mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-13 04:51:00 +08:00
Jesse JaggarsandDrew Newberry
02b664bb0d
* refactor(config): normalize compute driver field names Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * refactor(config): introduce canonical gateway fields Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * refactor(config): enforce gateway schema version 2 Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): preserve compute driver runtime guarantees Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): address schema v2 review regressions Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): complete schema v2 migration safeguards Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(config): expand schema v2 regression coverage Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(config): add schema v2 parity manifest Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): correct parity manifest inventory Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * docs(config): record schema v2 intentional changes Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * docs(config): disposition schema v2 parity gaps Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): add dual schema parity harness Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): establish compute lifecycle parity baseline Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): preserve gateway option compatibility Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): record gateway option parity Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * docs(config): close gateway-wide parity gaps Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(podman): apply configured pids limit Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): validate Podman option parity Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): add Kubernetes option parity harness Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): record Kubernetes option parity Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): disposition VM parity lanes Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): add external driver parity lane Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(e2e): preserve external driver pull policy Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): attest parity artifacts and launches Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): require clean parity build sources Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): bind parity runtime artifacts Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(e2e): use isolated supervisor tags Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(e2e): qualify parity image tags Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(e2e): serve parity supervisor locally Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): isolate parity podman services Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): harden parity evidence provenance Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): pin parity sandbox artifacts Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): attest parity runtime inputs Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): bind parity runtime evidence Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): record compute boundary parity Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(e2e): disposition cross-cutting parity lanes Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(packaging): preflight gateway config upgrades Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): preserve rebase integration guarantees Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(ci): isolate temporary git signing config Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): update remaining schema v2 consumers Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(ci): provide e2fs tools to VM tests Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): align preflight with gateway startup Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(vm): preserve rootfs tar configuration Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * chore(config): adopt duration unit constructors Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(packaging): preflight RPM gateway config Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(config): address driver review findings Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(e2e): require fresh semantic parity evidence Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * fix(docker): update tests for renamed sandbox label Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> * test(gateway): preserve selective driver coverage after rebase Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Jesse Jaggars <jjaggars@redhat.com> Signed-off-by: Drew Newberry <anewberry@nvidia.com> Co-authored-by: Drew Newberry <anewberry@nvidia.com>
55 lines
2.5 KiB
TOML
55 lines
2.5 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# OpenShell gateway TOML configuration — Docker compute driver.
|
|
#
|
|
# This file is the primary configuration source for docker-compose.yml in this
|
|
# directory. It is mounted read-only at /etc/openshell/gateway.toml inside the
|
|
# gateway container and loaded via OPENSHELL_GATEWAY_CONFIG.
|
|
#
|
|
# Why docker-compose.yml sets command: []:
|
|
# The gateway image's default CMD passes --bind-address 0.0.0.0 --port 8080
|
|
# as explicit CLI flags. CLI flags beat the TOML file in the merge order, so
|
|
# bind_address = "127.0.0.1:8080" below would be silently ignored without
|
|
# clearing the CMD first.
|
|
#
|
|
# grpc_endpoint note:
|
|
# host.docker.internal is automatically resolvable from containers on
|
|
# Docker Desktop (Windows / macOS). On Linux, add extra_hosts to the
|
|
# gateway service:
|
|
# extra_hosts:
|
|
# - "host.docker.internal:host-gateway"
|
|
# - "host.openshell.internal:host-gateway"
|
|
|
|
[openshell]
|
|
version = 2
|
|
|
|
[openshell.gateway]
|
|
# Bind to loopback only. The Docker driver adds an extra listener on the
|
|
# bridge interface automatically so sandbox containers can reach the gateway.
|
|
bind_address = "127.0.0.1:8080"
|
|
health_bind_address = "127.0.0.1:8081"
|
|
log_level = "info"
|
|
compute_driver = "docker"
|
|
disable_tls = true
|
|
|
|
[openshell.drivers.docker]
|
|
# Default image pulled for `openshell sandbox create` without --from.
|
|
default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
|
|
# Supervisor image from which the openshell-sandbox binary is extracted on
|
|
# first start. The binary is cached to XDG_DATA_HOME and reused on restart.
|
|
supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest"
|
|
# Only pull images that are not already cached locally.
|
|
image_pull_policy = "if_not_present"
|
|
# Value assigned to the openshell.sandbox_namespace label on sandbox containers.
|
|
sandbox_label = "openshell"
|
|
# Address sandbox containers use to call back to the gateway.
|
|
# The Docker driver replaces the host with host.openshell.internal and the
|
|
# port with the gateway's own bind port (8080). Only the scheme survives.
|
|
# The gateway must be published on port 8080 on the Docker host so that
|
|
# host.openshell.internal:8080 resolves to the gateway container.
|
|
grpc_endpoint = "http://host.openshell.internal:8080"
|
|
# Explicit supervisor-compatible Docker default. Set RuntimeDefault or
|
|
# Localhost/<profile> only when the daemon host has AppArmor available.
|
|
app_armor_profile = "Unconfined"
|