Skip to content

Commit 4514129

Browse files
SamyOubouazizthomas-tacquetbene2k1ldecarvalho-doc
authored
docs(srv): update doc on sandbox environments MTA-6006 (#4918)
* docs(srv): update doc on sandbox environments MTA-6006 * docs(srv): update * docs(srv): update * docs(srv): update * docs(srv): update * docs(srv): update * docs(srv): update * docs(srv): update * docs(srv): update * docs(srv): update * Update pages/serverless-containers/reference-content/containers-sandbox.mdx Co-authored-by: Thomas TACQUET <[email protected]> * Update pages/serverless-functions/reference-content/functions-sandbox.mdx Co-authored-by: Thomas TACQUET <[email protected]> * Update pages/serverless-containers/reference-content/containers-limitations.mdx Co-authored-by: Benedikt Rollik <[email protected]> * Apply suggestions from code review Co-authored-by: ldecarvalho-doc <[email protected]> --------- Co-authored-by: Thomas TACQUET <[email protected]> Co-authored-by: Benedikt Rollik <[email protected]> Co-authored-by: ldecarvalho-doc <[email protected]>
1 parent 58f3202 commit 4514129

File tree

12 files changed

+154
-8
lines changed

12 files changed

+154
-8
lines changed

‎menu/navigation.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3929,6 +3929,10 @@
39293929
"label": "Functions autoscaling",
39303930
"slug": "functions-autoscaling"
39313931
},
3932+
{
3933+
"label": "Functions sandbox",
3934+
"slug": "functions-sandbox"
3935+
},
39323936
{
39333937
"label": "Code examples",
39343938
"slug": "code-examples"
@@ -4097,6 +4101,10 @@
40974101
"label": "Containers port parameter",
40984102
"slug": "port-parameter-variable"
40994103
},
4104+
{
4105+
"label": "Containers sandbox",
4106+
"slug": "containers-sandbox"
4107+
},
41004108
{
41014109
"label": "Differences between Jobs, Functions and Containers",
41024110
"slug": "difference-jobs-functions-containers"

‎pages/serverless-containers/concepts.mdx

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,8 +193,10 @@ This process ensures a seamless update experience, minimizing user disruption du
193193
## Sandbox
194194

195195
A sandbox is an isolation area for your container. Serverless Containers offer two sandboxing environments:
196-
- **v2** - Recommended for faster cold starts. Can introduce some overhead on specific workflows with consequent amount of *syscalls*.
197-
- **v1** - Legacy sandboxing with slower cold starts, but fully supports Linux system call interface. Prefer this option when processing large amounts of *syscalls*.
196+
- **v1** - Legacy sandboxing with slower cold starts, but fully supports Linux syscall interface.
197+
- **v2** - Recommended for faster cold starts, but only supports a selection of Linux syscalls.
198+
199+
Refer to the [dedicated documentation](/serverless-containers/reference-content/containers-sandbox/) for more information on sandbox environments.
198200

199201
## Scale to zero
200202

‎pages/serverless-containers/faq.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,9 +144,13 @@ Ensure that your code avoids heavy computations or long-running initialization a
144144

145145
### Which Linux syscalls are supported?
146146

147+
Serverless Containers offer two sandboxing environments:
148+
147149
- [Sandbox](/serverless-containers/concepts/#sandbox) v1 guarantees full compatibility with Linux syscalls.
148150

149-
- [Sandbox](/serverless-containers/concepts/#sandbox) v2 relies on [gVisor](https://gvisor.dev/), which implements a selection of syscalls. Refer to the [official gVisor documentation](https://gvisor.dev/docs/user_guide/compatibility/linux/amd64/) for a comprehensive list of supported syscalls.
151+
- [Sandbox](/serverless-containers/concepts/#sandbox) v2 relies on [gVisor](https://gvisor.dev/), which implements a selection of syscalls.
152+
153+
Refer to the [dedicated documentation](/serverless-containers/reference-content/containers-sandbox/) for more information on sandboxing environments.
150154

