feat(docker): isolate workloads behind a companion supervisor

[drew]

Summary

Adopt RFC 0012 in the Docker driver. The workload container runs openshell-sandbox with Docker networking disabled; a supervisor companion container owns policy and mediated TCP and DNS access.

The driver provisions a private Unix socket between the containers. The OpenShell Sandbox Protocol authenticates the connection with a pinned TLS server identity and a launch-scoped sandbox JWT.

Related Issue

Part of #1737.

Changes

• Launch workload containers with network_mode=none.
• Launch openshell-supervisor as a companion container on the Docker host network.
• Keep supervisor credentials, client TLS material, and proxy credentials out of the workload container.
• Preserve a running workload during gateway recovery by replacing only its supervisor session.
• Adopt missing generation markers for older running sandboxes and reject conflicting generations.
• Fail closed when the supervisor or protected channel is unavailable.
• Preserve the accepted schema-v2 Docker configuration and typed image-pull policy.

Testing

• mise run pre-commit
• cargo test -p openshell-driver-docker --lib (131 passed)
• Full Docker E2E delegated to remote CI

Checklist

• Follows Conventional Commits
• Authored commits are signed off (DCO)

Stack

1. feat(isolation): implement the RFC 0012 sandbox architecture #2942 — RFC 0012 core architecture
2. feat(vm): run the supervisor outside the guest workload #2945 — VM driver
3. feat(docker): isolate workloads behind a companion supervisor #2965 — Docker driver (this PR)
4. feat(kubernetes): isolate workloads behind a dedicated supervisor #3144 — Kubernetes driver
5. feat(podman): isolate workloads behind a separate supervisor #3230 — Podman driver
6. perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2965.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for c63a604. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is required before review can proceed. The current author-only delta adjusts mediated-network E2E expectations and introduces no new Critical defect, but it does not resolve the two durable obligations from the prior review.

Root-cause findings:

• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts accepts any existing non-bind-backed named volume, including the predictably named OpenShell supervisor volume that contains another sandbox's JWT, TLS key, or proxy credential.
• GATOR-134c96ed-03: still unresolved. rfc/0003-gateway-configuration/README.md continues to publish schema-v1 keys and combined-runtime Docker guidance that the current schema-v2 parser and split sandbox/supervisor images reject.

Scope growth:

• None. Both findings have focused fixes within this Docker layer and its changed RFC documentation.

Reviewer-quality signals:

• The critical-only reviewer proposed no new findings. The ledger records repeated IDs from prior carry-forward dispositions, but no resolved or waived finding was re-raised in this round.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-134c96ed-01 and GATOR-134c96ed-03 remain required so @drew can implement the stated focused fixes, or explicitly waive either finding with the rationale for accepting that concrete security or configuration-contract risk.

Gator metadata

• Head SHA: cc9e969cb9fa911b449d3a0562a1d5c8ef81513c
• Base SHA: a8b780401e7e06273b1b32c4f5515957e344da08
• Merge base SHA: a8b780401e7e06273b1b32c4f5515957e344da08
• Patch ID: a500ff13770c56deadc22cb1d4ffc551ef4bf5fc
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• E2E: test:e2e remains applied; test dispatch is deferred until review convergence
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked the new mediated-network E2E updates against the current #2945 stacked base and the downstream RFC 0012 driver layers. The critical-only review found no newly introduced Critical defect, but these test-only commits do not resolve or waive the two durable obligations from the prior review.

Root-cause findings:

• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts accepts an existing non-bind-backed named volume, including a predictably named OpenShell supervisor volume containing another sandbox's JWT, TLS key, or proxy credential.
• GATOR-134c96ed-03: still unresolved. rfc/0003-gateway-configuration/README.md publishes schema-v1 keys and combined-runtime Docker guidance that the schema-v2 parser and split sandbox/supervisor images reject.

Scope growth:

• None. Both obligations retain focused fixes within this Docker layer and its changed RFC documentation.

Reviewer-quality signals:

• The critical-only reviewer proposed no findings. The ledger reports repeated carry-forward IDs from prior dispositions, with no waived or resolved finding re-raised by this review.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-134c96ed-01 and GATOR-134c96ed-03 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting that concrete security or configuration-contract risk.

