feat(vm): run the supervisor outside the guest workload - #2945
Conversation
|
🌿 Preview your docs: https://nvidia-preview-pr-2945.docs.buildwithfern.com/openshell |
4a8f295 to
532fa1b
Compare
532fa1b to
02e80eb
Compare
drew
changed the title
7e10ae3 to
02e80eb
Compare
drew
changed the title
02e80eb to
be91699
Compare
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
be91699 to
273655b
Compare
273655b to
f7c163d
Compare
0c5cd41 to
9291888
Compare
drew
changed the title
fd784d6 to
36d8ef7
Compare
a43076b to
8355238
Compare
17c81c7 to
45afac4
Compare
45afac4 to
4363b64
Compare
821b780 to
8c62fcf
Compare
dc7fa5d to
36ecb98
Compare
36ecb98 to
56fc0b3
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
56fc0b3 to
d88b884
Compare
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
The VM slice is project-valid as the second implementation layer of accepted RFC 0012, reviewed incrementally against current stack base #2942. Two launch-contract regressions must be fixed before the VM runtime can reliably create and restart supported sandboxes.
Action required: @drew, please update the VM launch path to use fresh restart credentials and the already-resolved image/overlay identity, with the requested regression coverage.
Blocking findings:
GATOR-d88b8843-01: VM restart discards fresh launch authentication and reuses the deactivated create-time bundle.GATOR-d88b8843-02: boundary and supervisor use fallback identity instead of the image/overlay identity used by guest init.
Carried findings:
- None
Non-blocking suggestions:
- None
Gator metadata
- Validation: Implements the VM driver slice of accepted RFC 0012 / #1737, stacked directly on #2942.
- Docs: Architecture and Fern reference docs are updated for the VM topology and configuration changes.
- Checks: Current-head Branch Checks and E2E have completed with failures; pipeline handoff is deferred until review blockers are resolved.
- E2E:
test:e2eis present; current-head Branch E2E ran and failed before VM E2E execution. - Head SHA:
d88b88430c289691f373487e91c9129fa902b98d - Base SHA:
07441545bab1241ba359eda5154236fbf775adfb - Merge base SHA:
07441545bab1241ba359eda5154236fbf775adfb - Patch ID:
dfbb972145c87ceeb43a8e5e538f71cc75f3b860 - Gator payload:
8 - Review mode:
initial - Previous reviewed SHA: none
- Review budget exhausted: no
- Maintainer decision required: no
- Next state:
gator:in-review
| @@ -1068,6 +1234,29 @@ impl VmDriver { | |||
| let image_disk = image_plan.image_disk; | |||
| let owner_source_disk = image_disk.as_ref().unwrap_or(&root_disk).clone(); | |||
| let overlay_disk = disk_paths.overlay_disk; | |||
| let boundary_generation = random_boundary_token(); | |||
| let launch_authentication = sandbox | |||
There was a problem hiding this comment.
gator-agent
Warning — GATOR-d88b8843-01 · Restart reuses deactivated launch credentials
Summary: When an operator stops and restarts a VM sandbox, the gateway supplies a fresh launch bundle, but this path reloads the create-time bundle from sandbox.pb. The gateway has already deactivated that old session, so the new host supervisor registers with stale credentials and the sandbox cannot return to Ready.
Fix: Thread StartSandboxRequest.launch_authentication through the VM start path, validate it, replace the persisted spec value atomically before provisioning, and cover propagation to both boundary config and supervisor auth.
Verify: Create with session A, stop, then start with distinct session B. Assert the boundary and supervisor both receive B and the sandbox registers successfully.
Agent context
- Location:
crates/openshell-driver-vm/src/driver.rs:1238 - Ownership: This PR makes launch authentication authoritative for the new VM host-supervisor boundary but leaves restart disconnected from its fresh request field.
| }) | ||
| }) | ||
| .collect::<Result<Vec<_>, _>>()?; | ||
| let sandbox_user_id = self.config.resolve_sandbox_uid(); |
There was a problem hiding this comment.
gator-agent
Warning — GATOR-d88b8843-02 · Boundary identity diverges from guest identity
Summary: For a supported image whose sandbox account is not 1000:1000, guest init uses the identity resolved from that image or its persisted overlay, while the new boundary and host supervisor independently fall back to 1000:1000. The boundary's exact identity check then fails and the sandbox never becomes Ready.
Fix: Pass the already-resolved sandbox_owner_state.uid and .gid into VmBoundarySpec and spawn_host_supervisor; remove the independent fallback lookup and cover image-owned and legacy-overlay identities.
Verify: Launch an image with sandbox:x:10001:10001 and no explicit UID/GID override. Assert guest init, boundary topology/config, and supervisor environment all use 10001:10001, then confirm startup succeeds.
Agent context
- Location:
crates/openshell-driver-vm/src/driver.rs:1437 - Sibling site:
crates/openshell-driver-vm/src/driver.rs:851supplies the same fallback identity to the host supervisor. - Ownership: This PR adds both new identity consumers beside the existing resolved owner-state path.
johntmyers
added
the
gator:in-review
3 participants
Summary
Adopt the RFC 0012 split in the VM driver.
openshell-supervisorruns on the host, whileopenshell-sandboxruns as guest init and owns the agent process tree.The private guest channel uses the same pinned TLS server identity and launch-scoped sandbox JWT as every other driver, carried over vsock or the hypervisor Unix-socket mapping.
Related Issue
Part of #1737.
Changes
Testing
mise run pre-commitChecklist
Stack