NVIDIA · drew · Sep 16, 2026 · Aug 26, 2026 · Sep 1, 2026 · Sep 1, 2026
@@ -69,28 +69,15 @@ mise run helm:skaffold:dev
 mise run helm:skaffold:run
 ```
 
-**Supervisor sidecar topology** (build once and leave running):
-```bash
-mise run helm:skaffold:run:sidecar
-```
-
-**Supervisor sidecar topology with TLS/mTLS enabled** (build once and leave running):
-```bash
-mise run helm:skaffold:run:sidecar-mtls
-```
-
-Both commands build the `gateway` and `supervisor` images and deploy the OpenShell Helm
-chart. The sidecar profile renders an `openshell-network-init` init container for
-nftables setup and an `openshell-supervisor-network` runtime sidecar for proxying.
-Binary-aware policy mode runs that sidecar as UID 0 with `SYS_PTRACE` and
-`DAC_READ_SEARCH`; relaxed mode can run it as the configured proxy UID, which
-must be at least `1000` and distinct from the workload UID. The
-sidecar-mTLS profile reuses `ci/values-sidecar.yaml` and restores
-`server.disableTls=false` inline for Skaffold. The `pkiInitJob` hook (a pre-install
-Job that runs `openshell-gateway generate-certs`) generates mTLS secrets on first
-install. The default Skaffold values export gateway and Kubernetes-driver traces to
-the collector service installed by `helm:k3s:create`. Envoy Gateway opt-in; see the
-Optional Add-ons section below.
+The Skaffold flow builds distinct `gateway`, `sandbox`, and `supervisor` images
+and deploys the OpenShell Helm chart. The Kubernetes driver creates a
+capability-free workload Pod and a directly managed capability-free supervisor
+Pod. One namespace-wide NetworkPolicy denies direct egress from every OpenShell
+workload Pod. The
+`pkiInitJob` hook (a pre-install Job that runs `openshell-gateway generate-certs`)
+generates mTLS secrets on first install. The default Skaffold values export
+gateway and Kubernetes-driver traces to the collector service installed by
+`helm:k3s:create`. Envoy Gateway is opt-in; see the Optional Add-ons section.
 
 The gateway Service uses ClusterIP. Access is via Envoy Gateway (port `8080`) or
 the unified local forwarding task:
@@ -102,9 +89,9 @@ mise run helm:k3s:forward
 The task forwards OTLP/gRPC to `http://127.0.0.1:4317` and the trace UI to
 `http://127.0.0.1:18888`. When Skaffold has deployed a Kubernetes gateway, it
 also forwards the gateway to `http://127.0.0.1:8090`; otherwise it continues
-with the collector ports only. A successful plaintext `helm:skaffold:run` or
-`helm:skaffold:run:sidecar` registers the gateway under the worktree-specific
-k3d cluster name and selects it as the active gateway. Keep the forwarding
+with the collector ports only. A successful plaintext `helm:skaffold:run`
+registers the gateway under the worktree-specific k3d
+cluster name and selects it as the active gateway. Keep the forwarding
 task running while using those endpoints.
 
 ### Viewing local traces
@@ -134,8 +121,7 @@ create the Secret named `openshell-ha-pg` with a `uri` key, then run
 ### TLS behaviour
 
 `ci/values-skaffold.yaml` sets `server.disableTls: true`, so Skaffold-based deploys run
-plaintext by default. To test sidecar topology with TLS enabled, use
-`mise run helm:skaffold:run:sidecar-mtls`.
+plaintext by default. Override `server.disableTls=false` to exercise TLS/mTLS.
 
 | Mode | `server.disableTls` | Gateway scheme |
 |------|---------------------|----------------|
@@ -188,12 +174,6 @@ openshell sandbox list --gateway-endpoint https://localhost:8090
 mise run helm:skaffold:delete
 ```
 
-For a sidecar-profile deployment:
-
-```bash
-mise run helm:skaffold:delete:sidecar
-```
-
 ### Delete the cluster entirely
 
 ```bash
@@ -292,7 +272,7 @@ SPIFFE JWT-SVIDs for dynamic provider token grants:
 `openshell.local` and adds a `ClusterSPIFFEID` that maps sandbox pod
 annotations to `spiffe://openshell.local/openshell/sandbox/<sandbox-id>`.
