alibaba / alibaba/ROCK

[Feature] Remove obsolete uuid dependency and slim core deps by moving jinja2 to admin extras

Open
#1,052 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
485
Forks
81
Avg merge
16h 12m
Merged PRs (30d)
8

Description

**Feature Category**
- [ ] Sandbox
- [ ] Actions
- [ ] Deployments
- [x] SDK & API
- [ ] Envhub
- [ ] CLI
- [x] Performance & Optimization
- [ ] Documentation & Examples

**Problem Statement**

`pyproject.toml` declares a top-level dependency on `uuid`. This resolves to the PyPI package `uuid==1.30`, a pre-stdlib backport last released in **May 2007**. It ships a top-level `uuid.py` that **shadows the Python standard library `uuid` module** whenever it gets installed.

Concrete impact today:
- `requirements_admin.txt` and `requirements_sandbox_actor.txt` both pin `uuid==1.30`. Production admin and sandbox-actor Docker images installed via `pip_install.sh` therefore run against the 2007 backport, while local dev (under `uv sync`) silently runs against stdlib. The two environments diverge for no reason.
- The 2007 backport lacks modern stdlib features (`SafeUUID`, `UUID.is_safe`, etc.) and uses a different module identity, which can break `isinstance(x, uuid.UUID)` and pickle round-trips when objects cross process boundaries (e.g. Ray actors).
- The codebase only uses `uuid.uuid4()`, which has been part of the standard library since Python 2.5 and is identical in behavior to the backport. So the dependency provides no value and only adds risk.

Additionally, `jinja2` is currently a **core** dependency, but it is only used by the admin / K8s template loader (`rock/sandbox/operator/k8s/template_loader.py`). SDK and rocklet users pay for it in install time and image size without ever importing it.

**Proposed Solution**

1. Drop `uuid` from `pyproject.toml` core dependencies.
2. Re-export `requirements_admin.txt` and `requirements_sandbox_actor.txt` via the existing `xrl/build-tools/export_requirements/*.sh` scripts so production images stop pulling `uuid==1.30`.
3. Move `jinja2` from core dependencies to the `admin` optional extras, where it logically belongs.

**Detailed Feature Description**

- **`pyproject.toml`** — remove the `"uuid"` line from `[project] dependencies`; remove `"jinja2"` from core and add it to `[project.optional-dependencies] admin`.
- **`uv.lock`** — regenerated to drop `uuid` and re-locate `jinja2` under the `admin` extra.
- **`requirements_admin.txt` / `requirements_sandbox_actor.txt`** — regenerated; the `uuid==1.30 # via rl-rock` lines are gone.
- **No code changes** are required: the only `uuid` API used in `rock/` and `tests/` is `uuid.uuid4()`, which the stdlib provides identically.
- **Compatibility** — Python 3.10+ is required by the project, so stdlib `uuid` is always available. Behavior of `uuid.uuid4()` is unchanged.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the dependency declarations in pyproject.toml and inspect the existing scripts under xrl/build-tools/export_requirements/. Regenerate uv.lock, requirements_admin.txt, and requirements_sandbox_actor.txt after removing uuid from core dependencies and moving jinja2 to the admin extra. Done means the generated requirements no longer contain uuid==1.30, jinja2 is available through admin, and no code changes are needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.