refactor(sandbox): sandboxes are managed as separate community images - #267
Merged
Conversation
…deload Move the sandbox image (Dockerfiles, default policy, skills) to the community repository and deliver the navigator-sandbox supervisor binary via a read-only hostPath volume from the k3s node filesystem instead of an emptyDir + init container pattern. Key changes: - Add supervisor-builder stage to Dockerfile.cluster that cross-compiles navigator-sandbox and places it at /opt/openshell/bin/ - Replace emptyDir + copy-supervisor init container with hostPath volume mount, applied unconditionally to all sandbox pods - Remove standalone sandbox Dockerfile, NVIDIA variant, default policy, and bundled skills (moved to NVIDIA/OpenShell-Community) - Update default sandboxImage to ghcr.io/nvidia/openshell-community/sandboxes/base:latest - Update deploy scripts to drop sandbox build/push/tag logic and add docker cp workflow for fast supervisor binary updates - Remove init container filtering from CLI provisioning display - Update architecture docs and agent skills for new delivery model
drew
force-pushed
the
refactor/supervisor-hostpath-sideload/dn
branch
from
March 13, 2026 00:59
7bee94c to
6f4424a
Compare
|
- Remove redundant mkdir for /opt/openshell/bin in Dockerfile.cluster - Remove dead RUST_TARGET variable in cluster-deploy-fast.sh - Remove unnecessary bare block in run.rs Pulling handler - Use DirectoryOrCreate for hostPath volume type for upgrade resilience
drew
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NVIDIA/OpenShell-Community). Sandbox images are now pulled fromghcr.io/nvidia/openshell-community/sandboxes/at runtime.navigator-sandboxsupervisor binary is now built into the k3s cluster image (Dockerfile.clustergains asupervisor-builderstage) and exposed to sandbox pods via a read-onlyhostPathmount at/opt/openshell/bin. This is applied unconditionally to all pods — no moreneeds_supervisor_bootstrap()conditional.docker cpto update the supervisor binary on the running k3s container; new sandbox pods pick it up immediately via the hostPath mount.Changes
Dockerfile.clustersupervisor-builderstage cross-compilesnavigator-sandbox; binary placed at/opt/openshell/bin/navigator-sandboxsandbox/mod.rsemptyDir+ init container replaced withhostPathvolume;apply_supervisor_bootstraprenamed toapply_supervisor_sideload; always applied to all podsnavigator-cli/src/run.rsdocker cpworkflow for supervisor binary updates; newcluster:deploy:supervisormise tasksandboxImage→ghcr.io/nvidia/openshell-community/sandboxes/base:latestDockerfile.base,Dockerfile.nvidia,dev-sandbox-policy.yaml,skills/github/SKILL.md(moved to community repo)Test Plan
sandbox/mod.rs— verifies hostPath volume, read-only mount,runAsUser: 0, and absence of init containersmise run clusterwith default and custom sandbox images