[aron-cf]

Summary

SimpleContainerBackend is a container that doesn't share files with the Workspace automatically. There's no FUSE mount and no sync around each command. The agent copies files in, runs commands at full disk speed, and copies the results back.

• A path is the same file on both sides: /workspace/src/a.ts in the Workspace is /workspace/src/a.ts in the container.
• Only changed files are copied, and nothing is ever deleted.
• If a file changed in both the Workspace and the container, pull refuses and writes nothing, unless you pass force: true.

Host setup

const container = new SimpleContainerBackend({
  container: () => this,
  workspace: { binding: "Agent", id: this.ctx.id.toString() },
});

new Workspace({
  storage: this.ctx.storage,
  backends: [
    new WorkerJavaScriptBackend({
      loader: env.LOADER,
      modules: { "ws:container": createContainerModule({ backend: container }) },
    }),
    container,
  ],
});

Agent code

Build and fetch the output:

import { exec, push, pull } from "ws:container";

export default async function () {
  await push(["/workspace/package.json", "/workspace/package-lock.json", "/workspace/src"]);

  const build = await exec("npm ci && npm run build", { cwd: "/workspace" });
  if (build.exitCode !== 0) return { failed: build.stderr };

  return pull(["/workspace/dist"]); // { pulled, bytes, skipped }
}

Edit, then rerun tests. Only the edited file is sent again:

import { exec, push } from "ws:container";
import fs from "node:fs/promises";

export default async function () {
  await fs.writeFile("/workspace/src/math.js", "export const add = (a, b) => a + b;\n");
  const sent = await push(["/workspace/src"]); // { pushed: 1, unchanged: 41, bytes: 37 }
  const test = await exec("npm test", { cwd: "/workspace" });
  return { sent, passed: test.exitCode === 0, output: test.stdout };
}

Globs and excludes:

import { pull } from "ws:container";

export default async function () {
  return pull(["/workspace/**/*.snap"], { exclude: ["/workspace/node_modules"] });
}

Handling a conflict:

import { exec, push, pull } from "ws:container";
import fs from "node:fs/promises";

export default async function () {
  await push(["/workspace/src"]);
  await exec("npx prettier --write src", { cwd: "/workspace" });     // container edits src
  await fs.writeFile("/workspace/src/index.js", "// my edit\n");     // workspace edits src too

  try {
    return await pull(["/workspace/src"]);
  } catch (error) {
    // "pull refused: 1 file changed in both the workspace and the container:
    //  /workspace/src/index.js. Pass { force: true } to overwrite the workspace copies."
    return { conflict: error.message };
    // or keep the container's version instead:
    // return pull(["/workspace/src"], { force: true });
  }
}

Commands have no default working directory, so always pass cwd.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 8e01872

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@cloudflare/computer	Minor
@cloudflare/dofs	Minor
@cloudflare/computer-rpc	Minor
@cloudflare/computerd	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[devin-ai-integration]

Devin Review found 6 potential issues.

[devin-ai-integration]

🔴 Concurrent edits lost during pull

When the Workspace edits a file during pullFiles, its earlier have snapshot misses the edit. The pull then overwrites that edit without reporting a conflict.

Learn more

A pull first collects the Workspace file's revision and sends it to send. The container decides conflicts against that revision before streaming bytes. Another Workspace operation can change the file between that snapshot and this write, so the container approves an overwrite that would now be a conflict. The write replaces the newer Workspace content.

Example: A file has revision 5 on both sides. Pull snapshots revision 5; a second operation writes revision 6 while the container prepares its changed copy. The container sees revision 5, sends its copy, and pull overwrites revision 6 instead of refusing it.

Recommended fix: Recheck the target revision immediately before committing each incoming file against the revision collected for have, with a compare-and-write transaction or equivalent serialization around validation and write. Ensure a conflict does not leave earlier files committed if all-or-nothing conflict semantics are required.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔴 Interrupted pulls strand copied files

If a pull ends early after a complete file, pullFiles leaves that file written but never records its revision. A retry can skip it, leaving later container changes blocked as untracked conflicts.

Learn more

The decoder rejects an incomplete transfer, including one missing its final terminator, through decodeFiles. Earlier complete files have already been written to the Workspace, but this record request runs only after the whole decoder completes. On retry, send sees a Workspace copy without a recorded base. It can skip that copy by size and mtime, permanently losing the chance to record it; later edits on the container produce an untracked conflict.

Example: A pull streams dist/a.js completely, then disconnects halfway through dist/b.js. The Workspace now has a.js, but the record request never runs. A retry skips a.js as same-size and older on the container; after rebuilding a.js, a further pull reports untracked.

Recommended fix: Record successfully committed files even if a later file or terminator fails, or stage all files until the full transfer validates and commit them afterward. Preserve the expected revision on retries so partial pulls cannot silently establish an unrecorded copy.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Container permission changes never reach Workspace

When a container command only changes file permissions, #unchanged treats the file as unchanged. A later pull omits the new mode, so executables remain non-executable in the Workspace.

Learn more

The container captures a file's content hash, size, and modification time in receive and after a pull in record. POSIX chmod changes the mode without changing file content or modification time. This test therefore skips the file, even though the transfer format carries its mode and the Workspace write applies it.

Example: Push bin/run.sh at mode 0644, then execute chmod +x bin/run.sh in the container. A subsequent pull reports zero files and the Workspace copy remains 0644.

Recommended fix: Include mode in the recorded disk version and in the unchanged check. Treat a mode difference as a change, then send and apply the header's mode.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Cancelled transfers continue writing files

When a host call expires during pushFiles, the active PUT lacks options.signal and keeps sending files. The caller stops waiting while the container continues changing.

Learn more

The host module passes its abort signal to file transfer. Abort checks in this function happen before starting the PUT and before reading each new file, not while an active file streams to computerd. The pull, diff, and record HTTP calls likewise omit the signal. A cancelled JavaScript execution can therefore finish with the caller gone while its file transfer continues to change a filesystem.

Example: An isolate starts pushing a large archive and reaches its host-call deadline halfway through the PUT. The request remains active and writes the rest of the archive into the container after the isolate has received a timeout.

Recommended fix: Pass options.signal through every transfer fetch's RequestInit, and ensure streaming bodies and the response reader are cancelled when the signal aborts.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟥 Read-only code can modify container files

With access: "read", push still writes Workspace bytes onto the container's disk. Read-only isolate code can replace container files despite lacking write access.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟥 Transfer paths follow symlinked directories

When a transfer path contains a symlinked parent, receive follows it after lexical validation. A push can write outside its intended container directory.

---

Was this helpful? React with 👍 or 👎 to provide feedback.