151155
### What are the limitations of Serverless Containers?
152156

‎pages/serverless-containers/reference-content/containers-limitations.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ When container CPU and/or memory are not provided by the client, these default v
9898
| Resources | Default value |
9999
|-----------|----------------|
100100
| CPU | 1000 mvCPU |
101-
| Memory | 2048 MB |
101+
| Memory | 2048 MB |
102102

103103
## Architecture
104104

@@ -127,3 +127,7 @@ Below is an example than illustrates this behavior:
127127
* Time +2H: Despite the failed deployment, the first container is still handling incoming requests.
128128
* Time +25H: The 24-hour window expires, and both the first working container and the failed container are removed,
129129
leading to service disruption until a new successful deployment is made.
130+
131+
## Containers sandbox
132+
133+
Refer to the [dedicated documentation](/serverless-containers/reference-content/containers-sandbox/) for more information on the limitations of sandbox environments for Serverless Containers.

‎pages/serverless-containers/reference-content/containers-sandbox.mdx

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
meta:
3+
title: Containers sandbox
4+
description: Learn more about the sandboxing environments of Scaleway Serverless Containers.
5+
content:
6+
h1: Containers sandbox
7+
paragraph: Learn more about the sandboxing environments of Scaleway Serverless Containers.
8+
tags: containers sandbox sandboxing gvisor isolation mechanism serverless v1 v2 clock drift skew
9+
dates:
10+
validation: 2025-05-07
11+
posted: 2025-05-07
12+
categories:
13+
- serverless
14+
- containers
15+
---
16+
17+
In the context of Scaleway Serverless Containers, a [Sandbox environment](/serverless-containers/concepts/#sandbox) is a critical security mechanism that isolates each container from others, ensuring that they operate in a secure and controlled space. Containers run in dedicated execution environments that prevent unauthorized access and potential interference between different resources.
18+
19+
Scaleway Serverless Containers offers two sandbox environment options:
20+
21+
- Sandbox v1 (legacy)
22+
- Sandbox v2 (recommended)
23+
24+
## Sandbox v1
25+
26+
Sandbox v1 is Serverless Containers' legacy sandboxing environment with slower [cold starts](/serverless-containers/concepts/#cold-start), but fully supports Linux system call interface.
27+
28+
<Message type="important">
29+
Sandbox v1 is known to experience clock drift over time. A difference of approximately **two seconds** can be observed after 24 hours of uninterrupted execution. This issue especially affects long-running containers, whereas short-lived containers are much less impacted. Update to sandbox v2 to solve the issue.
30+
</Message>
31+
32+
## Sandbox v2
33+
34+
Sandbox v2 is a modern isolation environment that relies on [gVisor](https://gvisor.dev/). This option offers faster [cold starts](/serverless-containers/concepts/#cold-start), but only implements a selection of Linux syscalls.
35+
Refer to the [official gVisor documentation](https://gvisor.dev/docs/user_guide/compatibility/linux/amd64/) for a comprehensive list of supported syscalls.

‎pages/serverless-containers/troubleshooting/cannot-deploy-image.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ I am unable to deploy my image using Serverless Containers.
1919

2020
## Possible solutions
2121

22-
- Make sure the container is listening on the specified PORT for HTTP requests (or use variable `$PORT`).
22+
- Make sure the container is listening on the specified PORT for HTTP requests (or use variable `$PORT`). Refer to the [dedicated documentation](/serverless-containers/reference-content/port-parameter-variable/) for more information.
2323

