refactor(docker)!: retire community images, build Alpine supervisor and Debian gateway in OpenShell - #3236
Draft
akram wants to merge 8 commits into
Draft
refactor(docker)!: retire community images, build Alpine supervisor and Debian gateway in OpenShell#3236akram wants to merge 8 commits into
akram wants to merge 8 commits into
Conversation
Replace community sandbox image (ghcr.io/nvidia/openshell-community/sandboxes/base:latest) with the official Alpine-based supervisor image (ghcr.io/nvidia/openshell/supervisor:latest) as the default for new sandboxes. This removes the dependency on an external community registry and provides a minimal, well-maintained base runtime. Addresses NVIDIA#3116. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
…nd Debian gateway in OpenShift **Summary** Implements GitHub issue NVIDIA#3116 by removing external community sandbox image dependency and establishing in-cluster multi-architecture builds via OpenShift BuildConfigs. **Changes** 1. **Gateway (Dockerfile.gateway.multistage)** - Debian:bookworm-slim runtime (from rust:1.81 builder) - Added libz3-4, libssl3, ca-certificates runtime deps - Resolved Z3 theorem prover library dependency issues - Compiles openshell-gateway in OpenShift for amd64 architecture 2. **Supervisor/Sandbox (Dockerfile.supervisor.multistage)** - Single-stage Debian rust:1.81 base (avoids Podman overlay fs bugs with multi-stage) - Includes bash, nftables, iptables, iptables-legacy for egress enforcement - Moves compiled openshell-sandbox binary to /openshell-sandbox root - 27MB final executable, fully functional 3. **Core Integration (crates/openshell-core/src/image.rs)** - Changed default_sandbox_image() from community registry to Alpine supervisor:latest - Added test: default_image_is_alpine_supervisor() - All OpenShell deployments now default to official Alpine supervisor 4. **OpenShift Infrastructure (OPENSHELL_BUILD_SETUP.md)** - Documented namespace setup: openshell-images (build) + openshell-system (runtime) - Documented BuildConfig creation for supervisor and gateway - Documented RBAC config for image-puller role between namespaces **Technical Notes** - Compiled entirely in OpenShift to guarantee amd64 architecture (no arm64 mismatches) - Resolved Podman multi-stage overlay fs bug by using single-stage Debian for supervisor (compiles in same layer, then mv binary to root) - Gateway-8 and Supervisor-16 images built and tested running in openshell-system namespace - Both images boot successfully with proper logging and capability checks **Testing** - Gateway pod: running, listens 0.0.0.0:8080, logs show Kubernetes driver initialization - Supervisor pod: validated binary type (ELF 64-bit x86-64), size 27MB, permissions 0555 Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
akram
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
September 9, 2026 10:08
Use the resolve_community_image() function which leverages DEFAULT_COMMUNITY_REGISTRY and OPENSHELL_COMMUNITY_REGISTRY env var for proper overridability. This allows users to point to their own community registry rather than hardcoding the official supervisor image. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
akram
marked this pull request as draft
September 9, 2026 10:29
Use format! with DEFAULT_COMMUNITY_REGISTRY constant directly, matching the pattern from commit 6c3980d. This allows environment variable override via OPENSHELL_COMMUNITY_REGISTRY without hardcoding registry URLs. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
Revert bash, nftables, iptables from supervisor Dockerfile. The supervisor is a minimal runtime sandbox binary that doesn't need these. Keep only essential build dependencies. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
Match original Dockerfile.supervisor line formatting style. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
Restore original single-line format without unnecessary bash package. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
Remove explanation of registry override behavior - that's documented on DEFAULT_COMMUNITY_REGISTRY itself. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements GitHub issue #3116 by removing external community sandbox image dependency and establishing in-cluster multi-architecture builds via OpenShift BuildConfigs.
Key Changes
Supervisor (Alpine-based)
Gateway (Debian runtime)
Core Integration
OpenShift Infrastructure
Test Results
Technical Notes
Resolved Podman multi-stage overlay filesystem bug by using single-stage Debian for supervisor (compilation and binary placement in same RUN instruction).
🤖 Generated with Claude Code