chore: merge updated stage 2 into durable configuration operations

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

e2e/python/Dockerfile.workload

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+ARG WORKLOAD_BASE=nvcr.io/nvidia/base/ubuntu:24.04
+FROM ghcr.io/astral-sh/uv:0.12.17@sha256:10787c682e4184e4f290de1171fd4703dc63de99221f10fe1c99002ce7fa9acc AS uv
+FROM ${WORKLOAD_BASE}
+
+COPY --from=uv /uv /uvx /usr/local/bin/
+# Supplied from .python-version by the build task for cloudpickle compatibility.
+ARG PYTHON_VERSION
+# curl and openssl also support the Rust Docker tests sharing this fixture.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        bash ca-certificates curl git openssl python3 python3-pip python3-venv python-is-python3 \
+    && rm -rf /var/lib/apt/lists/* \
+    && if getent passwd ubuntu >/dev/null; then userdel ubuntu; fi \
+    && if getent group ubuntu >/dev/null; then groupdel ubuntu; fi \
+    && groupadd --gid 1000 sandbox \
+    && useradd --uid 1000 --gid sandbox --create-home --shell /bin/bash sandbox \
+    && UV_PYTHON_INSTALL_DIR=/sandbox/.uv/python uv python install "${PYTHON_VERSION}" \
+    && UV_PYTHON_INSTALL_DIR=/sandbox/.uv/python uv venv --python "${PYTHON_VERSION}" --seed /sandbox/.venv \
+    && uv pip install --python /sandbox/.venv/bin/python cloudpickle==3.1.2 \
+    && chown -R sandbox:sandbox /sandbox \
+    && uv cache clean
+
+ENV VIRTUAL_ENV=/sandbox/.venv
+ENV PATH="/sandbox/.venv/bin:${PATH}"
+WORKDIR /sandbox
+USER sandbox:sandbox

e2e/python/conftest.py

@@ -93,8 +93,7 @@ def sandbox(cluster_name: str | None) -> Callable[..., Sandbox]:
             cluster=cluster_name,
             spec=spec,
             delete_on_exit=delete_on_exit,
-            # The sandbox image is large (Python, Node.js, coding agents) so the
-            # first pod in the cluster may need extra time for the image pull.
+            # Allow time to pull an explicitly supplied workload fixture.
             ready_timeout_seconds=300.0,
         )
 

e2e/python/test_sandbox_api.py

@@ -206,6 +206,50 @@ def test_sandbox_interactive_exec_honors_tty(
         assert b"TTT" in stdout + stderr
 
 
+def test_interactive_exec_drains_output_after_request_eof(
+    sandbox: Callable[..., Sandbox],
+    sandbox_client: SandboxClient,
+) -> None:
+    with sandbox(delete_on_exit=True) as sb:
+
+        def requests():
+            yield openshell_pb2.ExecSandboxInput(
+                start=openshell_pb2.ExecSandboxRequest(
+                    sandbox=sb.sandbox.name,
+                    workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default"),
+                    command=[
+                        "/bin/sh",
+                        "-c",
+                        "input=$(cat); sleep 0.2; "
+                        "printf '%s' \"$input\"; printf 'drained-stderr' >&2; exit 7",
+                    ],
+                    tty=False,
+                    execution_timeout=duration_pb2.Duration(seconds=20),
+                )
+            )
+            yield openshell_pb2.ExecSandboxInput(stdin=b"drained-stdout")
+            # End requests before the command emits output. The receive
+            # direction must survive long enough to drain both output streams.
+
+        stdout = bytearray()
+        stderr = bytearray()
+        exit_codes: list[int] = []
+        for event in sandbox_client._stub.ExecSandboxInteractive(
+            requests(), timeout=30
+        ):
+            assert not exit_codes, "received another event after terminal exit"
+            payload = event.WhichOneof("payload")
+            if payload == "stdout":
+                stdout.extend(event.stdout.data)
+            elif payload == "stderr":
+                stderr.extend(event.stderr.data)
+            elif payload == "exit":
+                exit_codes.append(event.exit.exit_code)
+        assert stdout == b"drained-stdout"
+        assert stderr == b"drained-stderr"
+        assert exit_codes == [7]
+
+
 def test_list_scoped_and_for_all_workspaces(
     sandbox_client: SandboxClient,
     workspace_client: WorkspaceClient,