mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-24 06:34:33 +08:00
Jordan Ganoff
da46abaeef
Refactor the supervisor so the Kubernetes sidecar topology is driven by a first-class RFC 0012 isolation backend instead of an inline conditional branch. The agent container's supervisor now resolves a `sidecar` backend from the driver-provided `TopologyDescriptor` and runs the standard `attach -> confirm -> start_agent` lifecycle, identically to the in-pod backend; the supervisor no longer branches on which backend it resolved. The agent container stays autonomous and spawns its own workload, so the backend wraps the existing agent/process path rather than inverting control. Network mediation continues to run in the separate network-sidecar container (framed as the RFC's network-mediation component), which hosts no local mediation ingress in the backend. Fail-closed hardening: - `attach` validates the descriptor payload at the trust boundary (empty for this topology), mirroring the in-pod backend. - `confirm` peeks the authoritative control link to the network container and refuses to advance if it is already closed, so the workload is never launched only to be torn down on the first `wait`. - The supervisor rejects a single process that enables both --mode=network and --mode=process under sidecar enforcement (never driver-produced) instead of silently holding open without spawning the workload. - `wait` races the workload against the control-closed signal and folds any wait error to a closed exit, dropping the workload handle to reap it. Add `SIDECAR_BACKEND_ID` and `TopologyDescriptor::sidecar()` to the contract crate, wire the driver to set the sidecar descriptor on the agent container, and update the sandbox architecture doc. Also fix pre-existing clippy lints in openshell-isolation surfaced by the workspace `-D warnings` gate. Signed-off-by: Jordan Ganoff <jordan.ganoff@docker.com>