From 0df87cd3e03a8a99b75322530bc675bc39da95cf Mon Sep 17 00:00:00 2001 From: Matthew Grossman Date: Tue, 11 Aug 2026 11:29:35 -0700 Subject: [PATCH] docs(drivers): explain identity environment defaults Signed-off-by: Matthew Grossman --- crates/openshell-driver-docker/src/lib.rs | 4 +++- crates/openshell-driver-podman/src/container.rs | 6 +++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/crates/openshell-driver-docker/src/lib.rs b/crates/openshell-driver-docker/src/lib.rs index 0d139ebf2..cfd6c7490 100644 --- a/crates/openshell-driver-docker/src/lib.rs +++ b/crates/openshell-driver-docker/src/lib.rs @@ -2251,7 +2251,9 @@ fn build_environment_for_oci_user( environment.remove(openshell_core::sandbox_env::SANDBOX_TOKEN); environment.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE); - // Ignore image-provided Podman probe attestations. + // Protected identity keys must be explicit even when unset: an omitted + // key can inherit image ENV, while an empty driver-owned value masks image + // metadata until the driver has an authoritative value to supply. environment.insert( openshell_core::sandbox_env::OCI_WORKSPACE_IDENTITY.to_string(), String::new(), diff --git a/crates/openshell-driver-podman/src/container.rs b/crates/openshell-driver-podman/src/container.rs index 853e6ed15..9f6378dec 100644 --- a/crates/openshell-driver-podman/src/container.rs +++ b/crates/openshell-driver-podman/src/container.rs @@ -583,9 +583,9 @@ fn build_env( env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN); env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE); - // The final spec overwrites this only after a successful immutable-image - // probe. An explicit empty value prevents image ENV from forging the - // attestation contract on the /sandbox compatibility path. + // Protected identity keys must be explicit even when unset: an omitted + // key can inherit image ENV, while an empty driver-owned value masks image + // metadata until the driver has an authoritative value to supply. env.insert( openshell_core::sandbox_env::OCI_WORKSPACE_IDENTITY.into(), String::new(),