Getting "Error: [Sandbox] PipeToSandbox is closed" on self hosted grist

Hello,

we are trying to run the gristlabs/girst-core:latest docker image with sandboxed pynbox formulas using Authentik as SAML provider behind an apache reverse proxy on a docker swarm manager node (I know lots of possible points of failure)

and we are getting the following error:

In the frontend

ERROR: Error: [Sandbox] PipeToSandbox is closed
_onServerMessage Comm.ts:338
Backbone 4
_processReceivedMessage GristWSConnection.ts:293
onmessage GristWSConnection.ts:219
errors.ts:82:2
GristWSConnection.send[true] 

In the backend:

2022-09-27 14:21:27.102 - debug: ActiveDoc _applyUserActions(Client 4cd2de5cc4b04caf #17, [['UpdateRecord', '_grist_Tables_column', 2, {isFormula: true, formula: 'print("foo")'}], ['AddRecord', 'Table1', null, {}]]) access=owners, userId=6, email=[e-mail], age=0, org=docs, altSessionId=2DKQjc9may2JAfvkdTtQaU, clientId=4cd2de5cc4b04caf, counter=17, docId=wDY9nMDvJhijaQsPEh45r3

2022-09-27 14:21:27.104 - warn: Sharing Unable to apply action... SandboxError: [Sandbox] PipeToSandbox is closed

    at NSandbox._sandboxClosedError (/grist/_build/app/server/lib/NSandbox.js:243:16)

    at NSandbox._sendData (/grist/_build/app/server/lib/NSandbox.js:200:24)

    at NSandbox.pyCall (/grist/_build/app/server/lib/NSandbox.js:148:14)

    at ActiveDoc._rawPyCall (/grist/_build/app/server/lib/ActiveDoc.js:1918:27)

    at async ActiveDoc.applyActionsToDataEngine (/grist/_build/app/server/lib/ActiveDoc.js:1350:35)

    at async Sharing._applyActionsToDataEngine (/grist/_build/app/server/lib/Sharing.js:321:37) access=owners, userId=6, email=[e-mail], age=0, org=docs, altSessionId=2DKQjc9may2JAfvkdTtQaU, clientId=4cd2de5cc4b04caf, counter=17, docId=wDY9nMDvJhijaQsPEh45r3

I guess it might have something to do with websockets, but I’m not certain. Any hint would be highly appreciated. Below are or configs.

docker-compose.yml

version: "3.9"
services:
  grist:
    # even though it is bad practice to use the latest tag, we want the latest state. Last tag v0.7.9 is 4 month old. There has been so many changes since then.
    # Other possibility would be to pull latest and rename the tag to mach some versioning we can use.
    image: gristlabs/grist:latest
    restart: always
    # currently not needed with pynbox
    # once gvisor is available in grist-core we can use it
    # runtime: runsc
    ports:
      - published: 11081
        target: 80
        mode: host
    volumes:
      - grist:/persist
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [ node.role == manager ]
    environment:
      PORT: 80
      APP_DOC_URL: https://$GRIST_DOMAIN
      APP_HOME_URL: https://$GRIST_DOMAIN
      GRIST_ORG_IN_PATH: "true"
      GRIST_DOMAIN: $GRIST_DOMAIN
      # GRIST_HOST: $GRIST_DOMAIN
      # GRIST_DEFAULT_EMAIL: $GRIST_DEFAULT_EMAIL
      GRIST_EXPERIMENTAL_PLUGINS: "true"
      GRIST_SANDBOX_FLAVOR: pynbox
      GRIST_SESSION_SECRET: $GRIST_SESSION_SECRET
      GRIST_SAML_IDP_CERTS: $GRIST_SAML_IDP_CERTS
      GRIST_SAML_SP_KEY: $GRIST_SAML_SP_KEY
      GRIST_SAML_SP_CERT: $GRIST_SAML_SP_CERT
      GRIST_SAML_IDP_LOGIN: $GRIST_SAML_IDP_LOGIN
      GRIST_SAML_IDP_LOGOUT: $GRIST_SAML_IDP_LOGOUT
      GRIST_HIDE_UI_ELEMENTS: helpCenter,billing,templates
      PYTHON_VERSION: 2
      PYTHON_VERSION_ON_CREATION: 2
      GRIST_FORCE_LOGIN: "true"
      GRIST_SAML_IDP_UNENCRYPTED: 1
      GRIST_SAML_SP_HOST: https://$GRIST_DOMAIN
      PIPE_MODE: $PIPE_MODE

volumes:
  grist:

.env

GRIST_DOMAIN=example.com
GRIST_SESSION_SECRET=123456
GRIST_SANDBOX_FLAVOR=pynbox
GRIST_ORG_IN_PATH=true
APP_DOC_URL=https://example.com
APP_HOME_URL=https://example.com
PYTHON_VERSION=2
PYTHON_VERSION_ON_CREATION=2
GRIST_SAML_IDP_LOGIN=https://authentik.example.com/application/saml/grist/sso/binding/redirect/
GRIST_SAML_IDP_LOGOUT=https://authentik.example.com/if/session-end/grist/
GRIST_SAML_IDP_CERTS=/persist/saml/grist_idp.cert
GRIST_SAML_SP_KEY=/persist/saml/grist_private_key.key
GRIST_SAML_SP_CERT=/persist/saml/grist_certificate.cert
GRIST_EXPERIMENTAL_PLUGINS=true
GRIST_HIDE_UI_ELEMENTS=helpCenter,billing,templates
GRIST_FORCE_LOGIN=true
GRIST_SAML_IDP_UNENCRYPTED=1
GRIST_SAML_SP_HOST=https://example.com

apache config (Stolen from many parts of the web)

RewriteEngine On
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*)           ws://localhost:11081/$1 [P,L]
RewriteCond %{HTTP:Upgrade} !=websocket [NC]
RewriteRule /(.*)           http://localhost:11081/$1 [P,L]

#
ProxyPreserveHost On
ProxyRequests off
ProxyPass / http://localhost:11081/
ProxyPassReverse / http://localhost:11081/
RequestHeader set X-Forwarded-Proto https

---

Edit 1:

• Setting GRIST_HOST breaks things in docker

[paulfitz]

I actually only went for pynbox and python 2 because of that gibt in the source code about gvisor not being available in grist-core and because it didn’t work in my first try.

Anyway. Thank you again

Oh gosh thanks for pointing me to that @ff6347, I’ll update that out-of-date comment. Cheers!

[ff6347]

I actually only went for pynbox and python 2 because of that gibt in the source code about gvisor not being available in grist-core and because it didn’t work in my first try.

Anyway. Thank you again