Harbor

Runta is a pre-integrated remote sandbox in Harbor. Harbor still owns the job, task, agent, verifier, and artifact flows. Runta provides the runtime where each trial runs.

Harbor calls sandboxes environments in its CLI and job configuration. Select Runta with -e runta, or set environment.type to runta in a job config.

Set Up

Install uv before starting.

Install Harbor with the runta extra to include the Runta Python SDK:

uv tool install "harbor[runta]"

uv installs the harbor command in an isolated environment. If uv reports that its tool directory is missing from PATH, run uv tool update-shell and restart your shell.

Set your Runta credentials:

export RUNTA_TOKEN=rt_...

Set RUNTA_ENDPOINT when the job should use an API endpoint other than the SDK default.

Run an Existing Harbor Dataset

Run one task from a published Harbor dataset:

harbor run \
  -d terminal-bench-sample@2.0 \
  -a oracle \
  -l 1 \
  -e runta

This runs Harbor’s built-in oracle agent against one task from the terminal-bench-sample@2.0 dataset and prints the trial result when Harbor finishes.

For a one-off run without installing the harbor command, use uvx:

uvx --from "harbor[runta]" harbor run \
  -d terminal-bench-sample@2.0 \
  -a oracle \
  -l 1 \
  -e runta

Use -n to control concurrent trials when running multiple tasks. Harbor deletes each sandbox after its trial by default.

Use in a Harbor Job

Save the following as run_job.py. It creates a Harbor JobConfig with EnvironmentConfig(type="runta").

import asyncio

from harbor.job import Job
from harbor.models.job.config import DatasetConfig, JobConfig
from harbor.models.trial.config import AgentConfig, EnvironmentConfig


async def main() -> None:
    config = JobConfig(
        job_name="runta-harbor-demo",
        jobs_dir="jobs",
        n_concurrent_trials=2,
        agents=[AgentConfig(name="oracle")],
        environment=EnvironmentConfig(
            type="runta",
        ),
        datasets=[
            DatasetConfig(name="terminal-bench-sample", version="2.0", n_tasks=1),
        ],
    )

    job = await Job.create(config)
    result = await job.run()
    print(result)


asyncio.run(main())

Run it with Harbor and the Runta SDK available to the script:

uv run --with "harbor[runta]" run_job.py

What Runta Handles

Harbor’s RuntaEnvironment implements the normal environment interface:

• start creates and starts a Runta runtime.
• exec runs Harbor agent and verifier commands in that runtime.
• upload_file and upload_dir copy solutions, tests, and task assets in.
• download_file and download_dir copy verifier logs and reward artifacts out.
• Compose sidecar service_exec, sidecar file and directory downloads, and stop_service.
• Network policy updates map Harbor public, no-network, exact-hostname allowlist, and wildcard-hostname allowlist policies onto Runta egress controls, including changes after the runtime has started.
• stop deletes the runtime after the trial by default.

Normal Harbor tasks can use Runta for agent execution, verifier execution, task asset upload, solution upload, health checks, main-service logs, main-service artifacts, compose sidecar artifact collection, and direct file or directory copy operations.

The provider selects direct, docker, or compose mode automatically:

• compose when the task has environment/docker-compose.yaml or extra Compose files.
• docker when the task has a Dockerfile or docker_image.
• direct when the task has neither, so commands run in the base runtime.

Set --ek mode=direct, --ek mode=docker, or --ek mode=compose to force a mode. In Python, pass the same value through EnvironmentConfig(kwargs={"mode": "docker"}).

CPU and memory from the task are sent as Runta runtime resource requests.

Current Limitations

• GPU, TPU, Windows, and mounted-resource task requirements are not supported.
• Storage override settings are accepted by Harbor but not applied to Runta runtime creation yet.
• Private registry pulls depend on Docker credentials already being available inside the Runta runtime; there is no Harbor-specific registry login flow yet.
• Network allowlists accept exact and wildcard hostnames. IP addresses and CIDR ranges are not supported.

Troubleshooting

If Harbor reports that the runta environment requires extra dependencies, the harbor command is running from a Python environment that does not have harbor[runta] installed. This commonly happens when which harbor points to a global uv tool install, such as ~/.local/bin/harbor.

Reinstall Harbor with the extra:

uv tool install "harbor[runta]" --force

Or use the uvx command in Run an Existing Harbor Dataset to select the package and extra explicitly.

If Harbor exits with Runta requires RUNTA_TOKEN or RUNTA_CONFIG., export RUNTA_TOKEN before harbor run.