feat: GKE multi-container support via privileged DinD compose#1773
Merged
Conversation
Adds Docker-in-Docker compose support to the GKE environment so multi-container tasks (those shipping a docker-compose.yaml) can run on GKE Standard. A single privileged dind pod runs dockerd; `docker compose` orchestrates the task's services inside it, and exec/upload/download target the `main` service via a two-hop path (k8s exec into the dind container, then `docker compose exec`/`cp`). Rebuilt on top of the current compose model (rather than the stale harbor-framework#1242 branch): - Reuses the shared compose templates and the `write_resources_compose_file` override (parity with the Daytona/Modal DinD strategies) instead of the removed docker-compose-base.yaml. - `capabilities()` advertises accelerators only in single-container mode; a task that ships docker-compose.yaml AND requests a GPU/TPU is rejected at preflight. No env supports TPU-in-compose, and a privileged dind pod cannot expose an accelerator into nested compose services. - Outer pod sized to the task's total budget, Burstable in AUTO mode (no fabricated daemon-overhead constant); inner `main` resources override only imposes a hard limit when the task sets ResourceMode.LIMIT. - Two-hop transfer reuses the existing python kubernetes-client exec/tar machinery (no new kubectl dependency); the single-container Direct path is untouched apart from extracting the shared `_create_pod` / pod-delete helpers. Requires GKE Standard (Autopilot blocks privileged pods). The DinD runtime path needs a kind/GKE smoke test before merge. Co-Authored-By: Claude Opus 4.7 <[email protected]>
Contributor
|
Enjoy a better diff viewing experience by clicking one of these URLs: |
alexgshaw
self-requested a review
May 31, 2026 03:10
alexgshaw
approved these changes
May 31, 2026
Messimeimei
added a commit
to Messimeimei/bitfun-harbor
that referenced
this pull request
Jul 7, 2026
700972a fix(gemini_cli): pre-select auth method for headless API-key/Vertex runs (harbor-framework#1794) 590f4f7 Fix installed agent ATIF exports (harbor-framework#1812) 9f65643 Update Islo SDK integration (harbor-framework#1824) 6cd496d fix(job): disable Rich stdout/stderr redirect to avoid deadlocks (harbor-framework#1829) 66cffed Suppress litellm debug output unless --debug is enabled (harbor-framework#1828) 48a577a Open PR diff links in a new tab. (harbor-framework#1831) ae938b8 feat: GKE multi-container support via privileged DinD compose (harbor-framework#1773) e1066b5 Add use.computer environment (harbor-framework#1834) 0f08f40 fix(pi): Reduce logging footprint (harbor-framework#1826) 9801da1 Update mini_swe_agent.py (harbor-framework#1837) 918a791 fix(check): accept all Claude auth methods, preferring the free subscription (harbor-framework#1766) 13f9692 fix(env): tar-based directory transfers for Modal, Daytona, and GKE (harbor-framework#1838) 8cfac6a Add Docker Compose support to Novita (harbor-framework#1830) c978013 harbor-langsmith: persist run tags (top-level) and dataset metadata (under extra) (harbor-framework#1808) a56546f Support wildcard network allowlist hosts (harbor-framework#1840) 6cd263a feat: add LangSmith sandbox environment (harbor-framework#1610) e75ecc0 rewardkit: add REWARDKIT_MODEL override for agent judges (harbor-framework#1778) 9c78b85 Update Claude Code bootstrap installer URL (harbor-framework#1852) 6a21701 Added cline v2 and ATIF Trajectory support (harbor-framework#1495) 6996f65 feat(claude_code): support CLAUDE_FORCE_OAUTH to bill the subscription on harbor run (harbor-framework#1846) 904b323 Add built-in LangGraph agent (harbor-framework#1807) b8976c9 Add GPU support to the Daytona environment (harbor-framework#1731) 2922220 Preserve tagged Docker images on delete (harbor-framework#1861) c2c5796 Improve use.computer environment (harbor-framework#1853) 3de07a0 add session-id header (harbor-framework#1855) 3f941bd ci: fix ai-review fork-PR checkout for claude-code-action@v1 (harbor-framework#1874) cdee965 Add network policy docs page under Tasks 253c546 Document environment support for network modes, phases, and capabilities 8d3384a Add Novita network policy support (harbor-framework#1867) 5270111 add procps to prevent process crashes when claude-code call tree-kill (harbor-framework#1864) 4195631 Add generic ACP registry agent support (harbor-framework#1464) 96eaf6b v0.13.2 Co-authored-by: Cursor <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Docker-in-Docker compose support to the GKE environment so multi-container tasks (those shipping a docker-compose.yaml) can run on GKE Standard. A single privileged dind pod runs dockerd;
docker composeorchestrates the task's services inside it, and exec/upload/download target themainservice via a two-hop path (k8s exec into the dind container, thendocker compose exec/cp).Rebuilt on top of the current compose model (rather than the stale #1242 branch):
write_resources_compose_fileoverride (parity with the Daytona/Modal DinD strategies) instead of the removed docker-compose-base.yaml.capabilities()advertises accelerators only in single-container mode; a task that ships docker-compose.yaml AND requests a GPU/TPU is rejected at preflight. No env supports TPU-in-compose, and a privileged dind pod cannot expose an accelerator into nested compose services.mainresources override only imposes a hard limit when the task sets ResourceMode.LIMIT._create_pod/ pod-delete helpers.Requires GKE Standard (Autopilot blocks privileged pods). The DinD runtime path needs a kind/GKE smoke test before merge.
Co-Authored-By: Claude Opus 4.7 [email protected]