region), and an in-process step aggregates the answer.