Move the gateway VM launching out of `nemoclaw gateway` into its own
`gateway` binary built from the navigator-vm crate. The nemoclaw CLI
no longer links against libkrun or requires macOS hypervisor codesigning.
Add scripts/bin/gateway wrapper (build + codesign + exec) and clean up
scripts/bin/nemoclaw to remove navigator-vm artifacts.
Stop deleting meta.db in gateway-init.sh and include the native
snapshotter, content store, and metadata DB in the rootfs built by
build-rootfs.sh. Without meta.db, containerd re-extracts all image
layers on every boot (~2 min for navigator/server on virtio-fs),
causing kubelet CreateContainer timeouts. Also replace the etcd-snapshot
approach with direct SQLite cleanup of the kine DB to remove stale
pod/event/lease records.
Add a new navigator-vm library crate that boots k3s inside a libkrun
microVM, accessible from the host via gvproxy port forwarding.
Key components:
- FFI bindings to libkrun C API (krun_create_ctx, krun_add_net_unixgram, etc.)
- VmConfig with gateway() preset for k3s and custom exec mode
- gvproxy integration: virtio-net via unixgram, DHCP, native HTTP port forwarding
- gateway-init.sh: PID 1 init script with DHCP via udhcpc, mounts, k3s exec
- build-rootfs.sh: builds Ubuntu 22.04 arm64 rootfs with k3s + busybox-static
- Kubeconfig auto-extraction to ~/.kube/gateway.yaml
- CLI integration as 'ncl gateway' with --exec, --port, --net flags
- macOS codesigning and DYLD_FALLBACK_LIBRARY_PATH in ncl wrapper
Closes#273
Verify inference endpoints synchronously on the server during set/update, expose a --no-verify escape hatch in the CLI and Python helper, and return actionable failures when validation does not pass.
Compute version strings from git describe in openshell-core's build.rs
using the guess-next-dev scheme (e.g. 0.0.4-dev.6+g2bf9969). All binary
crates and the TUI splash screen now use the shared openshell_core::VERSION
constant instead of CARGO_PKG_VERSION.
In Docker/CI builds where .git is absent, falls back to CARGO_PKG_VERSION
which is already set correctly by the sed-patch pipeline. Also adds
OPENSHELL_CARGO_VERSION support to the cluster image and fast-deploy
supervisor builds for parity with the gateway.
* feat(sandbox): add gpu sandbox scheduling support
Allow sandbox creation to request GPU resources explicitly or infer them from GPU image names. This wires GPU intent through bootstrap, validates gateway support, and adds dedicated GPU E2E coverage for follow-up cluster testing.
Drew Newberry