mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-26 06:52:57 +08:00
Drew Newberry
77929d9c14
* feat(isolation): publish backend protocol contracts independently of runtime Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(isolation): expose trusted launch and registry data contracts Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): name the required capability sandbox Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): align protocol and compute capability names Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): finalize public protocol contract names Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(isolation)!: activate backend contracts in sandbox runtime and driver selection Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): simplify runtime and fix backend example Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(examples): organize WASI backend in Rust Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): defer protocol conformance fixtures Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(examples): add supervised V8 backend demo Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(examples): stream V8 guest output with default policy Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(examples): handle V8 rejections and roll back failed launches Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(examples): align V8 crypto dependencies with CI AWS-LC Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(sandbox): represent Sandbox Protocol operations in protobuf Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): replace backend traits with RPC clients Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(proto): remove legacy isolation protocol reservations Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(proto): clarify Sandbox Protocol names Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(isolation): clarify authentication bootstrap and supervisor APIs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): simplify policy enforcement confirmation Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): rotate launch generations and stabilize retry sessions Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): remove redundant backend adapters and TCP flags Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): repair Docker restarts and macOS lint Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): simplify RPC contracts and backend registration Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): deliver TCP denials before closing the RPC Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
53 lines
2.9 KiB
Plaintext
53 lines
2.9 KiB
Plaintext
---
|
|
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
title: "Isolation Backends"
|
|
description: "Understand the runtime boundary used to launch and supervise sandboxed workloads."
|
|
keywords: "OpenShell Extensions, Isolation Backends, Sandbox Runtime, Extensibility"
|
|
---
|
|
|
|
The supervisor uses the `IsolationBackend` RPC service to discover and bind an
|
|
isolation backend, then uses the Sandbox Protocol to launch and control the
|
|
agent workload. The built-in `openshell-sandbox` runtime and external backends
|
|
implement the same services, allowing different isolation mechanisms without
|
|
changing the gateway API or policy model.
|
|
|
|
|
|
|
|
## The protocols
|
|
|
|
The services are defined in
|
|
[`isolation_backend.proto`](https://github.com/NVIDIA/OpenShell/blob/main/proto/isolation_backend.proto)
|
|
and
|
|
[`sandbox_protocol.proto`](https://github.com/NVIDIA/OpenShell/blob/main/proto/sandbox_protocol.proto).
|
|
The supervisor's concrete RPC client, `OpenShellRuntimeBackend`, lives in
|
|
[`openshell-sandbox-backend`](https://github.com/NVIDIA/OpenShell/tree/main/crates/openshell-sandbox-backend).
|
|
|
|
| RPC | What it does |
|
|
|---|---|
|
|
| `IsolationBackend.Describe` | Negotiates the protocol and capabilities. |
|
|
| `IsolationBackend.OpenBoundary` | Binds a provisioned resource to an authenticated launch. |
|
|
| `IsolationBackend.SuspendBoundary` / `ResumeBoundary` | Optionally retains and restores workload state. |
|
|
| `SandboxProtocol.Exchange` | Carries admission, process control and I/O, TCP decisions, and relay data. |
|
|
| `SandboxProtocol.Mediate` | Carries the DNS mediation handshake, queries, and responses. |
|
|
|
|
The admission sequence is Attach, Confirm, then StartAgent. No workload code
|
|
runs before StartAgent.
|
|
|
|
External compute drivers advertise `openshell.compute.isolation-backend` to
|
|
accept an operator-selected `IsolationBackendRegistration`, including its Unix,
|
|
TCP, or vsock endpoint. The driver provisions the resource and delivers the
|
|
backend's trusted launch metadata to the supervisor.
|
|
|
|
## Who Owns What
|
|
|
|
| Component | Owns |
|
|
|---|---|
|
|
| Supervisor | Policy decisions. Policy, credentials, DNS resolution, and approved external connections stay outside the agent workload. |
|
|
| Compute driver | Placement and fencing. The driver creates runtime resources, installs the outer egress fence, and supplies a verified descriptor. |
|
|
| Isolation backend | Enforcement. The backend implements the RPC contracts and enforces the admitted policy inside its provisioned resource. |
|
|
|
|
For how `openshell-sandbox` enforces the boundary, refer to [Inside the Sandbox
|
|
Boundary](/about/architecture#inside-the-sandbox-boundary). For driver-specific
|
|
workload behavior, refer to [Runtimes](/how-it-works/sandboxes/runtimes).
|