[sundy-li]

Current revision: retain sandbox guidance after #3592

AI-assisted ordinary main merge preserves the verified v1.2.955 scalar-worker and v1.2.957 sandbox/resource guidance together with the published Unreleased controlled HTTP(S) sections. Only the obsolete blanket local-network prohibition is updated to distinguish native sockets from integration-bound HTTP(S). All original EN/CN examples and version markers are retained.

Both full EN/CN builds, eight rendered-page/anchor checks, and exact-composition static checks passed. No runtime SQL, HTTP, sandbox/security, worker, Rust tests or benchmarks were run. New head c6dc6c07bdeb95971d76df7f418d61bd190b424b requires fresh remote CI and genuine human review. No self-review, repeated review request, or PR merge.

• A responsible human has read every line of the current revision.

---

Summary

Documents databendlabs/databend#20808 and databendlabs/databend#20830 in paired EN/CN scalar UDF, aggregate UDF and Query Config references. Sandbox/resource behavior version: v1.2.957. Python scalar worker isolation/automatic sizing version: v1.2.955. Existing language introduction versions remain visible.

• Separate query-owned scalar worker processes/automatic capacity (v1.2.955) from mandatory OS sandbox (v1.2.957). Workers grow lazily, respect max_threads and never cross SQL executions; idle extras retire by default after 300 seconds.
• Explain Linux 5.13+/Landlock/seccomp/x86_64/aarch64 requirements, container syscall requirements, fail-closed setup, private directories and allowlisted environment.
• Explain the file/network/process restrictions without claiming path-existence secrecy, macOS isolation, or Python memory/CPU containment.
• Distinguish the mandatory local OS sandbox from enable_udf_sandbox external-service routing. Python UDAFs use local query-owned workers but are rejected in external-sandbox mode.
• Correct the aggregate IMPORTS/PACKAGES table: syntax accepts them, but local Python aggregates do not install them.
• Explain dependency syntax validation, wheel-only defaults, and why disabling it runs sdist build code on the query node outside the worker sandbox.
• Document 12 node configuration controls/defaults, local-node worker/admission scopes, per-request versus total-query timeouts, no cross-query worker reuse and no automatic retry after poisoned runtimes.
• Describe JavaScript heap/deadline and WASM linear-memory limits. WASM has no execution timeout; neither in-process engine observes cancellation during a running call. These are not Python memory limits.

Release evidence: merge b0d1a1951e9bec955e343694b787a72e665dfca6 is in v1.2.957-nightly, not v1.2.956-nightly. The inspected script runtime README/limits have no later changes in the monitored checkout. Scalar worker merge a063b4d6a62a4d2ee71a9418fda713007ac49e04 is in v1.2.955-nightly, not v1.2.954-nightly. The seven historical worker-control defaults were also checked at that source commit.

Validation

• Worker-version follow-up: both builds rerun; four changed MDX files compile, all fenced examples unchanged, worker/sandbox versions rendered on both paired pages.
• npm run build:en
• npm run build:cn
• Six MDX files independently compiled; three matching EN/CN paths.
• Every existing fenced example is unchanged in each touched file; no new SQL/runtime fixture introduced.
• Version component strings match across each EN/CN pair.
• All 12 documented default values statically matched with config.rs, and EN/CN option/default rows match.
• Static inspection: script_udf_support README, PythonWorkerConfig positive limits, script_udf_limits defaults/engine application, pip requirement/install path, UDFValidator aggregate checks and 08_0004_hardening.sh.
• Release ancestry and git diff --check.
• Rendered EN/CN resource anchor (unique), versions, exact sandbox error string and function/config links.
• No live SQL, sandbox/security deployment test, worker execution, Rust test, OOM test or benchmark was performed. Builds/source/fixture inspection are not proof of runtime security or performance.

Merge note

#3563 also changes Query Config. Retain its newer page marker v1.2.960 and both sections when merging; this PR's sandbox behavior remains v1.2.957.

Review

@sundy-li is both the source PR author and the docs PR account. GitHub cannot request review from the PR author; assignment is not approval. An independent human reviewer is needed. No self-review or human approval is claimed.

AI assistance

• AI usage: An AI coding agent reviewed source/static fixtures, wrote only the touched paired EN/CN docs, and ran documentation/static validation.
• Responsible human: @sundy-li (source author, PR account and task owner).
• The responsible human has read every line of this diff and can explain each change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 5, 2026 1:32am UTC
docs-cn	Ready	Preview	Nov 5, 2026 1:32am UTC