Repository navigation
Conversation
Layer caching is content-addressed but the storage path is prefixed by cacheScope, which the API hardcodes to teamID. Two teams building identical layers each get a private copy of the index+tar and the buildID-keyed memfile/rootfs. In a single-trust-domain deployment that is pure waste. Add TEMPLATE_CACHE_SCOPE: when set, use it as the scope for every team so identical layers dedup across teams; when unset, fall back to teamID (unchanged upstream behavior). Orchestrator already honors the CacheScope field in TemplateCreateRequest / InitLayerFileUploadRequest, so no change there. Default-off keeps per-team cache isolation intact for multi-tenant. Refs e2b-dev#3748
AdaAibaby
requested review from
ValentaTomas,
dobrac and
jakubno
as code owners
October 26, 2026 08:16
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add an opt-in, default-off env var
TEMPLATE_CACHE_SCOPEthat makes the template layer cache shared across teams instead of per-team.Layer caching is already content-addressed (
HashKeys= sha256 over base + keys, no team), but the storage path is prefixed bycacheScope, and the API hardcodescacheScope = teamID. So two teams that build byte-identical layers each get a private copy of the index + tar (build-cache bucket) and the buildID-keyedmemfile/rootfs(template bucket). The content hash already proves the bytes are identical.Change
packages/api/internal/template-manager/cache_scope.go(new):cacheScopeFor(teamID)returnsTEMPLATE_CACHE_SCOPEwhen set, elseteamID.String().Both call sites now use it:
create_template.go—TemplateCreateRequest.CacheScopeupload_template_layer_files.go—InitLayerFileUploadRequest.CacheScopeOrchestrator is unchanged — it already honors the
CacheScopefield in both requests.Behavior
teamID, per-team isolation preserved.memfile/rootfs) are stored and reused once.Safety
A shared scope removes per-team cache isolation (a team can hit / prove existence of / reuse another team's cached layers). That is unacceptable for multi-tenant E2B Cloud, fine for a single trusted org / self-host. Default-off keeps multi-tenant behavior intact; sharing is a deliberate operator opt-in.
Relation to #3742
Orthogonal and complementary. #3742 reclaims unreferenced
{buildID}/prefixes by liveness; it never merges duplicates that are each still referenced. This PR collapses future duplicates to one copy; #3742 later reclaims the old copies once they age out of reference.Closes #3748