omnia-arena-builder chart

omnia-arena-builder is the Helm chart that installs the Arena builder agent into one workspace namespace. It is an Omnia module at blueprint tier and requires Omnia >=0.9.0. To install it, see Install the Arena builder.

The chart is published at the Omnia release’s version to oci://ghcr.io/altairalabs/charts/omnia-arena-builder and to the https://charts.altairalabs.ai Helm repository.

Rendered objects

Every object goes into the release namespace and carries the name agent.name (default arena-builder) and the label omnia.altairalabs.ai/role: arena-builder.

Kind	Contents
SandboxClass	The omnia-promptarena-sandbox image, pinned by digest, with one project mount (ReadWrite) and no egress. The class is never trusted.
ToolRegistry	A lazy sandbox named sandbox of class SandboxClass/<agent.name>. An mcp handler on it, filtered to allowedTools. The client tools ask_questions and update_spec. A platform handler for discovery when discovery.enabled, and one for arena when arena.enabled.
ConfigMap and PromptPack	The builder’s system prompt and tool definitions as a configmap-source pack.
AgentRuntime	One websocket facade with dataPlane: false and managementPlane: true, and spec.sandbox enabled with idleTimeout, maxConcurrent and mountReleaseGrace.
ToolPolicy	A permit for every tool in the builder’s registry. Omitted when toolPolicy.enabled is false.

Every object except the ToolPolicy carries the label omnia.altairalabs.ai/hidden: "true", so the builder does not appear in agent lists or pickers. The dashboard finds it by name. The ToolPolicy stays visible in the workspace’s policy list.

The chart never creates a Provider, Workspace, Secret, PersistentVolumeClaim or ClusterSandboxClass.

The discovery handler gives the builder the tools catalog_overview, catalog_search and catalog_get. The arena handler gives it arena_check_project, arena_start_run and arena_get_run. Both need the operator to run with --platform-api-url. Without it the operator skips the handler and the builder runs without those tools.

Values

Value	Default	Description
provider.name	none (required)	Name of an existing Provider in the release namespace
agent.name	arena-builder	Name of the AgentRuntime and of every other object the chart renders
agent.maxToolRounds	200	Tool-call rounds the builder may take in one turn before PromptKit stops it (the pack’s tool_policy.max_rounds)
agent.clientToolTimeout	15m	How long the facade waits for the browser to answer ask_questions or update_spec in one turn. Empty keeps the facade default of 60s
agent.systemPrompt	empty	Replaces the builder’s system prompt. Empty uses the prompt the chart ships. The render fails if the prompt contains {{, because the pack’s template engine reads it as a variable
agent.annotations	{}	Extra annotations on the builder’s AgentRuntime
agent.serviceAccountName	empty	spec.podOverrides.serviceAccountName of the builder’s pod. Empty inherits the Workspace’s spec.runtime.serviceAccountName, else the operator’s per-agent <agent.name>-facade
agent.runtime	{}	Passed through as the AgentRuntime’s spec.runtime: volumes, volumeMounts, extraEnv, resources, nodeSelector, tolerations, affinity and replicas
sandbox.image.repository	ghcr.io/altairalabs/omnia-promptarena-sandbox	Sandbox image repository
sandbox.image.digest	the digest of the released image	sha256: followed by 64 hex characters. The chart in the repository leaves it empty and the install fails without it; each release stamps the digest of its own image into the published chart
sandbox.image.tag	the Omnia version in a published chart	Written into the reference beside the digest (repo:tag@digest) for display. The digest decides what is pulled
sandbox.args	["-addr=:8080", "-workspace=/workspace"]	Arguments of the sandbox container
sandbox.env	HOME, GOPATH, GOCACHE and GOMODCACHE under /sandbox-cache	Environment of the sandbox container
sandbox.ports	mcp on 8080	Class ports
sandbox.filesystem	/workspace for the project, a 4Gi scratch volume at /sandbox-cache	The SandboxClass filesystem
sandbox.handlerPort	mcp	The class port the ToolRegistry’s mcp handler dials
sandbox.handlerPath	/sse	The MCP path on that port
sandbox.resources	requests 100m and 128Mi, limits 2 and 2Gi	Sandbox container resources. limits.cpu and limits.memory are required. The memory request is what each builder session reserves on a node
sandbox.runtimeClassName	empty	RuntimeClass of the sandbox pod, such as gVisor or Kata. Empty uses the cluster default
sandbox.nodeSelector	{}	Node selector of the sandbox pod
sandbox.tolerations	[]	Tolerations of the sandbox pod
sandbox.idleTimeout	30m	How long a bound sandbox may sit unused before the reaper deletes it
sandbox.mountReleaseGrace	5m	How long a builder sandbox outlives its conversation (spec.sandbox.mountReleaseGrace). A person who comes back within it finds the same sandbox; after it, a new one on the same project files
sandbox.maxConcurrent	4	How many builder sandboxes may run at once across every user of the workspace (spec.sandbox.maxConcurrent). A first tool call past it waits for a slot. A session keeps its slot for sandbox.mountReleaseGrace after its conversation ends: size it as users active at once plus users who left within the last mountReleaseGrace
toolCallTimeout	5m	Timeout of one sandbox tool call, which can include a claim, an image pull and a pod start
allowedTools	Read, Write, Edit, Bash	Sandbox tools the builder may call. Each needs a definition in the chart’s files/sandbox-tools.json, or the render fails
toolPolicy.enabled	true	Render the ToolPolicy. The policy broker refuses every tool call that no ToolPolicy permits, so set false only when you manage a ToolPolicy that selects the builder’s registry
discovery.enabled	true	Add the discovery platform handler and its three tools
arena.enabled	true	Add the arena platform handler and its three tools

Sandbox image

The image is built from Dockerfile.promptarena-sandbox and published as ghcr.io/altairalabs/omnia-promptarena-sandbox with every Omnia release. It contains:

Path	Contents
/usr/local/bin/promptarena, /usr/local/bin/packc	The PromptArena and packc CLIs, on the codegen-sandbox base
/opt/promptarena/brief	The PromptArena authoring brief
/schemas/v1alpha1	The CLI’s JSON schemas. PROMPTKIT_SCHEMA_SOURCE=local makes promptarena validate and promptarena run read them, so neither needs the network
git	Configured from images/promptarena-sandbox/

The git configuration sets:

• a commit-msg hook that adds Co-authored-by: Omnia builder <builder@omnia.invalid> to every commit;
• /workspace as the only safe directory;
• an empty credential helper and no remote.

The sandbox has no git credential and its egress is unchanged, so it cannot push.

Related pages

• Helm values: Arena builder: the dashboard.builder values that name the agent, sandbox and mount role
• SandboxClaim: mount roles and the SandboxClass fields
• Codegen sandbox isolation