On demand plugins by mjh1 · Pull Request #541 · daydreamlive/scope

mjh1 · 2026-02-26T11:39:04Z

Cloud Plugin Support & Separate Docker Image

Summary

Add a dedicated cloud Docker image (Dockerfile.cloud) and update CI to build both standard and cloud variants using a matrix strategy, with -cloud suffixed image tags
- Main reason was to speed up cloud load times, i found that it was faster to not install any of the dependencies into the image and download them at runtime instead. They total about 8gb so it really slows down the docker image pull (and github build times). I also omit the frontend from this image.
Enable whitelisted plugin installation in cloud mode — instead of blocking all plugin installs, plugins are now allowed if they match an entry in the CLOUD_PLUGINS_WHITELIST environment variable (with URL normalization for flexible matching)
Proxy plugin API endpoints through the cloud WebSocket — the /health, /api/v1/restart, and all /api/v1/plugins endpoints now use the @cloud_proxy() decorator so the frontend can manage plugins on the remote cloud instance
Clean up plugins between sessions — on WebSocket disconnect, all installed plugins are uninstalled and session data is wiped, with a gate (_cleanup_event) that blocks the next connection's "ready" message until cleanup finishes
Harden cloud subprocess environment — the scope subprocess now receives only whitelisted environment variables instead of inheriting the full parent environment

Changes

File	What changed
`Dockerfile.cloud`	New cloud-specific Dockerfile based on `nvidia/cuda:12.8.0-cudnn-runtime-ubuntu24.04`
`.github/workflows/docker-build.yml`	Matrix strategy for `standard` / `cloud` builds with per-variant tags, dockerfiles, and GHA cache scopes
`src/scope/cloud/fal_app.py`	Whitelist-based plugin install gating, plugin cleanup on disconnect, env var whitelisting, `uv run --extra kafka` instead of pre-install, assets dir moved to `/tmp/`
`src/scope/server/app.py`	Added `@cloud_proxy()` to health, restart, and all plugin CRUD endpoints; renamed `request` -> `http_request` to avoid shadowing

You can now connect to cloud and go to the plugin settings discover tab and click install, same as the local experience.

Signed-off-by: Max Holland <[email protected]>

This reverts commit 2eae6ee. Signed-off-by: Max Holland <[email protected]>

Signed-off-by: Max Holland <[email protected]>

src/scope/cloud/fal_app.py

Signed-off-by: Max Holland <[email protected]>

disable plugins install while stream running or cloud connecting Signed-off-by: Max Holland <[email protected]>

mjh1 · 2026-02-27T16:19:08Z

@emranemran hopefully you don't mind me leaving all the commits untidy, i wanted to preserve the history of doing the built in plugins to begin with.

Signed-off-by: Max Holland <[email protected]>

cursor · 2026-03-02T15:58:08Z

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 6.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

leszko

Added some comments. PTAL.Please send me also some environment where I can test it. Thanks.

leszko · 2026-03-02T15:45:12Z

src/scope/cloud/fal_app.py

+                    normalized = re.sub(r"^git\+https?://", "", normalized)
+                    normalized = re.sub(r"^https?://", "", normalized)


So, we support only URLs for plugins, right? Not local path and not PyPI packages. If that's the intention, then I'd add some comment about it. Maybe even in UI, it should be explicit that if you're in the cloud mode, you can only install from URLs.

I'll add a note to the UI 👍 in cloud mode we're only allowing installation from the discover tab for now, url entry is hidden.

src/scope/cloud/fal_app.py

leszko · 2026-03-02T15:51:55Z

src/scope/cloud/fal_app.py

+            for plugin in plugins:
+                name = plugin.get("name")
+                if not name:
+                    continue
+                try:
+                    resp = await client.delete(
+                        f"{scope_url}/api/v1/plugins/{name}", timeout=60.0
+                    )
+                    if resp.status_code == 200:
+                        print(f"Cleanup: uninstalled plugin '{name}'")
+                    else:
+                        print(
+                            f"Warning: Failed to uninstall plugin '{name}': {resp.status_code}"
+                        )
+                except Exception as e:
+                    print(f"Warning: Failed to uninstall plugin '{name}': {e}")


I wonder if it would make sense to delete plugins in parallel?

Are you sure that will be ok? I can test it out anyway

hmm maybe i'll avoid it for now:

There are a few concurrency hazards: - pipeline_manager.unload_pipeline_by_id() mutates shared state (_pipelines, _pipeline_statuses, _pipeline_load_params dicts, and main pipeline state). The internal helper is even named _unload_pipeline_by_id_unsafe -- it must be called with the lock held. Running multiple unloads concurrently risks corrupting that shared state. - CUDA cleanup -- each uninstall calls torch.cuda.empty_cache() and torch.cuda.synchronize(). Concurrent calls to these while pipelines are being torn down could interfere with each other. - pip uninstall -- the sync implementation ultimately shells out to pip. Running multiple pip processes concurrently is not safe; pip uses a single shared site-packages directory and doesn't handle concurrent modifications. - The plugin manager lock (self._lock) only guards the registry unregister section, not the entire uninstall operation, so it doesn't provide end-to-end protection.