Gator metadata

• Head SHA: 6049c0a7e7ea5ef4ebf70e49ef214222ce71fe31
• Base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Merge base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Patch ID: 24abdce88ba5c626da337dc9eab2b152b007d756
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• Review telemetry: 0 proposals, 0 duplicates, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 3 finding-bearing rounds to date
• E2E: test:e2e is applied and current-head Branch E2E workflows are running; no additional /ok to test or rerun is required in this cycle
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked the new sandbox CA runtime-path update against the current #2945 stacked base and the downstream RFC 0012 driver layers. The critical-only review found no newly introduced Critical defect, but this focused path change does not resolve or waive the two durable obligations from the prior review.

Root-cause findings:

• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts accepts an existing non-bind-backed named volume, including a predictably named OpenShell supervisor volume containing another sandbox's JWT, TLS key, or proxy credential.
• GATOR-134c96ed-03: still unresolved. rfc/0003-gateway-configuration/README.md publishes schema-v1 keys and combined-runtime Docker guidance that the schema-v2 parser and split sandbox/supervisor images reject.

Scope growth:

• None. The latest delta only nests workload-visible CA material below its tmpfs root; both obligations retain focused fixes within this Docker layer and its changed RFC documentation.

Reviewer-quality signals:

• The critical-only reviewer proposed no findings. The ledger reports repeated carry-forward IDs from prior dispositions, with no resolved or waived finding re-raised by this review.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-134c96ed-01 and GATOR-134c96ed-03 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting that concrete security or configuration-contract risk.

Gator metadata

• Head SHA: 9221700c8725ff980db6d669ffe8baf3422bda77
• Base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Merge base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Patch ID: dc32fb240f04e696ffa24dcfbfd2bf16695797e2
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• Review telemetry: 0 proposals, 0 duplicates, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 3 finding-bearing rounds to date
• E2E: test:e2e is applied and current-head Branch E2E workflows are running; no additional /ok to test or rerun is required in this cycle
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked the supervisor network update against the current #2945 stacked base and the downstream RFC 0012 driver layers. Moving the supervisor from host networking to the driver-owned bridge introduces no new Critical defect, but it does not resolve or waive the two durable obligations from the prior review.

Root-cause findings:

• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts accepts an existing non-bind-backed named volume, including a predictably named OpenShell supervisor volume containing another sandbox's JWT, TLS key, or proxy credential.
• GATOR-134c96ed-03: still unresolved. rfc/0003-gateway-configuration/README.md publishes schema-v1 keys and combined-runtime Docker guidance that the schema-v2 parser and split sandbox/supervisor images reject.

Scope growth:

• None. The latest delta only attaches the trusted supervisor to the configured driver-owned bridge and aligns the Docker README; both obligations retain focused fixes within this Docker layer and its changed RFC documentation.

Reviewer-quality signals:

• The critical-only reviewer proposed no findings. The ledger reports repeated carry-forward IDs from prior dispositions, with no waived or resolved finding re-raised by this review.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-134c96ed-01 and GATOR-134c96ed-03 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting that concrete security or configuration-contract risk.

Gator metadata

• Head SHA: b80c205c7bbcb821065f2071efc30a5341ff1a0e
• Base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Merge base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Patch ID: 89489e01acf1ed9490ec988cbefcbfb357a8033d
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• Review telemetry: 0 proposals, 0 duplicates, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 3 finding-bearing rounds to date
• E2E: test:e2e is applied and current-head Branch E2E workflows are running; no additional /ok to test or rerun is required in this cycle
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked the current-head startup-recovery change against the current #2945 stacked base and the downstream RFC 0012 driver layers. Deferring supervisor recovery until the gateway can supply authentication introduces no new Critical defect, but it does not resolve or waive the two durable obligations from the prior review.

Root-cause findings:

• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts still accepts any existing non-bind-backed named volume, including a predictably named OpenShell supervisor volume containing another sandbox's JWT, TLS key, or proxy credential.
• GATOR-134c96ed-03: still unresolved. rfc/0003-gateway-configuration/README.md still publishes schema-v1 keys and combined-runtime Docker guidance that the schema-v2 parser and split sandbox/supervisor images reject.

Scope growth:

• None. The latest delta only defers Docker supervisor recovery and preserves the persisted authentication bundle until the gateway is ready; both obligations retain focused fixes within this Docker layer and its changed RFC documentation.

