diff --git a/crates/openshell-driver-docker/src/tests.rs b/crates/openshell-driver-docker/src/tests.rs index 07fb2b0ffb..66211aa4dc 100644 --- a/crates/openshell-driver-docker/src/tests.rs +++ b/crates/openshell-driver-docker/src/tests.rs @@ -37,7 +37,7 @@ fn test_sandbox() -> DriverSandbox { log_level: "debug".to_string(), environment: HashMap::from([("SPEC_ENV".to_string(), "spec".to_string())]), template: Some(DriverSandboxTemplate { - image: "ghcr.io/nvidia/openshell/sandbox:dev".to_string(), + image: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), agent_socket_path: String::new(), labels: HashMap::new(), environment: HashMap::from([("TEMPLATE_ENV".to_string(), "template".to_string())]), diff --git a/crates/openshell-ocsf/tests/roundtrip.rs b/crates/openshell-ocsf/tests/roundtrip.rs index 1c8a8bb307..e7d37c9036 100644 --- a/crates/openshell-ocsf/tests/roundtrip.rs +++ b/crates/openshell-ocsf/tests/roundtrip.rs @@ -22,7 +22,7 @@ fn ctx() -> SandboxContext { SandboxContext { sandbox_id: "sb-7f3a9c2e14b8".to_string(), sandbox_name: "agent-workspace-01".to_string(), - container_image: "ghcr.io/nvidia/openshell/sandbox:0.42.1".to_string(), + container_image: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), hostname: "openshell-sb-7f3a9c2e14b8".to_string(), product_version: "0.42.1".to_string(), proxy_ip: IpAddr::V4(Ipv4Addr::LOCALHOST), diff --git a/crates/openshell-server/src/compute/mod.rs b/crates/openshell-server/src/compute/mod.rs index 053b08de9c..d894dde778 100644 --- a/crates/openshell-server/src/compute/mod.rs +++ b/crates/openshell-server/src/compute/mod.rs @@ -10514,7 +10514,7 @@ mod tests { ..Default::default() }), template: Some(SandboxTemplate { - image: "ghcr.io/nvidia/openshell/sandbox:test".to_string(), + image: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), driver_config: Some(prost_types::Struct { fields: [ ( diff --git a/crates/openshell-server/src/config_file.rs b/crates/openshell-server/src/config_file.rs index 65709748b1..64ac953624 100644 --- a/crates/openshell-server/src/config_file.rs +++ b/crates/openshell-server/src/config_file.rs @@ -522,7 +522,7 @@ sandbox_namespace = "agents" grpc_rate_limit_requests = 120 grpc_rate_limit_window_seconds = 60 policy_validation_failure_mode = "retain_last_valid" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest" client_tls_secret_name = "openshell-sandbox-tls" service_account_name = "openshell-sandbox" @@ -549,7 +549,7 @@ namespace = "agents" assert_eq!(gw.log_level.as_deref(), Some("info")); assert_eq!( gw.default_image.as_deref(), - Some("ghcr.io/nvidia/openshell/sandbox:latest") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!(gw.grpc_rate_limit_requests, Some(120)); assert_eq!(gw.grpc_rate_limit_window_seconds, Some(60)); @@ -943,7 +943,9 @@ version = 2 #[test] fn driver_table_inherits_gateway_defaults() { let gateway = GatewayFileSection { - default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()), + default_image: Some( + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), + ), supervisor_image: Some("ghcr.io/nvidia/openshell/supervisor:0.9".to_string()), ..Default::default() }; @@ -963,7 +965,7 @@ version = 2 ); assert_eq!( table.get("default_image").and_then(|v| v.as_str()), - Some("ghcr.io/nvidia/openshell/sandbox:0.9") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!( table.get("supervisor_image").and_then(|v| v.as_str()), @@ -975,7 +977,9 @@ version = 2 fn registered_driver_table_inherits_selected_gateway_defaults() { let gateway = GatewayFileSection { sandbox_namespace: Some("agents".to_string()), - default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()), + default_image: Some( + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), + ), host_gateway_ip: Some("10.0.0.1".to_string()), ..Default::default() }; @@ -992,7 +996,7 @@ version = 2 ); assert_eq!( table.get("default_image").and_then(|v| v.as_str()), - Some("ghcr.io/nvidia/openshell/sandbox:0.9") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!( table.get("host_gateway_ip").and_then(|v| v.as_str()), @@ -1003,7 +1007,9 @@ version = 2 #[test] fn registered_driver_table_can_select_network_defaults() { let gateway = GatewayFileSection { - default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()), + default_image: Some( + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), + ), host_gateway_ip: Some("192.168.127.254".to_string()), ..Default::default() }; @@ -1016,7 +1022,7 @@ version = 2 let table = merged.as_table().expect("table"); assert_eq!( table.get("default_image").and_then(|v| v.as_str()), - Some("ghcr.io/nvidia/openshell/sandbox:0.9") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!