From d957084c8c989eef0918bb44cd76ab5914b74ceb Mon Sep 17 00:00:00 2001 From: Yuedong Wu Date: Wed, 19 Aug 2026 07:32:41 +0800 Subject: [PATCH] docs(gateway-config): fix stale community sandbox image path Signed-off-by: Yuedong Wu --- crates/openshell-server/src/cli.rs | 7 +++++-- crates/openshell-server/src/config_file.rs | 22 ++++++++++++++-------- docs/reference/gateway-config.mdx | 12 ++++++------ rfc/0003-gateway-configuration/README.md | 10 +++++----- 4 files changed, 30 insertions(+), 21 deletions(-) diff --git a/crates/openshell-server/src/cli.rs b/crates/openshell-server/src/cli.rs index 2e86c3a1b5..3f6caafe6d 100644 --- a/crates/openshell-server/src/cli.rs +++ b/crates/openshell-server/src/cli.rs @@ -1845,7 +1845,7 @@ mem_mib = "not-a-number" let file = config_file_from_toml( r#" [openshell.gateway] -default_image = "ghcr.io/nvidia/openshell/sandbox:1.0" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" [openshell.drivers.kubernetes] namespace = "agents" @@ -1859,7 +1859,10 @@ namespace = "agents" let parsed = merged .try_into::() .expect("merged table deserializes"); - assert_eq!(parsed.default_image, "ghcr.io/nvidia/openshell/sandbox:1.0"); + assert_eq!( + parsed.default_image, + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" + ); assert_eq!(parsed.namespace, "agents"); } diff --git a/crates/openshell-server/src/config_file.rs b/crates/openshell-server/src/config_file.rs index 00b7a2f64d..dc79dd9a9a 100644 --- a/crates/openshell-server/src/config_file.rs +++ b/crates/openshell-server/src/config_file.rs @@ -551,7 +551,7 @@ sandbox_namespace = "agents" grpc_rate_limit_requests = 120 grpc_rate_limit_window_seconds = 60 policy_validation_failure_mode = "retain_last_valid" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest" client_tls_secret_name = "openshell-sandbox-tls" service_account_name = "openshell-sandbox" @@ -578,7 +578,7 @@ namespace = "agents" assert_eq!(gw.log_level.as_deref(), Some("info")); assert_eq!( gw.default_image.as_deref(), - Some("ghcr.io/nvidia/openshell/sandbox:latest") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!(gw.grpc_rate_limit_requests, Some(120)); assert_eq!(gw.grpc_rate_limit_window_seconds, Some(60)); @@ -971,7 +971,9 @@ version = 2 #[test] fn driver_table_inherits_gateway_defaults() { let gateway = GatewayFileSection { - default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()), + default_image: Some( + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), + ), supervisor_image: Some("ghcr.io/nvidia/openshell/supervisor:0.9".to_string()), ..Default::default() }; @@ -990,7 +992,7 @@ version = 2 ); assert_eq!( table.get("default_image").and_then(|v| v.as_str()), - Some("ghcr.io/nvidia/openshell/sandbox:0.9") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!( table.get("supervisor_image").and_then(|v| v.as_str()), @@ -1002,7 +1004,9 @@ version = 2 fn docker_driver_table_inherits_gateway_defaults() { let gateway = GatewayFileSection { sandbox_namespace: Some("agents".to_string()), - default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()), + default_image: Some( + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), + ), host_gateway_ip: Some("10.0.0.1".to_string()), ..Default::default() }; @@ -1014,7 +1018,7 @@ version = 2 ); assert_eq!( table.get("default_image").and_then(|v| v.as_str()), - Some("ghcr.io/nvidia/openshell/sandbox:0.9") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!( table.get("host_gateway_ip").and_then(|v| v.as_str()), @@ -1025,7 +1029,9 @@ version = 2 #[test] fn podman_driver_table_inherits_gateway_host_gateway_ip() { let gateway = GatewayFileSection { - default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()), + default_image: Some( + "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(), + ), host_gateway_ip: Some("192.168.127.254".to_string()), ..Default::default() }; @@ -1033,7 +1039,7 @@ version = 2 let table = merged.as_table().expect("table"); assert_eq!( table.get("default_image").and_then(|v| v.as_str()), - Some("ghcr.io/nvidia/openshell/sandbox:0.9") + Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest") ); assert_eq!