mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-09 09:15:23 +08:00
Drew Newberry
89a6e04c8c
## Summary - Add `GetSandboxProviderEnvironment` gRPC endpoint so the sandbox supervisor can fetch provider credentials at runtime instead of embedding them in the pod spec - Sandbox supervisor (`navigator-sandbox`) fetches credentials on startup and injects them as environment variables into both entrypoint processes and SSH shell sessions via `Command::env()` - Remove credential injection from sandbox creation-time pod spec in `navigator-server` - Update `architecture/providers.md` to document the full runtime credential injection flow, discovery engine details, trait definitions, and end-to-end diagram ## Changes - **proto**: Add `GetSandboxProviderEnvironment` RPC and request/response messages, add `providers` field to `SandboxSpec` - **navigator-server**: Implement `GetSandboxProviderEnvironment` handler and `resolve_provider_environment()` with env var key validation and first-wins dedup; remove old creation-time credential injection from `sandbox/mod.rs` - **navigator-sandbox**: Fetch provider env via gRPC on startup (`grpc_client.rs`), thread `provider_env` HashMap through to `process.rs` (entrypoint) and `ssh.rs` (shell sessions), inject via `cmd.env()` - **navigator-cli**: Adjust sandbox create flow to set provider names in `SandboxSpec.providers` - **e2e**: Add `test_sandbox_providers.py` end-to-end tests - **docs**: Rewrite `architecture/providers.md` with implementation details ## Test Plan - Unit tests for `resolve_provider_environment` in `grpc.rs` - Integration tests updated in `provider_commands_integration.rs`, `mtls_integration.rs`, `multiplex_integration.rs`, `multiplex_tls_integration.rs` - New e2e test suite `test_sandbox_providers.py`
54 lines
1.9 KiB
Bash
Executable File
54 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generic Docker image builder for Navigator components.
|
|
# Usage: docker-build-component.sh <component> [extra docker build args...]
|
|
#
|
|
# Environment:
|
|
# IMAGE_TAG - Image tag (default: dev)
|
|
# DOCKER_PLATFORM - Target platform (optional, e.g. linux/amd64)
|
|
# DOCKER_BUILDER - Buildx builder name (default: auto-select)
|
|
set -euo pipefail
|
|
|
|
COMPONENT=${1:?"Usage: docker-build-component.sh <component> [extra-args...]"}
|
|
shift
|
|
|
|
IMAGE_TAG=${IMAGE_TAG:-dev}
|
|
DOCKER_BUILD_CACHE_DIR=${DOCKER_BUILD_CACHE_DIR:-.cache/buildkit}
|
|
CACHE_PATH="${DOCKER_BUILD_CACHE_DIR}/${COMPONENT}"
|
|
|
|
mkdir -p "${CACHE_PATH}"
|
|
|
|
# Select the builder. For local (single-arch) builds use a builder with the
|
|
# native "docker" driver so images land directly in the Docker image store —
|
|
# no slow tarball export via the docker-container driver.
|
|
# Multi-platform builds (DOCKER_PLATFORM set) keep the current builder which
|
|
# is typically docker-container.
|
|
BUILDER_ARGS=()
|
|
if [[ -n "${DOCKER_BUILDER:-}" ]]; then
|
|
BUILDER_ARGS=(--builder "${DOCKER_BUILDER}")
|
|
elif [[ -z "${DOCKER_PLATFORM:-}" && -z "${CI:-}" ]]; then
|
|
# Pick the builder matching the active docker context (uses docker driver).
|
|
_ctx=$(docker context inspect --format '{{.Name}}' 2>/dev/null || echo default)
|
|
BUILDER_ARGS=(--builder "${_ctx}")
|
|
fi
|
|
|
|
CACHE_ARGS=()
|
|
if [[ -n "${CI:-}" ]]; then
|
|
echo "CI environment detected; skipping local build cache export options."
|
|
elif docker buildx inspect "${BUILDER_ARGS[@]}" 2>/dev/null | grep -q "Driver: docker-container"; then
|
|
CACHE_ARGS=(
|
|
--cache-from "type=local,src=${CACHE_PATH}"
|
|
--cache-to "type=local,dest=${CACHE_PATH},mode=max"
|
|
)
|
|
fi
|
|
|
|
docker buildx build \
|
|
"${BUILDER_ARGS[@]}" \
|
|
${DOCKER_PLATFORM:+--platform ${DOCKER_PLATFORM}} \
|
|
"${CACHE_ARGS[@]}" \
|
|
-f "deploy/docker/Dockerfile.${COMPONENT}" \
|
|
-t "navigator-${COMPONENT}:${IMAGE_TAG}" \
|
|
--provenance=false \
|
|
"$@" \
|
|
--load \
|
|
.
|