mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Eric Curtin
1c8417c4dd
The existing docs omitted or misstated several requirements when running the gateway as a container with the Docker compute driver: - OPENSHELL_GRPC_ENDPOINT is required; the Docker driver uses only the scheme (http/https) — host and port are substituted automatically with host.openshell.internal and the gateway's own bind port - Supervisor binary must be extracted to a host path before starting the gateway; bind-mount sources are resolved by the host Docker daemon so the path must be identical inside and outside the gateway container - Docker socket access requires adding the docker group (UID 1000 default) - Port binding should remain 127.0.0.1; Docker driver adds a bridge listener automatically - add --server-san host.openshell.internal to generate-certs for mTLS - Complete the mTLS docker run with all Docker driver requirements - Add deploy/docker/gateway.toml — TOML config for the Docker driver - Add deploy/docker/docker-compose.yml referencing the TOML - Add docs/get-started/tutorials/docker-compose.mdx tutorial page - Remote gateway registration instructions (--remote flag) Address reviewer feedback: - Move Docker Compose tutorials card to the bottom of the list - Replace inline YAML snippet in Docker Compose section with a reference to deploy/docker/ to avoid drift - Clarify OPENSHELL_DB_URL is safe in compose.yml (plain SQLite path, no credentials); the TOML block targets credential-bearing DSNs - Note that ./ in source: resolves relative to the compose file directory - Clarify that only the scheme from OPENSHELL_GRPC_ENDPOINT matters - Add note that the tilde volume mount resolves to the same absolute path on both host and container
52 lines
2.3 KiB
TOML
52 lines
2.3 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# OpenShell gateway TOML configuration — Docker compute driver.
|
|
#
|
|
# This file is the primary configuration source for docker-compose.yml in this
|
|
# directory. It is mounted read-only at /etc/openshell/gateway.toml inside the
|
|
# gateway container and loaded via OPENSHELL_GATEWAY_CONFIG.
|
|
#
|
|
# Why docker-compose.yml sets command: []:
|
|
# The gateway image's default CMD passes --bind-address 0.0.0.0 --port 8080
|
|
# as explicit CLI flags. CLI flags beat the TOML file in the merge order, so
|
|
# bind_address = "127.0.0.1:8080" below would be silently ignored without
|
|
# clearing the CMD first.
|
|
#
|
|
# grpc_endpoint note:
|
|
# host.docker.internal is automatically resolvable from containers on
|
|
# Docker Desktop (Windows / macOS). On Linux, add extra_hosts to the
|
|
# gateway service:
|
|
# extra_hosts:
|
|
# - "host.docker.internal:host-gateway"
|
|
# - "host.openshell.internal:host-gateway"
|
|
|
|
[openshell]
|
|
version = 1
|
|
|
|
[openshell.gateway]
|
|
# Bind to loopback only. The Docker driver adds an extra listener on the
|
|
# bridge interface automatically so sandbox containers can reach the gateway.
|
|
bind_address = "127.0.0.1:8080"
|
|
health_bind_address = "127.0.0.1:8081"
|
|
log_level = "info"
|
|
compute_drivers = ["docker"]
|
|
disable_tls = true
|
|
|
|
[openshell.drivers.docker]
|
|
# Default image pulled for `openshell sandbox create` without --from.
|
|
default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
|
|
# Supervisor image from which the openshell-sandbox binary is extracted on
|
|
# first start. The binary is cached to XDG_DATA_HOME and reused on restart.
|
|
supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest"
|
|
# Only pull images that are not already cached locally.
|
|
image_pull_policy = "IfNotPresent"
|
|
# Prefix applied to sandbox container names.
|
|
sandbox_namespace = "openshell"
|
|
# Address sandbox containers use to call back to the gateway.
|
|
# The Docker driver replaces the host with host.openshell.internal and the
|
|
# port with the gateway's own bind port (8080). Only the scheme survives.
|
|
# The gateway must be published on port 8080 on the Docker host so that
|
|
# host.openshell.internal:8080 resolves to the gateway container.
|
|
grpc_endpoint = "http://host.openshell.internal:8080"
|