diff --git a/English/.gitbook/assets/Agentbase-image/agentbase-browser-architecture.svg b/English/.gitbook/assets/Agentbase-image/agentbase-browser-architecture.svg new file mode 100644 index 00000000..8c226352 --- /dev/null +++ b/English/.gitbook/assets/Agentbase-image/agentbase-browser-architecture.svg @@ -0,0 +1,64 @@ + + + + + + + + + + + + + User + + + + Query + + Result + + + + Agent + + Automation library + Playwright, browser-use + + + + Large Language + Model (LLM) + + + + 1. Prompt + tools + + 2. Tool call + click, type, goto… + + + + Browser + isolated sandbox, created once and reused + + + + + Chromium + opens and works the web pages + Session + + + + 3. Commands (CDP) + …/automation-stream + + + + 4. Page content, screenshot + + + + Live view: watch the session as it happens, in an iframe + diff --git a/English/.gitbook/assets/Agentbase-image/agentbase-code-interpreter-architecture.svg b/English/.gitbook/assets/Agentbase-image/agentbase-code-interpreter-architecture.svg new file mode 100644 index 00000000..7ea2249c --- /dev/null +++ b/English/.gitbook/assets/Agentbase-image/agentbase-code-interpreter-architecture.svg @@ -0,0 +1,62 @@ + + + + + + + + + + + + + User + + + + Query + + Result + + + + Agent + + + + Large Language + Model (LLM) + + + + 1. Prompt + tools + + 2. Tool call + + + + Code Interpreter + isolated sandbox, created once and reused + + + + + Python + executeCode + + Shell + executeCommand + + File System + writeFiles · readFiles · listFiles + Session + + + + 3. Invoke the tool + POST …/sessions/{sessionId}/invoke + + + + 4. Tool result (output, files) + diff --git a/English/ai-stack/agent-base/agent-runtime/manage-runtime.md b/English/ai-stack/agent-base/agent-runtime/manage-runtime.md index 9d17eb5e..f59649cc 100644 --- a/English/ai-stack/agent-base/agent-runtime/manage-runtime.md +++ b/English/ai-stack/agent-base/agent-runtime/manage-runtime.md @@ -33,6 +33,20 @@ While the Runtime is in `STOPPED` state, all requests to its Endpoint will retur *** +## View a Runtime's Outbound IP + +The Runtime detail page shows the **Outbound IP** — the address the Runtime uses when calling out to your infrastructure (internal APIs, databases, MCP Servers in your VPC). + +**Step 1:** Open **Agent Runtime** → click the Runtime name to open its detail page + +**Step 2:** Check the **Outbound IP** field on the detail page + +{% hint style="info" %} +For **Private** Runtimes: if a server or VM in your VPC uses an IP-based firewall / whitelist, add the Runtime's **Outbound IP** to the allow list — otherwise, calls from the Runtime to your infrastructure will be blocked. +{% endhint %} + +*** + ## Update Runtime / Deploy a New Version Each update creates a new immutable **Version**. The DEFAULT Endpoint automatically points to the latest version — the old version continues serving traffic until the deployment completes. diff --git a/English/ai-stack/agent-base/built-in-tools/README.md b/English/ai-stack/agent-base/built-in-tools/README.md index 6d1593db..98e5265e 100644 --- a/English/ai-stack/agent-base/built-in-tools/README.md +++ b/English/ai-stack/agent-base/built-in-tools/README.md @@ -19,24 +19,11 @@ Built-in Tools is currently being rolled out by **whitelist**. If your account i ## Architecture -Each of your sessions runs inside its own microVM with a dedicated kernel, claimed from a pre-warmed VM pool, so creating a session takes only a few seconds. - -``` -Agent / MCP client - │ MCP (HTTPS) - ▼ -Built-in Tools gateway - (Code Interpreter · Browser) - │ - ▼ -AgentBase Runtime ── OpenSandbox (warm VM pool) - │ - ▼ -Dedicated vKS node group (nested virtualization) - │ Kata Containers + Cloud Hypervisor - ▼ -Each session = 1 microVM with its own kernel -``` +Each of your sessions runs inside its own microVM with a dedicated kernel, claimed from a pre-warmed VM pool, so creating a session takes only a few seconds. Both tools share the same sandbox foundation — they differ in the product layer on top: + +

