Skip to content

feat(docker): isolate workloads behind the host supervisor - #2965

Open
drew wants to merge 2 commits into
codex/vm-host-supervisorfrom
codex/docker-host-supervisor
Open

feat(docker): isolate workloads behind the host supervisor#2965
drew wants to merge 2 commits into
codex/vm-host-supervisorfrom
codex/docker-host-supervisor

Conversation

@drew

@drew drew commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Adopt the RFC 0012 split in the Docker driver. The workload container runs openshell-sandbox with Docker networking disabled; the host supervisor owns policy and all mediated TCP and DNS access.

The driver provisions a private Unix socket. The protocol uses a fresh pinned TLS server identity and launch-scoped sandbox JWT over that socket, with new material on every start after stop.

Related Issue

Part of #1737.

Changes

  • Launch workload containers with network_mode=none.
  • Provision the private Unix socket separately from authentication material.
  • Give the workload only the TLS server key, certificate, and public JWT verification keys.
  • Keep supervisor tokens and the pinned sandbox CA in host-owned runtime state.
  • Rotate the session, token pair, TLS identity, and bootstrap state on restart.
  • Preserve host aliases through supervisor-side resolution.
  • Fail closed when the supervisor or protected channel is unavailable.

Testing

  • mise run pre-commit
  • Focused Docker unit and authentication tests
  • Full Docker E2E validation delegated to remote CI

Checklist

  • Follows Conventional Commits
  • Authored commits are signed off (DCO)

Stack

  1. feat(isolation): define the RFC 0012 boundary contract #2941 — Isolation Backend contract
  2. feat(isolation): add boundary protocol and Linux primitives #2942 — OpenShell Sandbox Protocol and Linux primitives
  3. feat(isolation): split supervisor and sandbox runtimes #3151 — supervisor and sandbox runtimes
  4. feat(vm): run the supervisor outside the guest workload #2945 — VM driver
  5. feat(docker): isolate workloads behind the host supervisor #2965 — Docker driver (this PR)
  6. feat(kubernetes): add proxy-pod isolation topology #3144 — Kubernetes proxy-pod driver
  7. feat(podman): isolate workloads behind the host supervisor #3230 — Podman driver
  8. perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses

@copy-pr-bot

copy-pr-bot Bot commented Aug 26, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@github-actions

github-actions Bot commented Aug 26, 2026

Copy link
Copy Markdown

🌿 Preview your docs: https://nvidia-preview-pr-2965.docs.buildwithfern.com/openshell

@drew drew mentioned this pull request Aug 26, 2026
Open
5 tasks
@drew
drew force-pushed the codex/docker-host-supervisor branch from 3f387e4 to 9f08093 Compare September 1, 2026 00:13
@copy-pr-bot

copy-pr-bot Bot commented Sep 1, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@drew drew changed the title feat(docker): prototype supervisor-owned isolation boundaries feat(docker): prototype attach-driven isolation boundaries Sep 1, 2026
This was referenced Sep 1, 2026
Open
Open
@drew
drew force-pushed the codex/docker-host-supervisor branch from 0236ea1 to 7f9fa25 Compare September 1, 2026 08:00
@drew
drew force-pushed the codex/docker-host-supervisor branch from 7f9fa25 to e3b8a72 Compare September 1, 2026 08:06
@drew drew mentioned this pull request Sep 2, 2026
Open
5 tasks
@drew
drew force-pushed the codex/docker-host-supervisor branch from 2026bdc to f3fd9d9 Compare September 3, 2026 01:45
@drew drew mentioned this pull request Sep 3, 2026
Open
5 tasks
@drew
drew marked this pull request as ready for review September 3, 2026 01:46
@drew
drew requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners September 3, 2026 01:46
@drew drew changed the title feat(docker): prototype attach-driven isolation boundaries feat(docker): adopt shared supervisor boundary mode Sep 3, 2026
@drew
drew force-pushed the codex/docker-host-supervisor branch from d992755 to f6bc10a Compare September 3, 2026 14:34
@drew
drew force-pushed the codex/docker-host-supervisor branch from f6bc10a to c63a604 Compare September 3, 2026 14:47
@drew drew added the test:e2e Requires end-to-end coverage label Sep 3, 2026
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

Label test:e2e applied for c63a604. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

@drew
drew force-pushed the codex/docker-host-supervisor branch from c63a604 to c3a22d3 Compare September 5, 2026 16:08
@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

9 similar comments
@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew
drew force-pushed the codex/docker-host-supervisor branch from ae3939c to a62c4b7 Compare September 8, 2026 22:32
@drew drew changed the title feat(docker): adopt shared supervisor boundary mode feat(docker): isolate workloads behind the host supervisor Sep 8, 2026
@drew drew mentioned this pull request Sep 8, 2026
Open
5 tasks
@drew
drew force-pushed the codex/docker-host-supervisor branch from a62c4b7 to c59f844 Compare September 8, 2026 22:40
@drew
drew force-pushed the codex/docker-host-supervisor branch from c59f844 to 744d9e9 Compare September 9, 2026 04:39
@drew drew mentioned this pull request Sep 9, 2026
Open
5 tasks
@drew
drew removed this pull request from stack #3152 September 9, 2026 04:42
@drew
drew added this pull request to stack #3231 September 9, 2026 04:42
@drew
drew force-pushed the codex/docker-host-supervisor branch from 744d9e9 to 3fe2973 Compare September 9, 2026 04:53
@drew
drew force-pushed the codex/docker-host-supervisor branch from 3fe2973 to b5fd2f2 Compare September 9, 2026 05:03
@drew
drew force-pushed the codex/docker-host-supervisor branch 3 times, most recently from 480c8a0 to c8e388e Compare September 9, 2026 05:38
drew added 2 commits September 10, 2026 18:40
@drew
feat(docker): isolate workloads behind the host supervisor
6c473f2 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
feat(docker): rotate launch-scoped authentication
125f36c 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@drew