 OpenShell mounts the SPIFFE CSI Workload API socket at
-`/spiffe-workload-api/spire-agent.sock` into sandbox pods for provider token
+`/spiffe-workload-api/spire-agent.sock` only into supervisor Pods for provider token
 grants. Supervisor-to-gateway authentication remains on the Kubernetes
 ServiceAccount bootstrap and gateway-minted sandbox JWT path; the selected
 Kubernetes compute driver validates the projected token before the gateway
@@ -372,7 +352,6 @@ for dependencies still declared in `Chart.yaml`.
 | `deploy/helm/openshell/ci/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
 | `deploy/helm/openshell/ci/values-high-availability.yaml` | HA test overlay (`replicaCount: 2` with external PostgreSQL Secret) |
 | `deploy/helm/openshell/ci/values-keycloak.yaml` | Keycloak OIDC overlay |
-| `deploy/helm/openshell/ci/values-sidecar.yaml` | Supervisor sidecar topology overlay for Kubernetes e2e/dev |
 | `deploy/helm/openshell/ci/values-spire.yaml` | SPIFFE/SPIRE provider token grant overlay |
 | `deploy/helm/openshell/ci/values-spire-stack.yaml` | SPIRE hardened chart values for local dev |
 | `deploy/helm/openshell/ci/values-tls-disabled.yaml` | Lint-only: TLS + auth disabled (reverse-proxy edge termination) |

@@ -15,7 +15,7 @@ The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft,
 
 SBOMs are **release artifacts only** -- they are generated on demand and not committed to the repository. Output lands in `deploy/sbom/output/` (gitignored).
 
-Pushed gateway and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
+Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
 
 ## Prerequisites
 

@@ -13,18 +13,20 @@ The Release Canary (`.github/workflows/release-canary.yml`) smoke-tests the arti
 
 | Job | Runner | Verifies |
 |---|---|---|
-| `macos` | `macos-latest-xlarge` | `install.sh` resolves the Homebrew formula, brew installs the cask, and `openshell status` reaches the brew-services–backed local gateway with the VM driver. |
-| `ubuntu` | `ubuntu-latest` | `install.sh` installs the Debian package, the post-install systemd user service starts, and `openshell status` reaches the local gateway with the Docker driver. |
-| `fedora` | `fedora:latest` container | `install.sh` installs the RPM packages, the local gateway starts under Podman, and `openshell status` succeeds. |
-| `ubuntu-snap` | `ubuntu-latest` | Downloads the Snap artifact from Release Dev, installs it with `--dangerous`, connects the required interfaces, and waits up to 30 seconds for the recovered local gateway. |
-| `kubernetes` | `ubuntu-latest` + kind | `helm install oci://ghcr.io/nvidia/openshell/helm-chart --version 0.0.0-dev` succeeds in a kind cluster, the gateway pod becomes Ready, port-forward exposes 8080, and the released CLI registers the in-cluster gateway and runs `openshell status` against it. |
+| `macos` | `macos-latest-xlarge` | Installs the dev Homebrew artifacts, reaches the VM gateway, and creates, executes in, and deletes a sandbox. |
+| `ubuntu` | `ubuntu-latest` | Installs the dev Debian package, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
+| `fedora` | `fedora:latest` container | Installs the dev RPM packages, reaches the Podman gateway, and creates, executes in, and deletes a sandbox. |
+| `ubuntu-snap` | `ubuntu-latest` | Installs the Release Dev Snap, connects its interfaces, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
+| `kubernetes` | `ubuntu-latest` + kind | Installs the dev Helm chart, reaches the in-cluster gateway, and creates, executes in, and deletes a sandbox using the published runtime images. |
 
 All canary jobs disable anonymous OpenShell telemetry. Host package jobs inject
 `OPENSHELL_TELEMETRY_ENABLED=false` through the service environment, and the
 Kubernetes job installs with `server.telemetryEnabled=false`, so smoke traffic
 does not contribute to product usage metrics.
 
-`install.sh` defaults to the *latest tagged* release — the canary is therefore checking that the most recent public release still installs, not the just-published `dev` build. The `kubernetes` job is the exception: it pins to `0.0.0-dev` chart + `:dev` images.
+The workflow sets `OPENSHELL_VERSION=dev`, so every `install.sh` job consumes the
+rolling dev release produced by the triggering workflow. Kubernetes pins the
+matching `0.0.0-dev` chart and `:dev` images.
 
 The host-package jobs exercise fresh installs, not upgrades from a persisted
 schema-v1 gateway config. Validate Homebrew and RPM exact-default migration with
@@ -83,7 +85,7 @@ gh run view <run-id> --log-failed
 
 ## Iterating on the canary itself
 
-When you change `release-canary.yml` on a branch, a manual dispatch on that branch tests *your branch's workflow logic* against *main's published artifacts* (`0.0.0-dev` chart, `:dev` images, latest tagged install.sh assets). This is what you want for iterating on the canary — you're validating that the canary still works against known-good artifacts.
+When you change `release-canary.yml` on a branch, a manual dispatch on that branch tests *your branch's workflow logic* against *main's published dev artifacts* (`0.0.0-dev` chart, `:dev` images, and the `dev` GitHub release). This is what you want for iterating on the canary — you're validating that the canary still works against known-good artifacts.
 
 Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${head_sha}/install.sh`, so changes to `install.sh` on your branch *are* exercised even though the binaries it downloads are from the latest public tag.
 
@@ -92,7 +94,7 @@ Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${h
 `Release Dev` publishes two chart versions for every dev build (see `.github/actions/release-helm-oci/action.yml:89-102`):
 
 - `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` — floating, overwritten on every main push.