Reviewer-quality signals:

• The critical-only reviewer proposed no findings. The ledger reports 20 repeated finding-ID occurrences from prior carry-forward dispositions, with no waived or resolved finding re-raised by this review and no unchanged-code proposal.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-134c96ed-01 and GATOR-134c96ed-03 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting that concrete security or configuration-contract risk.

Gator metadata

• Head SHA: 6bcbd5a7f7d40f3655a58c4f77857f5c92fa84a2
• Base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Merge base SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Patch ID: d1d1e53ccb27a89e377038908bad864876910bf4
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• Review telemetry: 0 proposals, 0 duplicates in this reviewer output, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 3 finding-bearing rounds to date
• E2E: test:e2e remains applied; current-head Branch E2E is queued/running, so no additional /ok to test or workflow rerun is required in this cycle
• Checks: current-head Branch Checks and required E2E are pending; Helm Lint and Trivy Changes are green
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I reviewed the five-commit author-only delta after 09ad5790 against the current #2945 stacked base and the complete RFC 0012 stack, including the Kubernetes, Podman, and performance layers downstream. The critical-only review found no newly introduced Critical defect. The latest network, CA-path, E2E, and startup-recovery changes do not resolve or waive the two durable obligations from the prior review.

Root-cause findings:

• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts accepts an existing OpenShell-managed named volume, including the predictably named supervisor volume containing another sandbox's JWT, TLS key, or proxy credential.
• GATOR-134c96ed-03: still unresolved. rfc/0003-gateway-configuration/README.md still publishes schema-v1 keys and combined-runtime Docker guidance that the current schema-v2 parser and split sandbox/supervisor images reject.

Scope growth:

• None. The latest delta stays within the Docker isolation layer and shared runtime-path/test alignment; both obligations retain focused fixes in this layer and its changed RFC documentation.

Reviewer-quality signals:

• The critical-only reviewer proposed no findings. The ledger records 22 repeated finding-ID occurrences from prior carry-forward dispositions, with no resolved or waived finding re-raised by this review and no unchanged-code proposal.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-134c96ed-01 and GATOR-134c96ed-03 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting that concrete security or configuration-contract risk.

Gator metadata

• Head SHA: 30cf1e39c17f99284e19bf483ce1bb878b963fe2
• Base SHA: f4deea5c3c475c194af2b4fcdf1d9ec9f48bf216
• Merge base SHA: f4deea5c3c475c194af2b4fcdf1d9ec9f48bf216
• Patch ID: d1d1e53ccb27a89e377038908bad864876910bf4
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• Review telemetry: 0 proposals, 0 duplicates in this reviewer output, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 3 finding-bearing rounds to date
• E2E: test:e2e remains applied and the current-head Branch E2E workflow is running; no additional /ok to test or workflow rerun is required by the label-help bot in this cycle
• Checks: current-head Branch Checks and required E2E are pending; Helm Lint, Trivy Changes, and GPU E2E are green. One Docker E2E job has failed while the workflow remains in progress.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

PR Review Status

Thanks @drew. I reviewed the new generation-aware Docker start commit against the current #2945 stacked base and the full RFC 0012 stack. The rebase is patch-equivalent through the previously reconciled head, but the new marker check introduces one Critical startup-recovery regression. The two prior maintainer-decision obligations also remain carried and unwaived.

Action required: @drew, please initialize the Docker start-generation marker for normal/legacy running sandboxes, address or obtain maintainer waivers for GATOR-134c96ed-01 and GATOR-134c96ed-03, and push an updated head.

Blocking findings:

• GATOR-3a8cf989-01: gateway restart cannot recover normally provisioned running Docker sandboxes because they have no start-generation marker.

Carried findings:

• GATOR-134c96ed-01: workload mounts can still select predictably named OpenShell-managed supervisor volumes containing another sandbox's credentials.
• GATOR-134c96ed-03: the changed RFC still publishes schema-v1 keys and combined-runtime Docker guidance rejected by the schema-v2 split-runtime implementation.

