mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-07 08:55:37 +08:00
Drew Newberry
e5adf6f484
* feat(supervisor): recover shared instances with hash-based HA Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(supervisor): keep HA coordination out of compute drivers Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): fence pool admission and reconciliation races Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(supervisor): keep pool mode stable across replica scaling Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(supervisor): default shared deployments to pool mode Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): fence refused launches and remove legacy mode Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): confirm live owners and fence stale observations Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): preserve takeover cause log formatting Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(helm): add memory-based supervisor autoscaling Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): retain acknowledgements and fence streamed input Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(supervisor): consolidate experimental multi-tenant guidance Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(supervisor): simplify multi-tenant supervisor guide Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(supervisor): simplify pool member identity Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(helm): make supervisor affinity configurable Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(helm): make supervisor disruption budget optional Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(supervisor): align HA fixtures with suspend support Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
82 lines
2.4 KiB
Rust
82 lines
2.4 KiB
Rust
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
//! Capability-free in-workload sandbox boundary.
|
|
|
|
pub mod binary_pins;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod boundary_exec;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod boundary_io;
|
|
mod boundary_server;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod child_env;
|
|
pub mod container_log;
|
|
#[cfg(target_os = "linux")]
|
|
pub(crate) mod delegated;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod linux;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod main_session;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod managed_children;
|
|
#[cfg(target_os = "linux")]
|
|
mod network_broker;
|
|
#[cfg(all(target_os = "linux", feature = "perf-harness"))]
|
|
pub mod perf;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod process;
|
|
#[cfg(target_os = "linux")]
|
|
mod provider_files;
|
|
#[cfg(target_os = "linux")]
|
|
mod pty;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod sandbox;
|
|
#[cfg(target_os = "linux")]
|
|
pub mod sftp;
|
|
|
|
/// Results of actively qualifying the admitted workload runtime before the
|
|
/// sandbox consumes protected bootstrap material.
|
|
#[cfg(target_os = "linux")]
|
|
#[derive(Clone, Copy, Debug)]
|
|
#[allow(
|
|
clippy::struct_excessive_bools,
|
|
reason = "qualification preserves independently exercised security results"
|
|
)]
|
|
pub struct RuntimeQualification {
|
|
pub seccomp: openshell_sandbox_backend::boundary_protocol::SeccompEvidence,
|
|
pub landlock_abi: u32,
|
|
pub landlock_allow_deny: bool,
|
|
pub udp_dns_round_trip: bool,
|
|
pub tcp_dns_round_trip: bool,
|
|
pub tcp_allow_round_trip: bool,
|
|
pub tcp_deny_round_trip: bool,
|
|
pub socket_loopback_confinement: bool,
|
|
}
|
|
|
|
/// Placeholder used when compiling the package on a non-Linux host.
|
|
///
|
|
/// The sandbox binary rejects execution on those hosts before constructing a
|
|
/// qualification, but retaining the type keeps the library API portable for
|
|
/// workspace-wide checks.
|
|
#[cfg(not(target_os = "linux"))]
|
|
#[derive(Clone, Copy, Debug)]
|
|
pub struct RuntimeQualification;
|
|
|
|
/// Run the authenticated boundary-local sandbox.
|
|
///
|
|
/// # Errors
|
|
///
|
|
/// Returns an error when the protected bootstrap is invalid or the boundary
|
|
/// listener cannot be established.
|
|
pub fn run(
|
|
config_path: &std::path::Path,
|
|
qualification: RuntimeQualification,
|
|
) -> miette::Result<()> {
|
|
boundary_server::run_boundary(config_path, qualification)
|
|
.map_err(|error| miette::miette!(error))
|
|
}
|
|
|
|
#[cfg(target_os = "linux")]
|
|
mod native_api;
|