Code Interpreter — the agent calls tools over MCP, code runs in an isolated sandbox microVM

+ +

Browser — the agent drives Chromium inside a sandbox microVM over CDP

Main layers: diff --git a/English/ai-stack/agent-base/built-in-tools/use-browser.md b/English/ai-stack/agent-base/built-in-tools/use-browser.md index 14c537e4..946629c7 100644 --- a/English/ai-stack/agent-base/built-in-tools/use-browser.md +++ b/English/ai-stack/agent-base/built-in-tools/use-browser.md @@ -64,6 +64,10 @@ Recording ─ saved when the session is deleted ─────┘ - **Live view** — a human watches Chrome's screen live over noVNC, embedded in the portal via an iframe. - **Recording** — a session recording is preserved when the session ends. +The full flow: your agent (with an automation library such as Playwright or browser-use) receives a query → the LLM picks tool calls (`click`, `type`, `goto`...) → CDP commands travel over the automation stream into the Chromium inside the session → page content and screenshots return to the agent: + +

Browser architecture — the agent drives Chromium inside a sandbox microVM over CDP

+ Browser follows the same pattern as [Code Interpreter](use-code-interpreter.md): create the resource, wait for `ACTIVE`, create sessions (one VM per session), delete when done. --- diff --git a/English/ai-stack/agent-base/built-in-tools/use-code-interpreter.md b/English/ai-stack/agent-base/built-in-tools/use-code-interpreter.md index d77458ca..50e307bd 100644 --- a/English/ai-stack/agent-base/built-in-tools/use-code-interpreter.md +++ b/English/ai-stack/agent-base/built-in-tools/use-code-interpreter.md @@ -52,6 +52,16 @@ Tokens from a **Root user, IAM user, or Service Account** all work. If your agen --- +## How it works + +Your agent receives a user query, the LLM picks a tool call, and the tool call travels over the MCP connection into the Code Interpreter — running inside its own sandbox microVM and returning the result to the agent: + +

Code Interpreter architecture — the agent calls tools over MCP, code runs in an isolated sandbox microVM