Gator metadata

• Validation: Maintainer-authored Docker implementation layer in the accepted RFC 0012 isolation stack rooted at #2942, incrementally based on #2945 with downstream Kubernetes, Podman, and performance layers considered.
• Docs: Direct Fern references are updated; GATOR-134c96ed-03 remains carried for the incompatible RFC text.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint, Trivy Changes, and GPU E2E are green.
• E2E: test:e2e is applied and current-head Branch E2E is running; no /ok to test or workflow rerun is required in this cycle.
• Head SHA: 3a8cf989522754867aeabad6384532214b7aa752
• Base SHA: 6b0457f8fbe755e6779fdba34e85c2cf9b17666d
• Merge base SHA: 6b0457f8fbe755e6779fdba34e85c2cf9b17666d
• Patch ID: 96c7cd63243b53c33c77eacbad7ac6dfe0f1ae7a
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 169adfea3c5cca2446902ebc30f3e2ed83ce8281
• Review budget exhausted: yes
• Maintainer decision required: no — the newly introduced Critical requires author remediation directly; carried obligations remain unwaived
• Review telemetry: 1 proposal, 0 duplicates, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 3 prior finding-bearing rounds
• Next state: gator:in-review

[johntmyers]

gator-agent

PR Review Status

Thanks @drew. I reviewed the session-rotation update against the current #2945 stacked base and the full RFC 0012 stack. The rebase is patch-equivalent through the prior reviewed head, but this commit leaves the missing-generation-marker recovery defect open and introduces a second Critical: a same-generation recovery with fresh authentication stops and restarts the canonical workload, so a crash-window retry can execute non-idempotent work twice.

Action required: @drew, please preserve same-generation recovery without re-executing the workload, initialize/adopt the generation marker for normally provisioned running sandboxes, address or obtain maintainer waivers for GATOR-134c96ed-01 and GATOR-134c96ed-03, and push an updated head.

Blocking findings:

• GATOR-eca09e94-01: same-generation gateway recovery can re-execute the canonical workload process.

Carried findings:

• GATOR-3a8cf989-01: normally provisioned running Docker sandboxes still have no start-generation marker, so gateway restart recovery fails before supervisor restoration.
• GATOR-134c96ed-01: workload mounts can select predictably named OpenShell-managed supervisor volumes containing another sandbox's credentials.
• GATOR-134c96ed-03: the changed RFC still publishes schema-v1 keys and combined-runtime Docker guidance rejected by the schema-v2 split-runtime implementation.

Gator metadata

• Validation: Maintainer-authored Docker implementation layer in the accepted RFC 0012 isolation stack rooted at #2942, incrementally based on #2945 with downstream Kubernetes, Podman, and performance layers considered.
• Docs: Direct Fern references are updated; GATOR-134c96ed-03 remains carried for incompatible RFC text.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint, Trivy Changes, and GPU E2E are green.
• E2E: test:e2e is applied and the current-head Branch E2E workflow is running; no additional /ok to test or workflow rerun is required in this cycle.
• Head SHA: eca09e94c93577977d538141d0cdf8c588ab3d81
• Base SHA: 0caeda261ed0321a11662ab3fd4e066cf1540352
• Merge base SHA: 0caeda261ed0321a11662ab3fd4e066cf1540352
• Patch ID: e915a7c8dd54dd9eb716dd0f5e211bc68f8a058e
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 3a8cf989522754867aeabad6384532214b7aa752
• Review budget exhausted: yes
• Maintainer decision required: no — the new Critical and the prior recovery Critical require focused author remediation; two older obligations remain unwaived.
• Review telemetry: 1 proposal, 0 duplicates, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer; 4 finding-bearing rounds before this head.
• Next state: gator:in-review

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I reviewed the two-commit author-only delta against the current #2945 stacked base and the full RFC 0012 stack. The critical-only reviewer proposed no new Critical. The generation-marker recovery defect is fixed, and removing the unrelated RFC file from this incremental PR resolves the configuration-RFC obligation. Two durable obligations remain unwaived: the supported mount path can still expose another sandbox's supervisor credentials, and stopping the old supervisor during gateway recovery still terminates the workload boundary instead of preserving it for session replacement.

Root-cause findings:

• GATOR-eca09e94-01: still unresolved. Recovery no longer restarts the Docker workload container, but stop_control_process stops the supervisor container; the supervisor's SIGTERM path sends Term to the canonical agent and terminates the boundary before the replacement supervisor starts. Preserve the existing workload and boundary while retiring only the old supervisor session, and cover gateway-restart rotation with an unchanged workload PID and uninterrupted process state.
• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts accepts an existing OpenShell-managed named volume, including the predictably named supervisor volume containing another sandbox's JWT, TLS key, or proxy credential. Reject OpenShell-managed volumes before workload creation and cover a cross-sandbox supervisor-volume mount attempt.

