mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-25 06:42:52 +08:00
Drew Newberry
32f026442e
* feat(sandbox): support sandbox-initiated supervisor connections Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): consolidate control transport setup Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(sandbox): remove prototype-specific unit tests Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(kubernetes): migrate legacy control flow on restart Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs: remove prototype changes from published docs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): adapt reverse control to published backend protocol Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(sandbox): initiate supervisor connections across compute drivers Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(docker): stage reverse control socket for the supervisor identity Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): keep runtime transports behind the backend Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(docker): mount the runtime control volume read-only The sandbox runtime only dials the supervisor-owned control socket, so it does not need write access to the control volume. Mount it read-only in the runtime container and stop staging the control directory through the runtime bundle; the supervisor stager already initializes it through its own writable mount. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(kubernetes): separate legacy and runtime-initiated control services Keep os-boundary selecting the workload and add os-supervisor for runtime-initiated connections. Bind the mode marker to its runtime generation so a restart by an older gateway does not inherit stale mode metadata. Preserve the legacy Service across creation and restart, validate the active endpoint, and drop the Service patch permission. Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
51 lines
1.5 KiB
TOML
51 lines
1.5 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[package]
|
|
name = "openshell-sandbox-backend"
|
|
description = "OpenShell Sandbox Protocol and its supervisor-side IsolationBackend implementation"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[features]
|
|
test-support = []
|
|
|
|
[dependencies]
|
|
openshell-crypto = { workspace = true }
|
|
openshell-core = { path = "../openshell-core", default-features = false, features = ["jwt"] }
|
|
openshell-isolation-interface = { path = "../openshell-isolation-interface" }
|
|
async-trait = "0.1"
|
|
bytes = { workspace = true }
|
|
hyper-util = { workspace = true }
|
|
prost = { workspace = true }
|
|
prost-types = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
rustls = { workspace = true }
|
|
rustls-pemfile = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
socket2 = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tokio-util = { version = "0.7", features = ["io"] }
|
|
tokio-rustls = { workspace = true }
|
|
tokio-stream = { workspace = true }
|
|
tonic = { workspace = true }
|
|
tonic-prost = { workspace = true }
|
|
tower = { workspace = true }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = "0.2"
|
|
rustix = { workspace = true, features = ["fs", "process"] }
|
|
|
|
[dev-dependencies]
|
|
jsonwebtoken = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|