mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-20 06:00:06 +08:00

Files

T

History

Evan Lezar 2dae91642a feat(core): add the CDI context to the sandbox boundary protocol

Define the shared CDI context schema: the selected CDI device IDs and
the workload-local paths at which a compute driver projects CDI spec
directories. Carry it as an optional field in the sandbox boundary
configuration, omitted from serialized output when absent so non-GPU
bootstraps stay readable by older sandbox runtimes. No driver sets it
yet.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

2026-10-16 00:01:05 +02:00

proto

feat(isolation): implement the RFC 0012 sandbox architecture (#2942 )

2026-09-16 00:49:14 +00:00

src

feat(core): add the CDI context to the sandbox boundary protocol

2026-10-16 00:01:05 +02:00

build.rs

fix(build): honor PROTOC when generating protobuf code (#4441 )

2026-10-14 18:35:23 +00:00

Cargo.toml

feat(isolation): implement the RFC 0012 sandbox architecture (#2942 )

2026-09-16 00:49:14 +00:00

README.md

refactor(runtime): extract portable driver and isolation foundations (#4106 )

2026-10-14 03:07:31 +00:00

README.md

OpenShell sandbox backend

This crate implements the supervisor-side isolation backend and the private control protocol shared with openshell-sandbox.

Exec recovery

An exec envelope carries a UUID request ID and an absolute expiration time in Unix milliseconds, set to 30 seconds after creation. The payload digest includes the expiration time, and transport recovery preserves the entire envelope. The supervisor and sandbox need synchronized wall clocks.

The sandbox checks expiration before starting or reattaching an exec. It keeps each admitted request ID until that deadline, independently of process and I/O retention. An expired request, including a delayed first attempt, is rejected even after its ID has been discarded. The sandbox never moves its observed admission clock backwards, so a clock adjustment cannot resurrect discarded requests. Expired IDs are reclaimed when the next exec request arrives.

There is no lifetime exec request count limit. The existing concurrent process retention limit still applies. The deadline governs admission and recovery; it does not terminate an already running command. A recovery timeout can leave the execution outcome unknown.

Exec envelopes without an expiration time are rejected. Update the supervisor and sandbox runtime together when deploying this protocol change.

Boundary audit validation

OpenShellRuntimeBackend implements the authenticated host side of the shared Sandbox Protocol.

Backend implementations may inject a BoundaryAuditValidator to interpret their opaque confirmation evidence. The default Linux validator rejects incomplete or foreign evidence. Confirmation compares the asserted properties with the properties derived by the selected validator; validator injection does not bypass generation, session, resource, identity, or outer-fence checks.

Concrete platform validators belong to the implementing backend, not this shared transport library.

Boundary transport establishment

Backends may supply a BoundaryTransportConnector for raw stream establishment. The shared client retains TLS peer verification, session bearer authentication, generation checks, and reconnection handling. The connector is reused for policy discovery and attachment; it does not define platform launch configuration or replace the isolation interface.