( table.get("host_gateway_ip").and_then(|v| v.as_str()), diff --git a/docs/reference/gateway-config.mdx b/docs/reference/gateway-config.mdx index 8d74b3d44f..767379df17 100644 --- a/docs/reference/gateway-config.mdx +++ b/docs/reference/gateway-config.mdx @@ -102,7 +102,7 @@ disable_tls = false # Shared driver defaults. These inherit into [openshell.drivers.] tables # when the driver-specific table does not override them. -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" # Defaults to the gateway version; override to pin a specific build. # supervisor_image = "ghcr.io/nvidia/openshell/supervisor:" client_tls_secret_name = "openshell-client-tls" @@ -453,7 +453,7 @@ workspace_mode = "shared" # gateway_id = "openshell" namespace = "agents" service_account_name = "openshell-sandbox" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "IfNotPresent" image_pull_secrets = ["regcred"] # Defaults to the gateway version; override to pin a specific build. @@ -566,7 +566,7 @@ compute_drivers = ["docker"] [openshell.drivers.docker] socket_path = "/var/run/docker.sock" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" # Docker vocabulary: Always | IfNotPresent | Never. Empty behaves like IfNotPresent. image_pull_policy = "IfNotPresent" sandbox_namespace = "docker-dev" @@ -609,7 +609,7 @@ compute_drivers = ["podman"] # Omit to auto-detect: the driver probes for a responsive Podman socket and # fails to start if none respond. socket_path = "/run/user/1000/podman/podman.sock" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "missing" # always | missing | never | newer grpc_endpoint = "https://host.containers.internal:17670" # The gateway overwrites gateway_port from bind_address at runtime. @@ -724,10 +724,10 @@ compute_drivers = ["vm"] state_dir = "/var/lib/openshell/vm" # Where the gateway looks for the openshell-driver-vm subprocess binary. driver_dir = "/usr/local/libexec/openshell" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" grpc_endpoint = "https://host.containers.internal:17670" # Empty falls back to default_image. -bootstrap_image = "ghcr.io/nvidia/openshell/sandbox:latest" +bootstrap_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" krun_log_level = 1 vcpus = 2 mem_mib = 2048 diff --git a/rfc/0003-gateway-configuration/README.md b/rfc/0003-gateway-configuration/README.md index 2b7c095065..d6d4750f25 100644 --- a/rfc/0003-gateway-configuration/README.md +++ b/rfc/0003-gateway-configuration/README.md @@ -118,7 +118,7 @@ scopes_claim = "" # empty disables scope enforcement [openshell.drivers.kubernetes] namespace = "openshell" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "IfNotPresent" supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest" supervisor_image_pull_policy = "IfNotPresent" @@ -128,7 +128,7 @@ host_gateway_ip = "10.0.0.1" ssh_socket_path = "/run/openshell/ssh.sock" [openshell.drivers.docker] -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "IfNotPresent" sandbox_namespace = "docker-dev" grpc_endpoint = "https://host.openshell.internal:8080" @@ -141,7 +141,7 @@ guest_tls_key = "/etc/openshell/certs/client-key.pem" [openshell.drivers.podman] socket_path = "/run/podman/podman.sock" -default_image = "ghcr.io/nvidia/openshell/sandbox:latest" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" image_pull_policy = "missing" # Podman vocabulary: always | missing | never | newer supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest" network_name = "openshell" @@ -229,7 +229,7 @@ compute_drivers = ["kubernetes"] [openshell.drivers.kubernetes] namespace = "agents" -default_image = "ghcr.io/nvidia/openshell/sandbox:0.9.0" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" supervisor_image = "ghcr.io/nvidia/openshell/supervisor:0.9.0" grpc_endpoint = "https://openshell-gateway.agents.svc:8080" ``` @@ -254,7 +254,7 @@ gateway: drivers: kubernetes: namespace: agents - default_image: ghcr.io/nvidia/openshell/sandbox:0.9.0 + default_image: ghcr.io/nvidia/openshell-community/sandboxes/base:latest supervisor_image: ghcr.io/nvidia/openshell/supervisor:0.9.0 ```