Docs: runtime images and conda channel hosting (OH_CONDA_CHANNEL_ALIAS)

openapi/agent-sdk.json

@@ -5171,7 +5171,7 @@
           "version": {
             "type": "string",
             "title": "Version",
-            "default": "1.0.0a3"
+            "default": "1.0.0a4"
           },
           "docs": {
             "type": "string",

openhands/runtime/runtime-images-and-conda.mdx

@@ -0,0 +1,37 @@
+---
+title: Runtime images and conda channel hosting
+---
+
+This page explains when OpenHands runtime builds may contact anaconda.org and how to avoid it.
+
+Overview
+- OpenHands runtime images are built with micromamba and we install Python and Poetry from the conda-forge channel
+- Even when using only conda-forge, the default channel_alias expands conda-forge to https://conda.anaconda.org/conda-forge, which is hosted under anaconda.org
+
+Two usage paths
+1) Use prebuilt runtime images
+- No conda network activity occurs during normal use; no contact with anaconda.org on your side
+- If your organization must avoid any anaconda.org contact entirely, build your own runtime image instead (path 2) and configure OpenHands to use it
+
+2) Build runtime images yourself
+- As of PR #11516, you can override where the conda-forge channel resolves by setting an environment variable before building:
+
+  export OH_CONDA_CHANNEL_ALIAS=https://repo.prefix.dev
+  # then run your standard OpenHands build/run flow that triggers runtime image build
+
+- With this set, our Dockerfile sets:
+  micromamba config set channel_alias https://repo.prefix.dev
+
+- We continue to reference -c conda-forge for packages, which will resolve under the configured host (e.g., repo.prefix.dev) instead of anaconda.org
+
+- You can point channel_alias to:
+  - A public alternative such as https://repo.prefix.dev
+  - An internal corporate mirror/proxy (e.g., Artifactory) that fronts conda-forge
+
+Notes
+- We remove the defaults channel, so no packages are pulled from Anaconda's defaults repo
+- However, without channel_alias, conda-forge still resolves under the anaconda.org domain by default, which is why you may see requests there
+
+References
+- Conda channels and alias docs: https://www.anaconda.com/docs/getting-started/working-with-conda/channels
+- Background: https://github.com/conda-forge/miniforge/issues/784