What causes "cube remote client config is required" in Tencent/WeKnora?

Resolve the tenant's sandbox config first and handle the missing-config case before constructing the client.

cube remote client config is required

Error message

cube remote client config is required

What it means

NewCubeRemoteClientWithPool requires a non-nil *Config; passing nil means the client has no provider settings (timeout, endpoint, credentials) and cannot be constructed. This is a programmer-error guard at the constructor boundary.

Source

Thrown at internal/sandbox/cube_remote_client.go:52

// NewCubeRemoteClient constructs a Cube-backed RemoteSandboxClient using the
// SDK default HTTP clients (separate control/data pools). Suitable for the
// process-wide default manager and for throwaway connectivity probes, neither
// of which benefits from an externally owned pool.
func NewCubeRemoteClient(config *Config) (*CubeRemoteClient, error) {
	return NewCubeRemoteClientWithPool(config, nil)
}

// NewCubeRemoteClientWithPool builds a client whose connections come from a
// caller-owned pool. Named configs construct a client per request, so the pool
// is what keeps connections alive across requests; it routes control-plane
// traffic onto the transport shared with E2B while preserving the SDK's
// proxy dial rewrite for the data plane. A nil pool keeps the SDK defaults.
func NewCubeRemoteClientWithPool(
	config *Config,
	pool *SandboxGatewayTransportPool,
) (*CubeRemoteClient, error) {
	if config == nil {
		return nil, errors.New("cube remote client config is required")
	}
	httpTimeout := config.CubeHTTPTimeout
	if httpTimeout <= 0 {
		httpTimeout = DefaultCubeHTTPTimeout
	}
	sdkCfg := cubesandbox.Config{
		APIURL:         config.CubeAPIURL,
		APIKey:         config.CubeAPIKey,
		TemplateID:     config.CubeTemplate,
		SandboxDomain:  config.CubeSandboxDomain,
		Timeout:        config.CubeHTTPTimeout,
		RequestTimeout: config.CubeHTTPTimeout,
	}

	if proxyHost, proxyPort, proxyScheme, ok := parseProxyURL(config.CubeProxyURL); ok {
		sdkCfg.ProxyNodeIP = proxyHost
		sdkCfg.ProxyPortHTTP = proxyPort
		sdkCfg.ProxyScheme = proxyScheme

View on GitHub (pinned to 988cbb0330)

Solutions

Resolve the tenant's sandbox config first and handle the missing-config case before constructing the client.
At call sites, check for nil config and return a config-incomplete error (map to 400) instead of calling the constructor.
If the config may legitimately be absent, gate construction behind sandbox config presence (RequireCompleteConfig).
In tests, always construct a valid &sandbox.Config{} rather than nil.

Example fix

// before
cfg, _ := resolveSandboxConfig(ctx, tenantID)
client, err := sandbox.NewCubeRemoteClient(cfg) // panics into error if cfg nil
// after
cfg, err := resolveSandboxConfig(ctx, tenantID)
if err != nil || cfg == nil {
    return nil, sandbox.ErrSandboxConfigIncomplete
}
client, err := sandbox.NewCubeRemoteClient(cfg)

Defensive patterns

Strategy: validation

Validate before calling

cfg, err := resolveSandboxConfig(ctx, tenantID)
if err != nil {
    return nil, err
}
if cfg == nil {
    return nil, sandbox.ErrSandboxConfigIncomplete
}
client, err := sandbox.NewCubeRemoteClient(cfg)

Type guard

func canBuildCubeClient(cfg *sandbox.Config) bool { return cfg != nil }

Try / catch

client, err := sandbox.NewCubeRemoteClient(cfg)
if err != nil {
    if strings.Contains(err.Error(), "config is required") {
        return nil, fmt.Errorf("sandbox not configured for tenant: %w", err)
    }
    return nil, err
}

Prevention

Never ignore the error from config resolution; a (nil, nil) result still needs handling.
Gate client construction behind RequireCompleteConfig.
Construct configs explicitly in tests instead of passing nil.

When it happens

Trigger: Calling NewCubeRemoteClient, buildClient, or NewRemoteForCheck when the resolved sandbox *Config is nil — e.g. config lookup returned (nil, nil), a check/health-probe path skipped config resolution, or a test constructed the client directly without a config.

Common situations: Tenant sandbox config missing so resolution silently yields nil; refactors changing NewCubeRemoteClient to pass through an optional config; health-check endpoints probing before configuration exists.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/0595491e48ac2efa. Report an issue: GitHub.