+ +A Code Interpreter is **created once and reused** across sessions — each session is still its own microVM. + +--- + ## Usage lifecycle One round of using Code Interpreter goes through these steps: diff --git a/English/ai-stack/agent-base/private-networking.md b/English/ai-stack/agent-base/private-networking.md index dc6029ae..c7903822 100644 --- a/English/ai-stack/agent-base/private-networking.md +++ b/English/ai-stack/agent-base/private-networking.md @@ -90,6 +90,16 @@ Fill in the remaining fields (Inbound Auth, MCP Servers, Policy Group...) and cl *** +## Whitelist a Private Runtime's Outbound IP + +When a Private Runtime calls into your infrastructure (databases, internal APIs, MCP Servers), the request originates from the Runtime's **Outbound IP**. If your side filters by IP (security group, firewall, whitelist), you need to allow this IP: + +1. Open the Runtime detail page — see [Manage Runtime](agent-runtime/manage-runtime.md#view-a-runtimes-outbound-ip) +2. Copy the **Outbound IP** shown on the detail page +3. Add the IP to the whitelist / security group / firewall of the server or VM in your VPC + +*** + ## Result After creation with Private mode: diff --git a/Vietnamese/.gitbook/assets/Agentbase-image/agentbase-browser-architecture.svg b/Vietnamese/.gitbook/assets/Agentbase-image/agentbase-browser-architecture.svg new file mode 100644 index 00000000..8c226352 --- /dev/null +++ b/Vietnamese/.gitbook/assets/Agentbase-image/agentbase-browser-architecture.svg @@ -0,0 +1,64 @@ + + + + + + + + + + + + + User + + + + Query + + Result + + + + Agent + + Automation library + Playwright, browser-use + + + + Large Language + Model (LLM) + + + + 1. Prompt + tools + + 2. Tool call + click, type, goto… + + + + Browser + isolated sandbox, created once and reused + + + + + Chromium + opens and works the web pages + Session + + + + 3. Commands (CDP) + …/automation-stream + + + + 4. Page content, screenshot + + + + Live view: watch the session as it happens, in an iframe + diff --git a/Vietnamese/.gitbook/assets/Agentbase-image/agentbase-code-interpreter-architecture.svg b/Vietnamese/.gitbook/assets/Agentbase-image/agentbase-code-interpreter-architecture.svg new file mode 100644 index 00000000..7ea2249c --- /dev/null +++ b/Vietnamese/.gitbook/assets/Agentbase-image/agentbase-code-interpreter-architecture.svg @@ -0,0 +1,62 @@ + + + + + + + + + + + + + User + + + + Query + + Result + + + + Agent + + + + Large Language + Model (LLM) + + + + 1. Prompt + tools + + 2. Tool call + + + + Code Interpreter + isolated sandbox, created once and reused + + + + + Python + executeCode + + Shell + executeCommand + + File System + writeFiles · readFiles · listFiles + Session + + + + 3. Invoke the tool + POST …/sessions/{sessionId}/invoke + + + + 4. Tool result (output, files) + diff --git a/Vietnamese/ai-stack/agent-base/agent-runtime/quan-ly-runtime.md b/Vietnamese/ai-stack/agent-base/agent-runtime/quan-ly-runtime.md index d8afdf92..ea51a408 100644 --- a/Vietnamese/ai-stack/agent-base/agent-runtime/quan-ly-runtime.md +++ b/Vietnamese/ai-stack/agent-base/agent-runtime/quan-ly-runtime.md @@ -33,6 +33,20 @@ Trong khi Runtime ở trạng thái `STOPPED`, mọi request đến Endpoint s --- +## Xem Outbound IP của Runtime + +Trang chi tiết Runtime hiển thị **Outbound IP** — địa chỉ mà Runtime dùng khi gọi ra ngoài tới hạ tầng của bạn (API nội bộ, database, MCP Server trong VPC). + +**Bước 1:** Mở **Agent Runtime** → nhấp tên Runtime để mở trang chi tiết + +**Bước 2:** Xem trường **Outbound IP** hiển thị trên trang chi tiết + +{% hint style="info" %} +Với Runtime **Private**: nếu server hoặc VM trong VPC của bạn có firewall / whitelist theo IP, hãy thêm **Outbound IP** của Runtime vào danh sách cho phép — nếu không, các cuộc gọi từ Runtime tới hạ tầng của bạn sẽ bị chặn. +{% endhint %} + +--- + ## Cập nhật Runtime / Triển khai phiên bản mới Mỗi lần cập nhật tạo ra một **Version** bất biến mới. Endpoint DEFAULT tự động trỏ đến phiên bản mới nhất — phiên bản cũ tiếp tục phục vụ traffic cho đến khi deployment hoàn tất. diff --git a/Vietnamese/ai-stack/agent-base/built-in-tools/README.md b/Vietnamese/ai-stack/agent-base/built-in-tools/README.md index 3141efc5..45a866f8 100644 --- a/Vietnamese/ai-stack/agent-base/built-in-tools/README.md +++ b/Vietnamese/ai-stack/agent-base/built-in-tools/README.md @@ -19,24 +19,11 @@ Built-in Tools đang được mở theo từng đợt **whitelist**. Nếu accou ## Kiến trúc -Mỗi session của bạn chạy trong một microVM riêng có kernel riêng, được cấp từ pool VM làm nóng sẵn (warm pool) nên tạo session chỉ mất vài giây. - -``` -Agent / MCP client - │ MCP (HTTPS) - ▼ -Built-in Tools gateway - (Code Interpreter · Browser) - │ - ▼ -AgentBase Runtime ── OpenSandbox (Pool VM nóng sẵn) - │ - ▼ -vKS node group riêng (nested virtualization) - │ Kata Containers + Cloud Hypervisor - ▼ -Mỗi session = 1 microVM có kernel riêng -``` +Mỗi session của bạn chạy trong một microVM riêng có kernel riêng, được cấp từ pool VM làm nóng sẵn (warm pool) nên tạo session chỉ mất vài giây. Hai tool dùng chung một nền sandbox — khác nhau ở lớp sản phẩm bên trên: + +