Resolved findings:

• GATOR-3a8cf989-01: normal and legacy running sandboxes now atomically adopt a missing start-generation marker and reject a conflicting generation, with focused regression coverage.
• GATOR-134c96ed-03: the configuration RFC is no longer changed by this incremental Docker layer, so its unrelated contract text is outside this PR's effective patch.

Scope growth:

• None. Both remaining obligations have focused fixes within the Docker layer.

Reviewer-quality signals:

• The critical-only reviewer proposed 0 findings: 0 duplicates, 0 resolved/waived re-raises, 0 unchanged-code proposals, and 0 blockers lacking a reproducer. The ledger records 31 duplicate finding-ID occurrences across prior carry-forward dispositions and five finding-bearing rounds.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-eca09e94-01 and GATOR-134c96ed-01 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting its concrete lifecycle or credential-isolation risk.

Gator metadata

• Head SHA: 995af07e9a521672d2c785198a6e2d2e10cac7cf
• Base SHA: 9ab52d2224a04e0b23c93ffdce3e46195936bf65
• Merge base SHA: 9ab52d2224a04e0b23c93ffdce3e46195936bf65
• Patch ID: ae5194376f6944d5bfc240f3ac579e9fa3cc0ff7
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: eca09e94c93577977d538141d0cdf8c588ab3d81
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior findings remain unresolved and unwaived
• Checks: current-head Branch Checks and required E2E are queued/running; Helm Lint and Trivy Changes are green
• E2E: test:e2e remains applied and current-head Branch E2E is queued/running; no additional /ok to test or workflow rerun is required in this cycle
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked the rebased Docker layer against the current #2945 stacked base and the full RFC 0012 isolation stack. Removing the unrelated RFC 0003 edit resolves GATOR-134c96ed-03, but the recovery and supervisor-volume changes leave two durable Critical obligations unresolved.

Root-cause findings:

• GATOR-eca09e94-01: still unresolved. The new recovery branch avoids restarting the Docker workload container directly, but stop_control_process sends SIGTERM to the supervisor; its control-mode shutdown path signals and terminates the canonical workload before the replacement supervisor starts. Recovery therefore still cannot preserve a running non-idempotent workload.
• GATOR-134c96ed-01: still unresolved. template.driver_config.mounts continues to accept an existing OpenShell-managed supervisor volume. Because that volume name is derived from the namespace and sandbox ID, another workload can select it and read the victim sandbox's JWT, TLS key, or proxy credential.

Resolved obligation:

• GATOR-134c96ed-03: resolved by removing rfc/0003-gateway-configuration/README.md from this Docker layer's effective patch; the stale schema-v1 text is no longer introduced or modified by feat(docker): isolate workloads behind a companion supervisor #2965.

Scope growth:

• None. Both remaining obligations have focused fixes within the Docker companion lifecycle and volume validation paths.

Maintainer action: @NVIDIA/openshell-maintainers, please confirm that GATOR-eca09e94-01 and GATOR-134c96ed-01 remain required so @drew can implement the focused fixes, or explicitly waive either finding with the rationale for accepting the concrete workload-termination or cross-sandbox credential-exposure risk.

Gator metadata

• Head SHA: a3ff2e7024cb028a153894ea66921025ca1176c2
• Base SHA: 3be3fe3053291f5c48842d53475f183c92549b06
• Merge base SHA: 3be3fe3053291f5c48842d53475f183c92549b06
• Patch ID: da89ef7f769afca631652c39d301e0dbe26eb521
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: eca09e94c93577977d538141d0cdf8c588ab3d81
• Review budget exhausted: yes
• Maintainer decision required: yes — two carried Critical findings remain unresolved and unwaived
• Docs: Fern Docker/gateway documentation remains in the effective patch; the unrelated RFC 0003 edit was removed
• Checks: current-head Branch Checks and E2E are running; Helm Lint is green
• E2E: test:e2e is applied and a current-head Branch E2E run is active; no /ok to test or rerun is required in this cycle
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: the PR merged while Gator was in gator:blocked. The last review disposition recorded GATOR-eca09e94-01 (gateway recovery could terminate the running workload through supervisor shutdown) and GATOR-134c96ed-01 (a workload could select another sandbox's predictable supervisor volume and expose its credentials) as unresolved and unwaived. Required Branch Checks and E2E later completed successfully.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: a3ff2e7024cb028a153894ea66921025ca1176c2
• Gator payload: 8
• Terminal state: merged
• Previous state: gator:blocked