 Drew Newberry
|
62f7f92181
|
refactor(kubernetes): describe the single runtime placement
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:39:05 -07:00 |
|
|
Drew Newberry
|
e86c5c3ac2
|
fix(kubernetes): adapt proxy pods to current runtime APIs
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:39:05 -07:00 |
|
|
Drew Newberry
|
6859a3c0ef
|
feat(kubernetes): split sandbox and supervisor images
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:39:05 -07:00 |
|
|
Drew Newberry
|
05b14e152e
|
fix(kubernetes): use stable sandbox service authority
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:39:05 -07:00 |
|
|
Drew Newberry
|
63b74e0b01
|
refactor(kubernetes): use sandbox backend protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:39:05 -07:00 |
|
|
Drew Newberry
|
d90e33bcf7
|
feat(kubernetes): add proxy-pod isolation topology
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:39:05 -07:00 |
|
|
Drew Newberry
|
070b29afc4
|
refactor(docker): name the sandbox runtime directly
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
d34e5bd513
|
fix(docker): restore startup validation after rebase
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
9a658fd339
|
feat(docker): use separate sandbox and supervisor images
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
f171b949a1
|
fix(docker): preserve host gateway alias resolution
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
824b5e8139
|
refactor(docker): use host networking for supervisor
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
f1fa748f4b
|
refactor(docker): use sandbox backend protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
17b86ed25d
|
feat(docker): rotate launch-scoped authentication
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
7c4b5b30b5
|
feat(docker): isolate workloads behind the host supervisor
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:41 -07:00 |
|
|
Drew Newberry
|
ddf93f6ce4
|
fix(supervisor): install session before gateway calls
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
2b28f950bf
|
fix(vm): surface host supervisor failures
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
dfc5a7e56b
|
fix(vm): share resolved sandbox identity
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
4b5a7426e2
|
fix(vm): reconcile admitted sandbox identity
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
97c22d7fec
|
fix(vm): avoid guest interface casts
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
ec88c478a6
|
fix(vm): scope Linux test imports
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
bada067b14
|
fix(vm): guard guest init Linux symbols
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
3409fc275a
|
fix(vm): select native supervisor artifacts
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
238b1ea645
|
fix(vm): expose guest init version
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
654e0129ec
|
refactor(vm): own guest network bootstrap
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
95f262faaf
|
refactor(vm): use sandbox runtime terminology
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
94a0d42b4f
|
fix(vm): use unified build toolchain
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
45c8dc11c2
|
fix(vm): repair rebase integration
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
86b0ac8881
|
refactor(vm): use sandbox backend protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
a31a0938d8
|
feat(vm): run the supervisor outside the guest workload
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
de2b42c6e6
|
fix(sandbox): bind reconnects to supervisor process
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:35:48 -07:00 |
|
|
Drew Newberry
|
48f108374c
|
fix(ci): refresh schema and dependency policy
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 16:49:15 -07:00 |
|
|
Drew Newberry
|
bda6fff5a2
|
refactor(sandbox): use a scratch runtime image
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 16:22:59 -07:00 |
|
|
Drew Newberry
|
d3d92a7ccc
|
refactor(isolation): use backend and runtime terminology
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 14:07:09 -07:00 |
|
|
Drew Newberry
|
07441545ba
|
fix(ci): validate sandbox binary linkage
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:16:22 -07:00 |
|
|
Drew Newberry
|
9b00cb6153
|
feat(config): configure the sandbox runtime image
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
97f26ac888
|
build(runtime): publish separate sandbox and supervisor images
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
2e25ae860d
|
fix(isolation): repair rebased sandbox CI
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
8189cf4ca4
|
fix(sandbox): fail closed across supervisor disconnects
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
31141e0407
|
fix(auth): validate refreshed credentials before rotation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
46fc310ddf
|
fix(sandbox): align projected bootstrap bundle
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
bf42b59e48
|
test(sandbox): align topology session fixture
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
280cdef354
|
refactor(sandbox): consume dedicated backend crate
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
6a3d4a3040
|
feat(supervisor): rotate launch-scoped authentication
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
56a7f2a91d
|
feat(isolation): authenticate the Sandbox Protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
c4a0eff0d6
|
refactor(sandbox): implement loopback connector
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
e184f374a0
|
ci(e2e): select migrated drivers per stack layer
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
f59d403882
|
fix(sandbox): bound control admission and retire stale mediation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
7ec8eff932
|
fix(sandbox): bound network mediation and preserve socket authorization
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
fe6aad8327
|
fix(sandbox): return retained exec exit status to independent waiters
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
2b26edce70
|
test(sandbox): isolate credential probes from filtered threads
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|