mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-19 05:50:41 +08:00
Giuseppe Scrivano
d51a653f9c
* refactor(driver): extract shared supervisor binary helpers Move supervisor binary extraction, caching, and validation helpers from the Docker driver into openshell-core::driver_utils so both Docker and Podman drivers can reuse them. Moved helpers: extract_first_tar_entry, write_cache_binary_atomic, supervisor_cache_path, temp_extract_container_name, and validate_linux_elf_binary. The shared extract_first_tar_entry gains entry-type and empty-payload checks that the Docker-local version lacked. supervisor_cache_path takes a driver_subdir parameter so each driver caches under its own namespace (docker-supervisor vs podman-supervisor). Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> * feat(driver-podman): add userns config Add a `userns` option to the Podman compute driver that maps to Podman's user namespace modes. The mode string is split on the first colon into the API's `nsmode` and `value` fields so parameterized values like `auto:size=65536` and `keep-id:uid=1000,gid=1000` are forwarded correctly. When the mode is `auto`, the container spec also sets `idmappings.AutoUserNs = true` as required by the API. An allowlist validates the mode at startup: `auto` and `keep-id` accept optional parameters; `host`, `private`, and `nomap` reject them; everything else is an error. Podman image volumes use overlay mounts internally and the kernel does not support idmapped mounts on overlay (`mount_setattr` returns EINVAL). When userns is configured (any mode except `host`), the driver extracts the supervisor binary from the image to a host-side cache and bind-mounts it instead of using an image volume. Configurable via TOML `userns = "auto"`, CLI `--userns`, or environment variable `OPENSHELL_PODMAN_USERNS`. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> --------- Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
56 lines
1.8 KiB
TOML
56 lines
1.8 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[package]
|
|
name = "openshell-core"
|
|
description = "Shared library for OpenShell - proto definitions, config, and errors"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[dependencies]
|
|
async-trait = "0.1"
|
|
openshell-extension-core = { path = "../openshell-extension-core" }
|
|
glob = { workspace = true }
|
|
prost = { workspace = true }
|
|
prost-types = { workspace = true }
|
|
tonic = { workspace = true, features = ["channel", "tls-ring"] }
|
|
tonic-prost = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tokio-stream = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
miette = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tracing = { workspace = true }
|
|
url = { workspace = true }
|
|
ipnet = "2"
|
|
base64 = { workspace = true }
|
|
chrono = { version = "0.4", default-features = false, features = ["clock", "std"], optional = true }
|
|
reqwest = { workspace = true, features = ["blocking", "rustls-tls-native-roots"], optional = true }
|
|
tar = { version = "0.4", optional = true }
|
|
tempfile = { version = "3", optional = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
nix = { workspace = true }
|
|
|
|
[features]
|
|
default = ["telemetry"]
|
|
## Compile in anonymous telemetry emission support. On by default; disable with
|
|
## `--no-default-features` (plus any other features you need) for a build that
|
|
## contains no telemetry endpoint, no HTTP client, and no emission code at all.
|
|
driver-extraction = ["dep:tar", "dep:tempfile"]
|
|
telemetry = ["dep:reqwest", "dep:chrono"]
|
|
|
|
[build-dependencies]
|
|
tonic-prost-build = { workspace = true }
|
|
protoc-bin-vendored = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
[lints]
|
|
workspace = true
|