Docs

Volcano Engine Function as a Service

Cloud sandboxes

Integrating veRL with veFaaS cloud sandbox

This topic describes how to obtain the configuration parameters required for integrating veRL with the veFaaS cloud sandbox, and how to complete environment integration and connectivity verification.

Background information

The core technologies and platform concepts involved in this topic are described as follows:

Cloud sandbox: A cloud-based temporary execution environment that provides secure isolation and controlled resources, used to safely run code or tasks without impacting external systems.

veRL (Volcano Engine Reinforcement Learning): An open-source reinforcement learning training framework for LLMs from Volcano Engine. It enables efficient RLHF alignment training and supports integration with cloud sandboxes for secure tool execution and environment interaction.

LLM (Large Language Model): A large-parameter language model based on the Transformer architecture, trained on massive text data. It possesses capabilities for understanding, generating, reasoning, and conversing, serving as the core foundation of current AI applications.

RLHF (Reinforcement Learning from Human Feedback): An alignment training method used to make LLM outputs more consistent with human intent, safer, and more reliable.

SWE-bench: A benchmark dataset and evaluation framework specifically designed to assess the capabilities of LLMs on real-world software engineering tasks.

Prerequisites

The API access key has been obtained. For detailed instructions, see Access Key management .

An API gateway instance and corresponding service (domain names) have been created to expose the application interface externally. For details, see Creating instances and Creating services.

Procedure

Step 1: Create and release a sandbox application

Create a cloud sandbox application for VeRL training.

In the left navigation pane, select Cloud sandbox > Sandbox app.

Click the Create sandbox application button.

When creating, pay special attention to the following configuration items. Leave other configurations as the default. For detailed instructions, see Sandbox applications.

Category	Parameter	Description
For sandbox images	Container image	Select Public image.
		Select images	Select the SWE-bench type and the target image. In this example, select the one with image ID dm2t11rzrt.
		Startup command	The command to start the sandbox. In this example, it is curl -fsSL https://vefaas-swe.tos-cn-beijing.ivolces.com/swe-rex/install_1.4.0.sh \| bash -s -- ixcprx.
		Listening port	Set it to 8000.
Gateway routing configuration	Domain type	Select Unified domain name.
Gateway routing configuration		APIG instance	Select the API Gateway instance created. The APIG instance and service (domain name). They are used to expose application interfaces externally. For detailed instructions, see Creating instances and Creating services.
Environment variables	Environment variables	Configure environment variables for the sandbox. In this example, you need to add the following environment variables in addition to the default ones. Click Edit in JSON and add the following environment variables. { "HOME": "/root", "PIP_INDEX_URL": "https://mirrors.ivolces.com/pypi/simple/" }
Advanced settings	Instance specification	To ensure the smooth execution of evaluation tasks, we recommend selecting an instance specification of at least 2 vCPU and 4 GiB memory when creating a sandbox instance.
Advanced settings		Execution timeout	We recommend setting it to 650 s to avoid timeouts when handling complex tasks.

At the bottom of the page, click Confirm.

After creation, click Release > Confirm in the upper-right corner of the application details page to release the application.

Step 2: Obtain the sandbox application ID and address

On the sandbox application details page, locate the sandbox app ID and address required for integration.

Sandbox app ID: It can be found in Basic information > ID.

Address: The Address can be found in Gateway route settings > Configurations.

Step 3: Configure and verify in veRL

We recommend configuring the above key information into your veRL training environment by setting environment variables.

Configure environment variables

In your training environment, create a .env file and enter the following content.

tip

Please replace the example values with the actual information you have obtained.

# Volcano Engine cloud service access credentials
VEFAAS_ACCESS_KEY="YOUR_VOLC_ACCESS_KEY_ID"
VEFAAS_SECRET_KEY="YOUR_VOLC_SECRET_ACCESS_KEY"

# veFaaS cloud sandbox app configuration
VEFAAS_FUNCTION_ID="s1lw****" # Sample value, please replace it as needed
VEFAAS_FUNCTION_ROUTE="https://example.apigateway.volceapi.com" # Sample value, please replace it as needed

Environment variable name
Description
VOLCE_ACCESS_KEY
Volcano Engine access key.
VOLCE_SECRET_KEY

VEFAAS_FUNCTION_ID
Sandbox app ID.
VEFAAS_FUNCTION_ROUTE
Sandbox app address.

Minimal verification

After configuration is complete, run the following commands to verify the connectivity between the veRL environment and the cloud sandbox. The commands will start a Python 3.12 environment, complete initialization, dependency installation, and code execution, i.e., the entire process for a one-time minimal verification.

import os
import shlex
import uuid

from vergent.interaction import AgentEnv, AgentEnvConfig
from vergent.tools import ToolConfig

# step 1: create environment
run_id = str(uuid.uuid4())
impl = os.getenv("DEPLOYMENT", "vefaas").lower()

env_config = {
"deployment": {
"type": "vefaas",
"image": "enterprise-public-2-cn-beijing.cr.volces.com/vefaas-public/python:3.12",
"command": "curl -fsSL https://****-test-empty.tos-cn-beijing.ivolces.com/bin/tos_swe_rex.sh | bash -s -- ixcprx",
"timeout": 300.0,
"startup_timeout": 180.0,
"function_id": os.getenv("VEFAAS_FUNCTION_ID"),
"function_route": os.getenv("VEFAAS_FUNCTION_ROUTE"),
},
"env_variables": {
"PIP_PROGRESS_BAR": "off",
},
}
env_config = AgentEnvConfig(**env_config)
env = AgentEnv(run_id=run_id, env_config=env_config)
env.start()

# install tools in the environment
tools_config = [
{"name": "execute_bash"},
{"name": "str_replace_editor"},
]
tools = [ToolConfig(**tool_config).get_tool() for tool_config in tools_config]
env.install_tools(tools)
out = env.communicate("which str_replace_editor")
print(f"[Tool check] which str_replace_editor\n -> {out.strip()}\n")

# --- Simple sandbox demo: create script -> run -> output to file -> cat (shows persistence) ---
print("=" * 60)
print(" Sandbox demo: create script -> run -> output to file -> cat")
print("=" * 60)

# 1. Install dependency (persists in this sandbox)
print("\n[Step 1] Install numpy")
env.communicate("pip install numpy -q")
print(" -> done\n")

# 2. Create a runnable script with str_replace_editor (writes result to /tmp/demo_out.txt)
_script = "import numpy as np; print(np.array([1,2,3]).sum())"
print("[Step 2] str_replace_editor create /tmp/demo.py")
env.communicate(f"str_replace_editor create --path /tmp/demo.py --file_text {shlex.quote(_script)}")
print(" -> done\n")

# 3. Run the script (output goes to /tmp/demo_out.txt)
print("[Step 3] Run script (python3 /tmp/demo.py > /tmp/demo_out.txt)")
env.communicate("execute_bash 'python3 /tmp/demo.py > /tmp/demo_out.txt'")
print(" -> done\n")

# 4. Cat the output path
print("[Step 4] cat /tmp/demo_out.txt")
out = env.communicate("cat /tmp/demo_out.txt")
print(f" -> {out.strip()}\n")

print("=" * 60)
print(" Demo done (sandbox: script + output file persisted)")
print("=" * 60)

env.close()

Last updated: 2026.08.19 14:06:08

Environment variable name	Description
VOLCE_ACCESS_KEY	Volcano Engine access key.
VOLCE_SECRET_KEY	Volcano Engine access key.
VEFAAS_FUNCTION_ID	Sandbox app ID.
VEFAAS_FUNCTION_ROUTE	Sandbox app address.