 Matthew Grossman
|
bc14018cad
|
feat(sandbox): use policy-first OCI image identity (#2509)
* feat(sandbox): use policy-first OCI image identity
Closes #2331
Preserve per-field policy omission, derive Docker and Podman fallbacks from the inspected immutable image, and resolve the final numeric identity before starting agent children.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(sandbox): preserve declared process identities
Keep explicit policy values and OCI-declared names intact, defer passwd lookup until a primary GID is required, and refresh stale policy examples.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(supervisor): reuse resolved OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(supervisor): allow Linux pre-exec arguments
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(kubernetes): protect resolved sandbox identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(sandbox): prepare workspace for OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* refactor(sandbox): own only workspace root
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(sandbox): harden partial identity drops
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* test(sandbox): scope OCI image e2e to Docker
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(sandbox): narrow OCI identity fallback scope
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* test(podman): cover OCI identity launch
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
* fix(podman): exercise OCI fallback in E2E
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
|
2026-07-29 05:27:21 +00:00 |
|