I was thinking it sounded risky to have concurrent pip commands.

leszko · 2026-03-02T15:54:41Z

src/scope/cloud/fal_app.py

+            "KAFKA_BOOTSTRAP_SERVERS",
+            "KAFKA_TOPIC",
+            "KAFKA_SASL_USERNAME",
+            "KAFKA_SASL_PASSWORD",


Ok, since we pass credentials into Scope, do we already have some safeguard for the plugins that are added into Daydream Plugin registry?

My plan is to create a write only user for this so that if they ever did leak it would be much less of a concern, they wouldn't be able to read our data. Then we can also have a scan over the current plugins to check nothing looks dangerous.

leszko · 2026-03-02T15:55:45Z

src/scope/cloud/fal_app.py

+                    return normalized
+
+                def is_plugin_whitelisted(package: str) -> bool:
+                    raw = os.getenv("CLOUD_PLUGINS_WHITELIST", "")


How are you going to update this plugin list env variable?

This is a variable that lives in fal, it can be updated through their CLI or web dashboard.

ok, but who will update it? Will we have some automation which will take our plugins and update this variable?

leszko · 2026-03-02T16:01:16Z

.github/workflows/fal-deploy.yml

        uses: actions/setup-python@v5
        with:
-          python-version: '3.10'
+          python-version: '3.12'


Are we sure that using different Python version won't have any effect?

It looks good in testing, I can do some more exhaustive testing though. In our pyproject file we specify python 3.12 so I think this was just an accidental case where the docker images were on 3.10 because that was the default installed with the older ubuntu version. I updated that which means it also needs to be updated here for the fal deploy.

leszko · 2026-03-02T16:11:42Z

src/scope/cloud/fal_app.py

            request_id = payload.get("request_id")

-            # Block plugin installation in cloud mode (security: prevent arbitrary code execution)
            if method == "POST" and path == "/api/v1/plugins":


I wonder if this check is good enough. The path comes from the WebSocket message payload, so someone could hack like /api/v1/plugins?hack=true and then this check will not apply. Isn't that an issue?

oh yep good spot!

github-actions · 2026-03-02T16:33:14Z

🚀 fal.ai Preview Deployment


App ID	`daydream/scope-pr-541--preview`
WebSocket	`wss://fal.run/daydream/scope-pr-541--preview/ws`
Commit	`50aacd6`

Testing

Connect to this preview deployment by running this on your branch:

uv run build && SCOPE_CLOUD_APP_ID="daydream/scope-pr-541--preview/ws" uv run daydream-scope

🧪 E2E tests will run automatically against this deployment.

github-actions · 2026-03-02T16:37:17Z

✅ E2E Tests passed


Status	passed
fal App	`daydream/scope-pr-541--preview`
Run	View logs

Test Artifacts

Check the workflow run for screenshots.

leszko · 2026-03-03T09:15:56Z

A few more comments after trying it out:

What about the artifacts defined in the plugins, do we plan to store all model weights for each plugin in the network storage in FAL?
I tried LTX-2 plugin and it hasn't worked, could you check?
So, now all plugins installed in the cloud and ephemeral (you reconnect, you don't see them again). I wonder if we should not store locally somewhere the names of the plugins and install them? This is something that @thomshutt mentioned in his doc. Maybe if we have workflow export/import (this week), then it won't be such a pain, because you'll be able to export and import the workflow (which will automatically install all the plugins).

mjh1 · 2026-03-04T13:41:35Z

A few more comments after trying it out:

What about the artifacts defined in the plugins, do we plan to store all model weights for each plugin in the network storage in FAL?

I tried LTX-2 plugin and it hasn't worked, could you check?

So, now all plugins installed in the cloud and ephemeral (you reconnect, you don't see them again). I wonder if we should not store locally somewhere the names of the plugins and install them? This is something that @thomshutt mentioned in his doc. Maybe if we have workflow export/import (this week), then it won't be such a pain, because you'll be able to export and import the workflow (which will automatically install all the plugins).

That's right the model weights all get downloaded to fal on first run, I've done this for all of the current ones.
I'll check that 👍
Yes that's right we plan to solve that with reloading workflows like we discussed earlier.

Signed-off-by: Max Holland <[email protected]>

mjh1 · 2026-03-04T13:51:46Z

Wow that is not what i see locally 🤯 i didn't realise github merged the branch temporarily with main then uses that for these github actions.

Signed-off-by: Max Holland <[email protected]>

leszko

Looks good. The one question that is unanswered is this one:

ok, but who will update it? Will we have some automation which will take our plugins and update this variable?

I just want to make sure we have a plan about updating this. Other than that LGTM. Feel free to Squash and Merge.

Signed-off-by: Max Holland <[email protected]>

mjh1 · 2026-03-05T12:41:40Z

Looks good. The one question that is unanswered is this one:

ok, but who will update it? Will we have some automation which will take our plugins and update this variable?