2424
- Make sure the container is bound to `0.0.0.0`.
2525

‎pages/serverless-containers/troubleshooting/container-clock-drift.mdx

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
meta:
3+
title: I am experiencing clock drift with my container
4+
description: Discover the causes and solutions to clock drift issues in Scaleway Serverless Containers.
5+
content:
6+
h1: I am experiencing clock drift with my container
7+
paragraph: Discover the causes and solutions to clock drift issues in Scaleway Serverless Containers.
8+
tags: containers clock drift skew error time difference serverless troubleshooting
9+
dates:
10+
validation: 2025-05-07
11+
posted: 2025-05-07
12+
categories:
13+
- serverless
14+
- containers
15+
---
16+
17+
## Problem
18+
19+
The clock of my Serverless Container is slowly drifting.
20+
21+
## Cause
22+
23+
The internal clock of a Serverless Container executed in a [Sandbox v1](/serverless-containers/reference-content/containers-sandbox/) environment is known to slowly drift over time, to reach a clock skew of approximately **two seconds** after 24 hours.
24+
25+
## Solution
26+
27+
[Update the sandbox environment](/serverless-containers/how-to/manage-a-container/#how-to-manage-a-container-deployment) of your Serverless Container to [Sandbox v2](/serverless-containers/reference-content/containers-sandbox/#sandbox-v2) to solve clock drift issues.

‎pages/serverless-containers/troubleshooting/index.mdx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,3 +69,4 @@ categories:
6969
- [I cannot retrieve an external image for my container](/serverless-containers/troubleshooting/cannot-retrieve-external-image/)
7070
- [My container stopped working after a redeploy](/serverless-containers/troubleshooting/container-stopped-after-redeploy/)
7171
- [Tests fail on Serverless Containers](/serverless-containers/troubleshooting/tests-fail-on-container/)
72+
- [I am experiencing clock drift with my Serverless Containers](/serverless-containers/troubleshooting/container-clock-drift/)

‎pages/serverless-functions/concepts.mdx

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,8 +153,10 @@ The runtime is the execution environment of your function. Regarding Serverless
153153
## Sandbox
154154

155155
A sandbox is an isolation area for your function. Serverless Functions offer two sandboxing environments:
156-
- **v2** - Recommended for faster cold starts.
157-
- **v1** - Legacy sandboxing with a slower cold start, but fully supports Linux system call interface.
156+
- **v1** - Legacy sandboxing with slower cold starts, but fully supports Linux syscall interface.
157+
- **v2** - Recommended for faster cold starts, but only supports a selection of Linux syscalls.
158+
159+
Refer to the [dedicated documentation](/serverless-functions/reference-content/functions-sandbox/) for more information on sandbox environments.
158160

159161
## Scale to zero
160162

‎pages/serverless-functions/reference-content/functions-sandbox.mdx

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
meta:
3+
title: Functions sandbox
4+
description: Learn more about the sandboxing environments of Scaleway Serverless Functions.
5+
content:
6+
h1: Functions sandbox
7+
paragraph: Learn more about the sandboxing environments of Scaleway Serverless Functions.
8+
tags: functions sandbox sandboxing gvisor isolation mechanism serverless v1 v2 clock drift skew
9+
dates:
10+
validation: 2025-03-13
11+
posted: 2021-10-12
12+
categories:
13+
- serverless
14+
- functions
15+
---
16+
17+
In the context of Scaleway Serverless Functions, a [Sandbox environment](/serverless-functions/concepts/#sandbox) is a critical security mechanism that isolates each function from others, ensuring that they operate in a secure and controlled space. Functions run in dedicated execution environments that prevent unauthorized access and potential interference between different resources.
18+
19+
Scaleway Serverless Functions offers two sandbox environment options:
20+
21+
- Sandbox v1 (legacy)
22+
- Sandbox v2 (recommended)
23+
24+
## Sandbox v1
25+
26+
Sandbox v1 is Serverless Functions' legacy sandboxing environment with slower [cold starts](/serverless-functions/concepts/#cold-start), but fully supports Linux system call interface.
27+
28+
<Message type="important">
29+
Sandbox v1 is known to experience clock drift over time. A difference of approximately **two seconds** can be observed after 24 hours of uninterrupted execution. This issue especially affects long-running functions, whereas short-lived functions are much less impacted. Update to sandbox v2 to solve the issue.
30+
</Message>
31+
32+
## Sandbox v2
33+
34+
Sandbox v2 is a modern isolation environment that relies on [gVisor](https://gvisor.dev/). This option offers faster [cold starts](/serverless-functions/concepts/#cold-start), but only implements a selection of Linux syscalls.
35+
Refer to the [official gVisor documentation](https://gvisor.dev/docs/user_guide/compatibility/linux/amd64/) for a comprehensive list of supported syscalls.

0 commit comments

Comments
 (0)