Conversation
akram
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
September 9, 2026 10:08
akram
marked this pull request as draft
September 9, 2026 10:29
akram
force-pushed
the
refactor/sandbox-alpine-default
branch
from
September 10, 2026 16:21
1344ed3 to
e3e2878
Compare
akram
changed the title
akram
force-pushed
the
refactor/sandbox-alpine-default
branch
6 times, most recently
from
September 10, 2026 20:19
ceb6dcc to
813092f
Compare
akram
changed the title
akram
force-pushed
the
refactor/sandbox-alpine-default
branch
3 times, most recently
from
September 15, 2026 19:10
d355c19 to
78d68c0
Compare
… and gateway Add multi-stage Dockerfiles that build the OpenShell supervisor and gateway images entirely inside an OpenShift/Buildah cluster, for environments without the upstream Nix CI pipeline that stages prebuilt binaries under deploy/docker/.build/prebuilt-binaries. Both reproduce the exact upstream artifacts by running the project's own Nix devShells in a builder stage, then assembling a runtime stage identical to the existing Dockerfile.supervisor / Dockerfile.gateway: - Dockerfile.supervisor.multistage: builds the static musl openshell-sandbox binary via the musl devShell; runtime is alpine:3.22 with nftables/iptables and COPY --chmod=0555. - Dockerfile.gateway.multistage: builds openshell-gateway via the glibc-2-28 devShell, normalizes the ELF interpreter with patchelf and asserts z3 is statically embedded; runtime is distroless cc-debian13. Each builder collapses build and cleanup into a single RUN so the Nix store never enters the committed layer, keeping the intermediate commit small and within the node's ephemeral-storage budget. The upstream Dockerfiles and CI binary pipeline are unchanged. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
default_sandbox_image() now returns docker.io/library/alpine:3.22, a generic version-qualified official image, so a fresh install no longer depends on the community sandbox image catalog. All compute drivers (docker, podman, kubernetes, vm) inherit this fallback. Part of NVIDIA#3116. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
The restrictive default policy granted read-only access to /app, a directory that only existed in the community base image. A generic Alpine default has no /app, so remove it. Landlock best-effort already ignores absent paths; this just stops advertising a community-specific layout in the default. Part of NVIDIA#3116. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
…ox image Update the shared gateway default_image, Helm chart values, the standalone Kubernetes manifest, and the dev gateway task scripts to use docker.io/library/alpine:3.22 instead of the community base image, consistent with default_sandbox_image(). GPU e2e image-build base is left unchanged (CUDA needs a glibc base). Part of NVIDIA#3116. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
Remove DEFAULT_COMMUNITY_REGISTRY, resolve_community_image, and the OPENSHELL_COMMUNITY_REGISTRY override. Bare --from values are no longer expanded into the OpenShell Community registry; the CLI and TUI now pass explicit OCI image references through to the gateway unchanged. The openshell-core image module is reduced to default_sandbox_image(). BREAKING CHANGE: community sandbox shorthand names and OPENSHELL_COMMUNITY_REGISTRY are no longer supported; pass a full OCI image reference to --from. Part of NVIDIA#3116. Signed-off-by: Akram <akram.benaissi@gmail.com>
With the default sandbox image now Alpine, images that declare no OCI USER must start instead of being rejected. When the image declares no USER and the policy requests none, the Podman and Docker drivers now supply a numeric non-root identity (DEFAULT_SANDBOX_UID/GID = 1000) instead of rejecting, matching the numeric-identity behavior of the Kubernetes and VM drivers. The supervisor's resolved-identity path runs the sandbox as a synthesized non-root account without the account existing in the image. Images that declare a USER keep the OCI resolution path unchanged. Part of NVIDIA#3116. Signed-off-by: Akram <akram.benaissi@gmail.com>
Replace the remaining OpenShell Community sandbox image references (RPM/Helm docs, SDK doc examples, and test fixtures) with the Alpine default, and update the resolve_from test that asserted community-name expansion — bare values are now passed through unchanged as explicit OCI references. The VM runtime image pin (driver-vm/runtime/pins.env) and the GPU e2e build base (tasks/scripts/e2e-gpu-build-images.sh) reference a community image for their own runtime/build needs and are intentionally left for separate follow-ups. Part of NVIDIA#3116. Signed-off-by: Akram <akram.benaissi@gmail.com>
akram
force-pushed
the
refactor/sandbox-alpine-default
branch
from
September 16, 2026 16:19
78d68c0 to
243dc1e
Compare
Contributor
Author
|
Closing in favor of #3386. This branch's history became hard to follow — it carried the now-superseded netns/rtnetlink work (#3281/#3282/#3285, closed) and was force-pushed several times while |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First code increment toward #3116 (retire community images, default to Alpine): change the default sandbox image to a generic official Alpine image, remove the built-in community catalog resolution, make the container drivers work on a USER-less base image, and point the deployment configs at Alpine. Also adds OpenShift in-cluster build tooling. Upstream Dockerfiles and explicit image-reference behavior are preserved.
Related Issue
Part of #3116. Depends on #2750 for proxy-mode networking on a bare image (see Follow-up).
Changes
default_sandbox_image()→docker.io/library/alpine:3.22, inherited by all compute drivers.DEFAULT_COMMUNITY_REGISTRY,resolve_community_image,OPENSHELL_COMMUNITY_REGISTRY; explicit--fromOCI references pass through. BREAKING./apppath from the default policy.USER(like K8s/VM), instead of rejecting withOCI USER is required.Dockerfile.{supervisor,gateway}.multistagereproducing the upstream Nix build inside OpenShift/Buildah.Testing
CreateSandboxwith no image →docker.io/library/alpine:3.22.driver=podman) starts an Alpine sandbox — supervisor boots (noOCI USER is required), interoperates with existing supervisors. Fails only later on proxy-mode networking (see below).cargo testgreen for modified crates.Follow-up
ip(×32),nsenter(×9),nft(×6) anddmesg, which bare Alpine lacks (busyboxiphas nonetns). feat(sandbox): make privileged supervisor independent of workload-image code #2750 proposes replacing these with direct namespace syscalls / route netlink / nf_tables netlink / NFLOG, making the supervisor independent of the workload image. That work is a prerequisite for a bare-Alpine default in proxy mode.0.1.0migration guide, community repo decommission.