Add Fystash cloud runtime provider (ContainerProvider)

[fystash]

Summary

Adds Fystash as an OpenEnv ContainerProvider (FystashProvider) and lists it on the Runtime Providers docs table next to Daytona / Modal / ACA.

Fystash runs warm Firecracker rooms. This provider:

1. Creates a room with template_id=docker (default)
2. docker pull + docker run of a registry OpenEnv server image
3. Exposes port 8000 via Fystash preview URL as base_url
4. Polls {base_url}/health in wait_for_ready

Usage

export FYSTASH_API_KEY=key-…   # https://fystash.ai/signup
export OPENENV_IMAGE=your-org/echo-env:latest
pip install 'openenv[fystash]'
PYTHONPATH=src python examples/fystash_echo_env.py

from openenv.core.containers.runtime.fystash_provider import FystashProvider

provider = FystashProvider(image="your-org/echo-env:latest")
base_url = provider.start_container()
provider.wait_for_ready(base_url, timeout_s=300)

Honesty / v1 scope

• Registry image only — no image_from_dockerfile / snapshot build (same honesty bar as our Harbor first cut)
• Preview URL path; full WebSocket//ws EnvClient sessions should be validated before dropping “experimental”
• Nested-KVM production topology (topology=nested)

Links

• https://fystash.ai
• Partner notes: https://github.com/fystash/fystash-infra/blob/main/docs/openenv-fystash.md
• Related Harbor provider PR: Add Fystash cloud sandbox provider (--env fystash) harbor-framework/harbor#2491

Test plan

• FYSTASH_API_KEY + published OpenEnv server image → start_container → /health 200 → stop_container
• Reject dockerfile: / snapshot: with clear ValueError
• Docs table lists FystashProvider after merge

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 617dd4f. Configure here.}

[cursor]

Double start orphans Fystash room

High Severity

start_container overwrites _api and _room_id without checking for an active room. A second start before stop_container/close abandons the previous Firecracker room so it is never destroyed, leaking billable cloud resources. Peer cloud providers (ModalProvider, ACASandboxProvider, HFSandboxProvider) raise in this case for the same reason.

 

^{Reviewed by Cursor Bugbot for commit 617dd4f. Configure here.}