feat: snap UX improvements, and work towards strict confinement#1571
Open
alexclewontin wants to merge 5 commits into
Open
feat: snap UX improvements, and work towards strict confinement#1571alexclewontin wants to merge 5 commits into
alexclewontin wants to merge 5 commits into
Conversation
Adds OPENSHELL_SYSTEM_GATEWAY_DIR, a read-only gateway registry that installers (snap, deb, systemd units) can seed with deployment-provided gateways. load_active_gateway and load_gateway_metadata fall back to the system dir when no per-user entry exists; list_gateways merges both, with per-user entries shadowing system entries on name collision. Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com> Originally-authored-by: Mark Shuttleworth <mark@ubuntu.com>
Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
alexclewontin
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
|
All contributors have signed the DCO ✍️ ✅ |
Author
|
I have read the DCO document and I hereby sign the DCO. |
Author
|
recheck |
Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
Custom `--from` VM images were failing in the guest-prep path with stale or incompatible prepared rootfs handling. Observed failures: - `EXT4-fs (vdc): write access unavailable, cannot proceed (try mounting with noload)` - `mount: /image-cache: cannot mount /dev/vdc read-only` - `FATAL: umoci unpack did not produce rootfs directory` - `ProcessExited: VM process exited with status 0` hid the guest-side cause Mount prepared ext4 disks with `ro,noload`, accept both umoci unpack layouts, bump the rootfs cache layout versions so old prepared disks are rebuilt, and include the tail of rootfs-console.log in ProcessExited errors. Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
Strict snap sandbox connect/create shells were still trying to exec the host OpenSSH binary. Observed failure: - `apparmor="DENIED" operation="exec" class="file" profile="snap.openshell.openshell" name="/usr/bin/ssh" requested_mask="x" denied_mask="x"` Bundle `openssh-client` in the snap so the CLI uses the bundled binary under strict confinement. Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
alexclewontin
force-pushed
the
snap-support
branch
from
4cdaf3c to
05cfc6b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR makes the snap package usable under strict confinement and gives it a working local gateway by default. It also fixes the VM image-preparation path that blocked
openshell sandbox create --from ...against the snap-managed VM gateway.The workflows this branch is trying to enable are:
snap install openshell, then runopenshell sandbox create ...without manually registering a gateway.openshell sandbox connectand interactivesandbox createflows work without trying to exec host binaries outside the snap sandbox.openshell sandbox create --from <image> ...works against the default snap-managed VM gateway instead of failing during prepared rootfs setup.Related Issue
N/A.
Changes
openshell-bootstrapso package-managed installs can seed read-only gateway registrations outside per-user config.OPENSHELL_SYSTEM_GATEWAY_DIR, letting package-provided local gateways appear immediately inopenshell statusand normal gateway selection flows.snap/snapcraft.yamland refreshed the snap packaging/tests around that layout.local-vmgateway pointing athttp://127.0.0.1:17670, marks it active, and bootstraps gateway runtime state on first install.deploy/snap/README.md,docs/about/installation.mdx,docs/sandboxes/manage-gateways.mdx, andarchitecture/gateway.md.umoci raw unpacktoumoci unpackso the guest prep step always gets a bundlerootfs/directory,ro,noload, andProcessExitedincludes relevant VM console output instead of only the host-side exit status.openssh-clientin the snap so strict-confinement SSH-based sandbox workflows use the snap-managed client instead of failing on/usr/bin/sshAppArmor denies.Testing
mise run pre-commitpassesAdditional verification:
mise run pre-commitpassed, includingcargo check,cargo clippy, workspace Rust tests, Python tests, markdown lint, Helm lint, install.sh tests, and Python type/lint/format checks.pytest python/passed (15 passed).local-vmgateway path,IMAGE_TAG=dev mise run e2eruns on this work and onmainboth hit the same pre-existing Docker supervisor TLS cert issue (failed to read CA cert from /etc/openshell/tls/client/ca.crt). This PR does not introduce that failure.Checklist