Install the E2B gateway
This page shows how to install the E2B gateway so that programs built on the E2B SDK can connect to Kibotos.
Prerequisites
- You have ctrl, nodes, and at least one usable Template in place, in the order given in Installation overview.
- A dedicated Operator identity for the gateway: an enrollment key, or an identity directory enrolled as described in Identity and enrollment. Each instance needs its own identity.
- The gateway uses the same release set as ctrl and the nodes.
1. Install the package and write the configuration
set -eu
sudo apt-get install ./kibotos-e2b_1.2.3_amd64.deb
sudo test ! -e /etc/kibotos/e2b/config.env
sudo install -o root -g root -m 0600 \
/usr/share/doc/kibotos-e2b/e2b.example.env /etc/kibotos/e2b/config.env
sudoedit /etc/kibotos/e2b/config.envThe package creates the kibotos-e2b account and the service unit; it neither starts nor enables the service. All of the gateway's configuration goes in this file. It uses the systemd EnvironmentFile format, does not support shell expressions, and is read by systemd. Keep it root:root 0600. For a full example, see e2b.example.env.
| Variable | Description |
|---|---|
KIBOTOS_E2B_API_KEYS | The API keys accepted from outside, comma-separated, at least one |
KIBOTOS_E2B_NAMESPACE | A fixed name for this gateway deployment. It must be a label value (at most 63 letters, digits, -, _, ., starting and ending with a letter or digit). All instances of the same deployment use the same value. Another E2B gateway deployment sharing the same ctrl uses a different value, and the two cannot see each other's sandboxes and volumes. If you change it, existing sandboxes and volumes no longer exist for this gateway deployment |
KIBOTOS_E2B_TOKEN_KEYS | Keys for deriving sandbox access tokens, in the format kid:base64key, comma-separated. The first is the current key. All instances of the same deployment use the same value. Generate one with openssl rand -base64 32. Rotate keys in two rounds: first add the new key after the current key on all instances, and after all are done, move it to the front on all instances. Keep the old key while any sandbox still uses it |
KIBOTOS_E2B_IDENTITY_DIR | The absolute path of the Operator identity directory. The service can write only to /var/lib/kibotos/e2b/, so put it there. Required; the examples use /var/lib/kibotos/e2b/identity |
KIBOTOS_E2B_ENROLLMENT_KEY_FILE | Optional. When the identity directory is empty, the gateway enrolls with this one-time enrollment key. See the next step |
KIBOTOS_E2B_CTRL_ENDPOINT | The HTTPS address of ctrl |
KIBOTOS_E2B_DOMAIN / KIBOTOS_E2B_PUBLIC_BASE_URL | The sandbox domain, and the HTTPS address of the external control API |
KIBOTOS_E2B_LISTEN | The listen address of the control API, 127.0.0.1:18095 by default. The reverse proxy forwards all requests here, including envd requests for 49983-<sandboxID>.<domain> |
KIBOTOS_E2B_ENVD_LISTEN | A second listen address that serves only the envd protocol, 127.0.0.1:18096 by default. The reverse proxy does not need to route to it. Keep it on loopback |
To provide sandbox metrics, also fill in the KIBOTOS_E2B_METRICS_* variables. See E2B gateway configuration. Without them, the two sandbox metrics endpoints return 501.
2. Prepare the identity and start
Prepare the gateway's Operator identity and start the service as described in Prepare the identity and start on the Exposure gateway page, using the E2B gateway's names from the table there. Then check the service:
sudo systemctl status kibotos-e2b.service
sudo journalctl -u kibotos-e2b.service -n 100 --no-pagerNotes:
- When configuration is missing or a value is invalid, the service cannot start. The log lists all problematic variable names at once, without printing their values. The gateway verifies the contents of the identity directory.
- The gateway has no database of its own. Several instances can serve the same set of sandboxes at the same time, each caching what it reads from ctrl. They use the same
KIBOTOS_E2B_NAMESPACEandKIBOTOS_E2B_TOKEN_KEYS, and each has its own identity.
3. Optional: tune runtime parameters
The following variables all have defaults. When needed, write them into /etc/kibotos/e2b/config.env and restart the gateway. The gateway accepts no command-line flags.
| Variable | Default | Description |
|---|---|---|
KIBOTOS_E2B_DEFAULT_TIMEOUT | 1h | The sandbox lifetime when a request specifies no timeout, as a Go duration |
KIBOTOS_E2B_MAX_TIMEOUT | No limit | The longest lifetime a single request may ask for. create and connect beyond it return 400 |
KIBOTOS_E2B_DEFAULT_CPU_MILLIS | 1000 | The CPU requested when creating a Workspace |
KIBOTOS_E2B_DEFAULT_MEMORY_BYTES | 1073741824 | The memory requested when creating a Workspace |
KIBOTOS_E2B_DEFAULT_DISK_BYTES | 5368709120 | The writable root file system space requested when creating a Workspace. It must be a whole number of MiB. It takes up capacity in the node's storage pool from placement on |
KIBOTOS_E2B_NATIVE_PROXY | Not used | A forward proxy for connecting to ctrl, as an http, https, or socks5 URL |
KIBOTOS_E2B_TELEMETRY_LISTEN | Not listening | The metrics listen address, for example 127.0.0.1:18195. See Cluster and service metrics |
4. Configure the reverse proxy
The deployer provides DNS, HTTPS certificates, and a reverse proxy for api.<domain> and *.<domain>:
- Preserve the original Host header and forward requests to the control API's listen address.
- Turn off buffering for streaming responses and uploads.
- When the SDK accesses
49983-<sandboxID>.<domain>, the gateway finds the sandbox by domain name, then verifies the envd token. For<port>-<sandboxID>.<domain>with any other port, the gateway proxies the request to that port in the sandbox.
Install the Exposure gateway
This page shows how to install the Exposure gateway so that HTTP services in Workspaces can be reached through public URLs.
Run in containers
Each release of ctrl, the E2B gateway, and the Exposure gateway also ships container images that you can run with Kubernetes or Docker. You still install node on hosts. See Install node. Use these images if you operate a container platform.