-- `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls `ghcr.io/nvidia/openshell/gateway:<sha>` and `:supervisor:<sha>`.
+- `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls the matching `gateway`, `sandbox`, and `supervisor` images.
 
 To smoke-test the chart for a specific dev build, dispatch `Release Dev` on the branch first, then run the kind canary steps locally pointed at the SHA-pinned chart (see "Local kind reproduction" below). The release-canary workflow itself does not currently expose `chart_version` / `image_tag` inputs.
 
@@ -134,7 +136,8 @@ Loopback registration auto-derives the gateway name to `openshell` if `--name` i
 
 | Symptom | Likely cause | Where to look |
 |---|---|---|
-| `macos`/`ubuntu`/`fedora` job fails on `install.sh` | Latest tagged release missing an asset, checksum mismatch, or `install.sh` regression on this branch. | Job log around the `curl … install.sh \| sh` step. |
+| `macos`/`ubuntu`/`fedora` job fails on `install.sh` | Dev release missing an asset, checksum mismatch, or `install.sh` regression on this branch. | Job log around the `curl … install.sh \| sh` step. |
+| Sandbox create or exec fails | Published sandbox and supervisor artifacts are missing, incompatible, or cannot establish the protected runtime channel. | Gateway logs plus Docker, Podman, VM, Snap, or Kubernetes runtime diagnostics for the job. |
 | `macos`/`ubuntu`/`fedora` job fails on `openshell status` | Local gateway service did not start (systemd/brew/podman). Often a driver issue. | Service logs in the job log; `OPENSHELL_COMPUTE_DRIVER` env in the "Ensure …" step. |
 | `ubuntu-snap` fails after interface connection | The gateway did not recover after Docker became available, or did not become reachable within the 30-second bound. | Failure diagnostics dump Snap service/connection/change state, gateway and snapd journals, Snap logs, and port 17670 listeners. |
 | `kubernetes` job fails on `helm install --wait` | Chart did not deploy in 5 min — usually image pull failure or readiness probe failing. | "Diagnostics on failure" step dumps `helm status`, manifest, pod describe, pod logs. |

@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  interpreter:
+    description: Expected ELF program interpreter, "none" for static, or "skip"
+    required: false
+    default: skip
 
 runs:
   using: composite
@@ -71,11 +75,24 @@ runs:
       env:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_INTERPRETER: ${{ inputs.interpreter }}
       run: |
+        binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
         # Confirm the binary runs and reports the expected name.
-        target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} --version | grep -q "^${INPUTS_BINARY} "
+        "$binary" --version | grep -q "^${INPUTS_BINARY} "
         # Confirm Syft can decode the embedded cargo-auditable metadata.
-        SYFT_CHECK_FOR_APP_UPDATE=false syft file:target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        if [ "$INPUTS_INTERPRETER" != skip ]; then
+          actual_interpreter="$(readelf -l "$binary" | sed -n 's/.*Requesting program interpreter: \(.*\)]/\1/p')"
+          expected_interpreter="$INPUTS_INTERPRETER"
+          if [ "$expected_interpreter" = none ]; then
+            expected_interpreter=""
+          fi
+          if [ "$actual_interpreter" != "$expected_interpreter" ]; then
+            echo "error: expected interpreter '${expected_interpreter:-<none>}', got '${actual_interpreter:-<none>}'" >&2
+            exit 1
+          fi
+        fi
 
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

@@ -8,7 +8,6 @@ inputs:
   results:
     description: JSON-encoded GitHub Actions needs context
     required: true
-
 runs:
   using: composite
   steps:

@@ -14,7 +14,7 @@ inputs:
   images:
     description: Space-separated OpenShell image components to load
     required: false
-    default: gateway supervisor
+    default: gateway sandbox supervisor
   registry:
     description: Container registry and namespace
     required: false
@@ -71,7 +71,7 @@ runs:
         set -euo pipefail
         for component in $IMAGE_COMPONENTS; do
           case "$component" in
-            gateway | supervisor) ;;
+            gateway | sandbox | supervisor) ;;
             *) echo "ERROR: unsupported OpenShell image component: $component" >&2; exit 1 ;;
           esac
           image="${REGISTRY}/${component}:${IMAGE_TAG}"

@@ -179,8 +179,8 @@ jobs:
           tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
           cargo build -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
-          cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
-          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
+          cargo build -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor
 
       - name: Verify selective gateway compute-driver builds
         run: |
@@ -197,12 +197,12 @@ jobs:
 
       - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
         run: |
-          cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots
-          if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
+          cargo check -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots
+          if cargo tree -p openshell-supervisor -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
             echo "ERROR: webpki-roots found in system CA roots build" >&2
             exit 1
           fi
-          if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
+          if cargo tree -p openshell-supervisor -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
             echo "ERROR: webpki-root-certs found in system CA roots build" >&2
             exit 1
           fi