Skip to content

Commit fb4e7ec

Browse files
craigshoemakercraigshoemaker
committed
updates based on PM review
1 parent 938ab2d commit fb4e7ec

File tree

5 files changed

+204
-201
lines changed

5 files changed

+204
-201
lines changed

‎articles/container-apps/session-pool.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.topic: conceptual
8-
ms.date: 02/19/2025
8+
ms.date: 04/07/2025
99
ms.author: cshoe
1010
---
1111

‎articles/container-apps/sessions-code-interpreter.md

Lines changed: 200 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.topic: how-to
8-
ms.date: 02/19/2025
8+
ms.date: 04/07/2025
99
ms.author: cshoe
1010
ms.custom: references_regions
1111
ms.collection: ce-skilling-ai-copilot
@@ -70,6 +70,205 @@ If you're using the pool's management API endpoints directly, you must generate
7070

7171
To learn more, see [Authentication and authorization](sessions-usage.md#authentication).
7272

73+
## Work with files
74+
75+
You can upload and download files, and list all the files in a code interpreter session.
76+
77+
### Upload a file
78+
79+
To upload a file to a session, send a `POST` request to the `uploadFile` endpoint in a multipart form data request. Include the file data in the request body. The file must include a filename.
80+
81+
Uploaded files are stored in the session's file system under the `/mnt/data` directory.
82+
83+
The following example shows how to upload a file to a session.
84+
85+
Before you send the request, replace the placeholders between the `<>` brackets with values specific to your request.
86+
87+
```http
88+
POST https://<REGION>.dynamicsessions.io/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/sessionPools/<SESSION_POOL_NAME>/files/upload?api-version=2024-02-02-preview&identifier=<SESSION_ID>
89+
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
90+
Authorization: Bearer <token>
91+
92+
------WebKitFormBoundary7MA4YWxkTrZu0gW
93+
Content-Disposition: form-data; name="file"; filename="<FILE_NAME_AND_EXTENSION>"
94+
Content-Type: application/octet-stream
95+
96+
(data)
97+
------WebKitFormBoundary7MA4YWxkTrZu0gW--
98+
```
99+
100+
### Download a file
101+
102+
To download a file from a session's `/mnt/data` directory, send a `GET` request to the `file/content/{filename}` endpoint. The response includes the file data.
103+
104+
The following example demonstrates how to format a `GET` request to download a file.
105+
106+
Before you send the request, replace the placeholders between the `<>` brackets with values specific to your request.
107+
108+
```http
109+
GET https://<REGION>.dynamicsessions.io/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/sessionPools/<SESSION_POOL_NAME>/files/content/<FILE_NAME_AND_EXTENSION>?api-version=2024-02-02-preview&identifier=<SESSION_ID>
110+
Authorization: Bearer <TOKEN>
111+
```
112+
113+
### List the files
114+
115+
To list the files in a session's `/mnt/data` directory, send a `GET` request to the `files` endpoint.
116+
117+
The following example shows you how to list the files in a session's directory.
118+
119+
Before you send the request, replace the placeholders between the `<>` brackets with values specific to your request.
120+
121+
```http
122+
GET https://<REGION>.dynamicsessions.io/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/sessionPools/<SESSION_POOL_NAME>/files?api-version=2024-02-02-preview&identifier=<SESSION_ID>
123+
Authorization: Bearer <TOKEN>
124+
```
125+
126+
The response contains a list of files in the session.
127+
128+
The following listing shows a sample of the type of response you can expect from requesting session contents.
129+
130+
```json
131+
{
132+
"$id": "1",
133+
"value": [
134+
{
135+
"$id": "2",
136+
"properties": {
137+
"$id": "3",
138+
"filename": "test1.txt",
139+
"size": 16,
140+
"lastModifiedTime": "2024-05-02T07:21:07.9922617Z"
141+
}
142+
},
143+
{
144+
"$id": "4",
145+
"properties": {
146+
"$id": "5",
147+
"filename": "test2.txt",
148+
"size": 17,
149+
"lastModifiedTime": "2024-05-02T07:21:08.8802793Z"
150+
}
151+
}
152+
]
153+
}
154+
```
155+
156+
## Security
157+
158+
Code interpreter sessions are designed to run untrusted code in isolated environments, ensuring that your applications and data remain protected.
159+
160+
### Use managed identity
161+
162+
A managed identity from Microsoft Entra ID allows your container session pools and their sessions to access other Microsoft Entra protected resources. Both system-assigned and user-assigned managed identities are supported in a session pool.
163+
164+
For more about managed identities in Microsoft Entra ID, see [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).
