trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-25 06:42:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(drivers): explain identity environment defaults

Browse Source 
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
This commit is contained in:
Matthew Grossman
2026-08-11 11:29:35 -07:00
parent 02ae9bc8d5
commit 0df87cd3e0
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-driver-docker/src/lib.rs
+3 -1
View File
@@ -2251,7 +2251,9 @@ fn build_environment_for_oci_user(
environment.remove(openshell_core::sandbox_env::SANDBOX_TOKEN);
environment.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE);
// Ignore image-provided Podman probe attestations.
// Protected identity keys must be explicit even when unset: an omitted
// key can inherit image ENV, while an empty driver-owned value masks image
// metadata until the driver has an authoritative value to supply.
environment.insert(
openshell_core::sandbox_env::OCI_WORKSPACE_IDENTITY.to_string(),
String::new(),
crates/openshell-driver-podman/src/container.rs
+3 -3
View File
@@ -583,9 +583,9 @@ fn build_env(
env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN);
env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE);
// The final spec overwrites this only after a successful immutable-image
// probe. An explicit empty value prevents image ENV from forging the
// attestation contract on the /sandbox compatibility path.
// Protected identity keys must be explicit even when unset: an omitted
// key can inherit image ENV, while an empty driver-owned value masks image
// metadata until the driver has an authoritative value to supply.
env.insert(
openshell_core::sandbox_env::OCI_WORKSPACE_IDENTITY.into(),
String::new(),