( table.get("host_gateway_ip").and_then(|v| v.as_str()), diff --git a/docs/reference/gateway-config.mdx b/docs/reference/gateway-config.mdx index c04c0040d0..2176f28c10 100644 --- a/docs/reference/gateway-config.mdx +++ b/docs/reference/gateway-config.mdx @@ -105,7 +105,7 @@ disable_tls = false # Shared driver defaults. These inherit into [openshell.drivers.] tables # when the driver-specific table does not override them. -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" # Defaults to the gateway version; override to pin a specific build. # supervisor_image = "ghcr.io/nvidia/openshell/supervisor:" client_tls_secret_name = "openshell-client-tls" @@ -481,7 +481,7 @@ workspace_mode = "shared" # gateway_id = "openshell" namespace = "agents" service_account_name = "openshell-sandbox" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "IfNotPresent" image_pull_secrets = ["regcred"] # Defaults to the gateway version; override to pin a specific build. @@ -604,7 +604,7 @@ compute_drivers = ["docker"] [openshell.drivers.docker] socket_path = "/var/run/docker.sock" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" # Docker vocabulary: Always | IfNotPresent | Never. Empty behaves like IfNotPresent. image_pull_policy = "IfNotPresent" sandbox_namespace = "docker-dev" @@ -648,7 +648,7 @@ compute_drivers = ["podman"] # asks the podman CLI where its socket is, and fails to start if neither finds # one. Set this to pin a specific Podman machine instead. socket_path = "/run/user/1000/podman/podman.sock" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "missing" # always | missing | never | newer grpc_endpoint = "https://host.containers.internal:17670" # The gateway overwrites gateway_port from bind_address at runtime. @@ -781,10 +781,10 @@ compute_drivers = ["vm"] state_dir = "/var/lib/openshell/vm" # Where the gateway looks for the openshell-driver-vm subprocess binary. driver_dir = "/usr/local/libexec/openshell" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" grpc_endpoint = "https://host.containers.internal:17670" # Empty falls back to default_image. -bootstrap_image = "ghcr.io/nvidia/openshell/sandbox:latest" +bootstrap_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" krun_log_level = 1 vcpus = 2 mem_mib = 2048 diff --git a/examples/spiffe-token-exchange-demo/podman/README.md b/examples/spiffe-token-exchange-demo/podman/README.md index d8fdde4b4b..b30c4830dd 100644 --- a/examples/spiffe-token-exchange-demo/podman/README.md +++ b/examples/spiffe-token-exchange-demo/podman/README.md @@ -109,7 +109,7 @@ TOKEN_ISSUER_PORT=18080 MANAGED_GATEWAY_PORT=18082 MANAGED_GATEWAY_HEALTH_PORT=18083 GATEWAY_IMAGE=ghcr.io/nvidia/openshell/gateway:latest -SANDBOX_IMAGE=ghcr.io/nvidia/openshell/sandbox:latest +SANDBOX_IMAGE=ghcr.io/nvidia/openshell-community/sandboxes/base:latest SUPERVISOR_IMAGE=ghcr.io/nvidia/openshell/supervisor:latest SANDBOX_IMAGE_PULL_POLICY=missing PODMAN_STOP_TIMEOUT_SECS=3 diff --git a/rfc/0003-gateway-configuration/README.md b/rfc/0003-gateway-configuration/README.md index 2b7c095065..d6d4750f25 100644 --- a/rfc/0003-gateway-configuration/README.md +++ b/rfc/0003-gateway-configuration/README.md @@ -118,7 +118,7 @@ scopes_claim = "" # empty disables scope enforcement [openshell.drivers.kubernetes] namespace = "openshell" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "IfNotPresent" supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest" supervisor_image_pull_policy = "IfNotPresent" @@ -128,7 +128,7 @@ host_gateway_ip = "10.0.0.1" ssh_socket_path = "/run/openshell/ssh.sock" [openshell.drivers.docker] -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "IfNotPresent" sandbox_namespace = "docker-dev" grpc_endpoint = "https://host.openshell.internal:8080" @@ -141,7 +141,7 @@ guest_tls_key = "/etc/openshell/certs/client-key.pem" [openshell.drivers.podman] socket_path = "/run/podman/podman.sock" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "missing" # Podman vocabulary: always | missing | never | newer supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest" network_name = "openshell" @@ -229,7 +229,7 @@ compute_drivers = ["kubernetes"] [openshell.drivers.kubernetes] namespace = "agents" -default_image = "ghcr.io/nvidia/openshell/sandbox:0.9.0" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" supervisor_image = "ghcr.io/nvidia/openshell/supervisor:0.9.0" grpc_endpoint = "https://openshell-gateway.agents.svc:8080" ``` @@ -254,7 +254,7 @@ gateway: drivers: kubernetes: namespace: agents - default_image: ghcr.io/nvidia/openshell/sandbox:0.9.0 + default_image: ghcr.io/nvidia/openshell-community/sandboxes/base:latest supervisor_image: ghcr.io/nvidia/openshell/supervisor:0.9.0 ```