From 26d90513a5a789c0e33b4eb8ba199786eaaece76 Mon Sep 17 00:00:00 2001 From: Akber Raza Date: Thu, 13 Aug 2026 18:13:54 -0500 Subject: [PATCH] feat: enhance MXC backend with provider credential management - Introduced `pending_provider_credentials` in `MxcComputeBackend` to manage out-of-band provider credential state. - Added `append_provider_child_env` function to merge provider credentials into the agent environment, ensuring sensitive values are not exposed. - Updated `create_sandbox` method to validate egress requirements for provider credentials. - Implemented `resolve_sandbox_create_runtime_inputs` to prepare driver-specific sandbox creation state, including effective policy and provider credentials. - Modified gRPC handlers to utilize the new provider credential management features. - Updated documentation to clarify the use of provider credentials and their requirements for governed egress. Signed-off-by: Akber Raza --- docs/reference/gateway-config.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/reference/gateway-config.mdx b/docs/reference/gateway-config.mdx index 7c8e043e1..6804add9a 100644 --- a/docs/reference/gateway-config.mdx +++ b/docs/reference/gateway-config.mdx @@ -914,6 +914,8 @@ OpenShell sends no override and Podman applies its runtime-selected profile. Set `Unconfined` explicitly only when the deployment requires the supervisor's mount setup to bypass that profile. +Attached provider credentials require this governed-egress path. The gateway gives MXC only revision-scoped environment placeholders and keeps real values in the host proxy's endpoint-bound resolver. Provider keys override matching `agent_env` entries case-insensitively. Sandbox creation fails when attached provider material exists but `egress_proxy` is disabled. MXC takes its provider snapshot at creation; recreate the sandbox after attaching, detaching, or rotating a provider. + ### MicroVM Each sandbox runs inside its own libkrun microVM managed by the standalone `openshell-driver-vm` subprocess. Use this driver when you want stronger isolation than container namespaces alone.