Code Interpreter — agent gọi tool qua MCP, code chạy trong sandbox microVM cô lập

+ +

Browser — agent điều khiển Chromium trong sandbox microVM qua CDP

Các tầng chính: diff --git a/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-browser.md b/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-browser.md index f5aad50f..04233442 100644 --- a/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-browser.md +++ b/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-browser.md @@ -64,6 +64,10 @@ Ghi hình ── recording (lưu khi xoá session) ──────┘ - **Live view** — người xem màn hình Chrome trực tiếp qua noVNC, nhúng trong portal bằng iframe. - **Recording** — bản ghi phiên được lưu lại khi session kết thúc. +Luồng đầy đủ: agent (kèm automation library như Playwright, browser-use) nhận query → LLM chọn tool call (`click`, `type`, `goto`...) → lệnh CDP đi qua automation stream vào Chromium trong session → nội dung trang và screenshot trả về agent: + +

Kiến trúc Browser — agent điều khiển Chromium trong sandbox microVM qua CDP

+ Browser dùng cùng khuôn với [Code Interpreter](su-dung-code-interpreter.md): tạo tài nguyên, chờ `ACTIVE`, tạo session (một VM mỗi session), xoá khi hết dùng. --- diff --git a/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-code-interpreter.md b/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-code-interpreter.md index 6c05b267..b12158c1 100644 --- a/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-code-interpreter.md +++ b/Vietnamese/ai-stack/agent-base/built-in-tools/su-dung-code-interpreter.md @@ -52,6 +52,16 @@ Token từ **Root user, IAM user hoặc Service Account** đều dùng được. --- +## Mô hình hoạt động + +Agent nhận query của người dùng, LLM chọn tool call, rồi tool call đi qua kết nối MCP vào Code Interpreter — chạy trong sandbox microVM riêng và trả kết quả về cho agent: + +

Kiến trúc Code Interpreter — agent gọi tool qua MCP, code chạy trong sandbox microVM cô lập

+ +Code Interpreter tạo **một lần và dùng lại** cho nhiều session — mỗi session vẫn là một microVM riêng. + +--- + ## Vòng đời sử dụng Một lần dùng Code Interpreter đi qua các bước sau: diff --git a/Vietnamese/ai-stack/agent-base/private-networking.md b/Vietnamese/ai-stack/agent-base/private-networking.md index 570f6920..4a99a9fb 100644 --- a/Vietnamese/ai-stack/agent-base/private-networking.md +++ b/Vietnamese/ai-stack/agent-base/private-networking.md @@ -90,6 +90,16 @@ Khi chọn **Private**, AgentBase tạo một private gateway riêng cho org và --- +## Whitelist Outbound IP của Runtime Private + +Khi Runtime Private gọi vào hạ tầng của bạn (database, API nội bộ, MCP Server), nguồn của request là **Outbound IP** của Runtime. Nếu hạ tầng phía bạn chặn theo IP (security group, firewall, whitelist), bạn cần cho phép IP này: + +1. Mở trang chi tiết Runtime — xem [Quản lý Runtime](agent-runtime/quan-ly-runtime.md#xem-outbound-ip-cua-runtime) +2. Copy **Outbound IP** hiển thị trên trang chi tiết +3. Thêm IP vào whitelist / security group / firewall của server hoặc VM trong VPC của bạn + +--- + ## Kết quả Sau khi tạo thành công với chế độ Private: