fix(server): fix sandbox port expose bug under windows and egress

Author: Pangjiping

server/opensandbox_server/services/docker.py

@@ -1193,6 +1193,7 @@ def _provision_sandbox(
                 # dockur/windows exposes RDP and noVNC/web UI on these ports.
                 # https://github.com/dockur/windows/blob/master/Dockerfile
                 exposed_ports.extend(["3389/tcp", "3389/udp", "8006/tcp"])
+            container_exposed_ports: Optional[list[str]] = exposed_ports
 
             if request.network_policy:
                 egress_token = generate_egress_token()
@@ -1218,6 +1219,9 @@ def _provision_sandbox(
                 host_config_kwargs = self._base_host_config_kwargs(
                     effective_mem_limit, effective_nano_cpus, f"container:{sidecar_container.id}"
                 )
+                # Container network namespace is shared with sidecar. Docker rejects
+                # exposing ports on the main container in "container:<id>" mode.
+                container_exposed_ports = None
                 # Drop NET_ADMIN for the main container; only the sidecar should keep it
                 cap_drop = set(host_config_kwargs.get("cap_drop") or [])
                 cap_drop.add("NET_ADMIN")
@@ -1258,7 +1262,7 @@ def _provision_sandbox(
                 labels,
                 environment,
                 host_config_kwargs,
-                exposed_ports,
+                container_exposed_ports,
                 request.platform,
             )
         except Exception:

server/tests/test_docker_service.py

@@ -1537,9 +1537,7 @@ async def test_create_sandbox_windows_profile_with_network_policy_maps_windows_p
     assert host_config_kwargs["network_mode"] == "container:sidecar-123"
     assert "NET_ADMIN" in set(host_config_kwargs.get("cap_add") or [])
     assert "NET_ADMIN" not in set(host_config_kwargs.get("cap_drop") or [])
-    assert "3389/tcp" in forwarded_ports
-    assert "3389/udp" in forwarded_ports
-    assert "8006/tcp" in forwarded_ports
+    assert forwarded_ports is None
     assert labels["opensandbox.io/embedding-proxy-port"] == "51664"
     assert labels["opensandbox.io/http-port"] == "48891"