mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-02 08:04:37 +08:00
Matthew Grossman
bc14018cad
* feat(sandbox): use policy-first OCI image identity Closes #2331 Preserve per-field policy omission, derive Docker and Podman fallbacks from the inspected immutable image, and resolve the final numeric identity before starting agent children. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(sandbox): preserve declared process identities Keep explicit policy values and OCI-declared names intact, defer passwd lookup until a primary GID is required, and refresh stale policy examples. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(supervisor): reuse resolved OCI identity Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(supervisor): allow Linux pre-exec arguments Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(kubernetes): protect resolved sandbox identity Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(sandbox): prepare workspace for OCI identity Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(sandbox): own only workspace root Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(sandbox): harden partial identity drops Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(sandbox): scope OCI image e2e to Docker Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(sandbox): narrow OCI identity fallback scope Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(podman): cover OCI identity launch Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(podman): exercise OCI fallback in E2E Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
30 lines
792 B
Rust
30 lines
792 B
Rust
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
//! Process component of the `OpenShell` supervisor.
|
|
//!
|
|
//! Owns the entrypoint process spawn, SSH server, supervisor session, network
|
|
//! namespace, bypass monitor, child environment construction, skills install,
|
|
//! and log push. Populated by follow-up commits as modules migrate out of
|
|
//! `openshell-sandbox`.
|
|
|
|
pub mod child_env;
|
|
pub mod debug_rpc;
|
|
#[cfg(unix)]
|
|
pub mod identity;
|
|
pub mod log_push;
|
|
pub mod managed_children;
|
|
pub mod process;
|
|
pub mod run;
|
|
pub mod sandbox;
|
|
pub mod skills;
|
|
pub mod ssh;
|
|
pub mod supervisor_session;
|
|
|
|
mod unix_socket;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
pub mod bypass_monitor;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod netns;
|