I just want to make sure we have a plan about updating this. Other than that LGTM. Feel free to Squash and Merge.

Yep i'll make a github action to update it 👍

mjh1 added 14 commits February 23, 2026 17:33

Build plugins into docker image

e96964b

Signed-off-by: Max Holland <[email protected]>

fix

24b214b

Signed-off-by: Max Holland <[email protected]>

separate docker images

b3cf2cc

Signed-off-by: Max Holland <[email protected]>

try to reduce docker image size

6d9f1c7

Signed-off-by: Max Holland <[email protected]>

non root user

6144e68

Signed-off-by: Max Holland <[email protected]>

build at runtime

dd7c9a3

Signed-off-by: Max Holland <[email protected]>

fix fal deploy

d9b1d36

Signed-off-by: Max Holland <[email protected]>

fix

c750dba

Signed-off-by: Max Holland <[email protected]>

fix

d60c4b2

Signed-off-by: Max Holland <[email protected]>

try install plugins in background on app startup

2eae6ee

Signed-off-by: Max Holland <[email protected]>

Revert "try install plugins in background on app startup"

a0a94ca

This reverts commit 2eae6ee. Signed-off-by: Max Holland <[email protected]>

Proxy plugin APIs to cloud

27fa84c

Signed-off-by: Max Holland <[email protected]>

remove plugin preinstall

8d8438c

Signed-off-by: Max Holland <[email protected]>

Proxy health and restart calls

33b5974

Signed-off-by: Max Holland <[email protected]>

mjh1 force-pushed the mh/plugins-od branch from e2bf951 to 33b5974 Compare February 26, 2026 12:20

mjh1 added 3 commits February 26, 2026 12:54

Fix whitelist check

a83c521

Signed-off-by: Max Holland <[email protected]>

plugins cleanup on disconnect

a257028

Signed-off-by: Max Holland <[email protected]>

read whitelist from env var

dd0deec

Signed-off-by: Max Holland <[email protected]>

mjh1 force-pushed the mh/plugins-od branch from ecbb286 to 2e7448e Compare February 26, 2026 17:39

Tidy up for review

0f672a1

Signed-off-by: Max Holland <[email protected]>

mjh1 force-pushed the mh/plugins-od branch from 2e7448e to 0f672a1 Compare February 26, 2026 18:11

mjh1 commented Feb 26, 2026

View reviewed changes

src/scope/cloud/fal_app.py Outdated Show resolved Hide resolved

mjh1 requested a review from emranemran February 26, 2026 18:17

mjh1 added 2 commits February 27, 2026 15:11

Merge branch 'main' into mh/plugins-od

3e7f669

Signed-off-by: Max Holland <[email protected]>

UI tweaks

301401b

disable plugins install while stream running or cloud connecting Signed-off-by: Max Holland <[email protected]>

mjh1 marked this pull request as ready for review February 27, 2026 16:11

mjh1 requested a review from leszko February 27, 2026 16:11

Merge branch 'main' into mh/plugins-od

b420d85

Signed-off-by: Max Holland <[email protected]>

leszko requested changes Mar 2, 2026

View reviewed changes

mjh1 requested a review from leszko March 4, 2026 13:42

Review comments

8340ece

Signed-off-by: Max Holland <[email protected]>

mjh1 force-pushed the mh/plugins-od branch from d4d4712 to 8340ece Compare March 4, 2026 13:47

mjh1 added 2 commits March 4, 2026 13:56

Merge remote-tracking branch 'origin/main' into mh/plugins-od

de17778

fix after merging in main

58256cd

Signed-off-by: Max Holland <[email protected]>

leszko approved these changes Mar 5, 2026

View reviewed changes

Merge branch 'main' into mh/plugins-od

50aacd6

Signed-off-by: Max Holland <[email protected]>

mjh1 merged commit 674efaa into main Mar 5, 2026
7 checks passed

mjh1 deleted the mh/plugins-od branch March 5, 2026 12:02

		normalized = re.sub(r"^git\+https?://", "", normalized)
		normalized = re.sub(r"^https?://", "", normalized)

Conversation

mjh1 commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cloud Plugin Support & Separate Docker Image

Summary

Changes

Uh oh!

Uh oh!

mjh1 commented Feb 27, 2026

Uh oh!

cursor bot commented Mar 2, 2026

Uh oh!

leszko left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mjh1 Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 fal.ai Preview Deployment

Testing

Uh oh!

github-actions bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ E2E Tests passed

Test Artifacts

Uh oh!

leszko commented Mar 3, 2026

Uh oh!

mjh1 commented Mar 4, 2026

Uh oh!

mjh1 commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leszko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mjh1 commented Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mjh1 commented Feb 26, 2026 •

edited

Loading

mjh1 Mar 4, 2026 •

edited

Loading

github-actions bot commented Mar 2, 2026 •

edited

Loading

github-actions bot commented Mar 2, 2026 •

edited

Loading

mjh1 commented Mar 4, 2026 •

edited

Loading