165+
166+
There are two ways to use managed identities with custom container session pools:
167+
168+
- **Image pull authentication**: Use the managed identity to authenticate with the container registry to pull the container image.
169+
170+
- **Resource access**: Use the session pool's managed identity in a session to access other Microsoft Entra protected resources. Due to its security implications, this capability is disabled by default.
171+
172+
> [!IMPORTANT]
173+
> If you enable access to managed identity in a session, any code or programs running in the session can create Microsoft Entra tokens for the pool's managed identity. Since sessions typically run untrusted code, use this feature with extreme caution.
174+
175+
# [Azure CLI](#tab/azure-cli)
176+
177+
To enable managed identity for a custom container session pool, use Azure Resource Manager.
178+
179+
# [Azure Resource Manager](#tab/arm)
180+
181+
To enable managed identity for a custom container session pool, you add an `identity` property to the session pool resource.
182+
183+
The `identity` property must have a `type` property with the value `SystemAssigned` or `UserAssigned`. For more information on how to configure this property, see [Configure managed identities](managed-identity.md?tabs=arm%2Cdotnet#configure-managed-identities).
184+
185+
The following example shows an ARM template snippet that enables a user-assigned identity for a custom container session pool and use it for image pull authentication.
186+
187+
Before you send the request, replace the placeholders between the `<>` brackets with the appropriate values for your session pool and session identifier.
188+
189+
```json
190+
{
191+
"type": "Microsoft.App/sessionPools",
192+
"apiVersion": "2024-08-02-preview",
193+
"name": "my-session-pool",
194+
"location": "westus2",
195+
"properties": {
196+
"environmentId": "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerApps/environments/<ENVIRONMENT_NAME>",
197+
"poolManagementType": "Dynamic",
198+
"containerType": "CustomContainer",
199+
"scaleConfiguration": {
200+
"maxConcurrentSessions": 10,
201+
"readySessionInstances": 5
202+
},
203+
"dynamicPoolConfiguration": {
204+
"executionType": "Timed",
205+
"cooldownPeriodInSeconds": 600
206+
},
207+
"customContainerTemplate": {
208+
"registryCredentials": {
209+
"server": "myregistry.azurecr.io",
210+
"identity": "<IDENTITY_RESOURCE_ID>"
211+
},
212+
"containers": [
213+
{
214+
"image": "myregistry.azurecr.io/my-container-image:1.0",
215+
"name": "mycontainer",
216+
"resources": {
217+
"cpu": 0.25,
218+
"memory": "0.5Gi"
219+
},
220+
"command": [
221+
"/bin/sh"
222+
],
223+
"args": [
224+
"-c",
225+
"while true; do echo hello; sleep 10;done"
226+
],
227+
"env": [
228+
{
229+
"name": "key1",
230+
"value": "value1"
231+
},
232+
{
233+
"name": "key2",
234+
"value": "value2"
235+
}
236+
]
237+
}
238+
],
239+
"ingress": {
240+
"targetPort": 80
241+
}
242+
},
243+
"sessionNetworkConfiguration": {
244+
"status": "EgressEnabled"
245+
},
246+
"managedIdentitySettings": [
247+
{
248+
"identity": "<IDENTITY_RESOURCE_ID>",
249+
"lifecycle": "None"
250+
}
251+
]
252+
},
253+
"identity": {
254+
"type": "UserAssigned",
255+
"userAssignedIdentities": {
256+
"<IDENTITY_RESOURCE_ID>": {}
257+
}
258+
}
259+
}
260+
```
261+
262+
This template contains the following settings for managed identity:
263+
264+
| Parameter | Value | Description |
265+
|---------|-------|-------------|
266+
| `customContainerTemplate.registryCredentials.identity` | `<IDENTITY_RESOURCE_ID>` | The resource ID of the managed identity to use for image pull authentication. |
267+
| `managedIdentitySettings.identity` | `<IDENTITY_RESOURCE_ID>` | The resource ID of the managed identity to use in the session. |
268+
| `managedIdentitySettings.lifecycle` | `None` | The session lifecycle where the managed identity is available.<br><br>- `None` (default): The session can't access the identity. This setting is only used for image pull.<br><br>- `Main`: In addition to image pull, the main session can also access the identity. **Use with caution.** |
269+
270+
---
271+
73272
## LLM framework integrations
74273

75274
Instead of using the session pool management API directly, the following LLM frameworks provide integrations with code interpreter sessions:

‎articles/container-apps/sessions-custom-container.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.service: azure-container-apps
77
ms.custom:
88
- ignite-2024
99
ms.topic: conceptual
10-
ms.date: 02/19/2025
10+
ms.date: 04/07/2025
1111
ms.author: cshoe
1212
ms.collection: ce-skilling-ai-copilot
1313
---

0 commit comments

Comments
 (0)