2707 configurable uid gid range/ebusto by ebusto · Pull Request #2737 · NVIDIA/OpenShell

ebusto · 2026-08-13T22:04:38Z

Summary

Operators can lower the sandbox UID/GID minima in gateway.toml so enterprise
system identities below 1000 (for example GID 30 or UID 500) are accepted.
Defaults stay 1000, and root (0) is still rejected.

Related Issue

Fixes #2707

Changes

Add [openshell.gateway] min_sandbox_uid and min_sandbox_gid (TOML only;
default 1000, minimum 1).
Thread those limits through policy validation on create, update, get, merge
retry, draft-chunk approval, and agent proposals.
Inject OPENSHELL_MIN_SANDBOX_UID / OPENSHELL_MIN_SANDBOX_GID into Docker,
Podman, and Kubernetes sandbox environments so the supervisor and OPA engine
use the same range.
Document the keys in docs/reference/gateway-config.mdx.

Testing

mise run pre-commit passes
Unit tests added/updated
E2E tests added/updated (if applicable)
Unit coverage includes default-min rejection, min=1 accepting GID 30 / UID
500, supervisor env parsing, OPA from_proto with env limits, and merge /
agent-proposal paths that previously re-validated against the default 1000
floor. Farm VM check: gateway with min_sandbox_uid = 1 / min_sandbox_gid = 1
and a UID/GID 500 user.

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (if applicable)

Operators can lower min_sandbox_uid and min_sandbox_gid in gateway.toml so enterprise system IDs such as GID 30 are accepted. Root remains rejected. Signed-off-by: Eric Busto <ebusto@nvidia.com>

Signed-off-by: Eric Busto <ebusto@nvidia.com>

Network-policy merge retries and agent proposals re-validated the full policy with the default UID/GID minimum, so a persisted run_as_user of 500 was rejected even when gateway.toml lowered the range. Signed-off-by: Eric Busto <ebusto@nvidia.com>

Production paths now pass configured identity limits, so the default wrapper was unused in non-test builds and triggered dead_code. Signed-off-by: Eric Busto <ebusto@nvidia.com>

Rename from_mins parameters to avoid similar_names, and use RangeInclusive::contains when parsing supervisor env minima. Signed-off-by: Eric Busto <ebusto@nvidia.com>

Rename apply_identity_limits_from_file parameters so pre-commit clippy -D warnings passes. Signed-off-by: Eric Busto <ebusto@nvidia.com>

copy-pr-bot · 2026-08-13T22:04:41Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

github-actions · 2026-08-13T22:05:52Z

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

ebusto · 2026-08-13T22:14:49Z

I have read the DCO document and I hereby sign the DCO.

drew

gator-agent

PR Review Status

Validation: Project-valid implementation of validated issue #2707; the operator-configurable lower identity floor preserves the default of 1000 and rejects root.
Head SHA: b1b4bb32705432815f1cd0f9a1313698dbd942e9
Base SHA: c5498239e66581d5842b50773eff07ace65726f1
Merge base SHA: c5498239e66581d5842b50773eff07ace65726f1
Patch ID: a4928771b3cd59dd91c7902df8e2f7eda9552bd7
Gator payload: 4
Review mode: initial
Previous reviewed SHA: none
Review budget exhausted: no
Maintainer decision required: no

Blocking findings:

GATOR-b1b4bb32-01: Kubernetes still resolves and validates its authoritative workload identity against the fixed 1000 floor, so the advertised configured lower minima cannot survive that supported path.
GATOR-b1b4bb32-02: VM gateways accept policies using the lowered global minima but do not propagate the minima to the guest supervisor or reject that configuration.

Carried findings:

None

Non-blocking suggestions:

None

Docs: docs/reference/gateway-config.mdx is updated, but its stated backend coverage exposes the unresolved VM contract described above.

Next state: gator:in-review

drew · 2026-08-13T22:22:41Z

    pub sandbox_gid: Option<u32>,
+    /// Minimum accepted sandbox process UID.
+    #[serde(skip, default = "default_min_sandbox_identity")]
+    pub min_sandbox_uid: u32,


gator-agent

Warning — GATOR-b1b4bb32-01

Invariant: Kubernetes authoritative workload UID/GID resolution must honor the same configured minima as gateway and supervisor validation.

Prerequisite: An operator selects Kubernetes, lowers min_sandbox_uid/min_sandbox_gid, and configures or receives an OpenShift-assigned workload identity below 1000.

Entry point → sink: [openshell.gateway] minima plus Kubernetes sandbox_uid/sandbox_gid or SCC annotations → Kubernetes identity validation/resolution and apply_resolved_identity_env.

Base → head: All layers previously rejected identities below 1000 → the gateway and supervisor now accept them, but validate_sandbox_identity_config and both SCC parsers still use fixed MIN_SANDBOX_UID; the resolved Kubernetes pair then overrides the policy identity.

Impact: Explicit UID 500/GID 30 fails driver initialization, low SCC allocation falls back to 1000, or a gateway-accepted policy runs under the wrong resolved pair.

Reproducer: Construct KubernetesComputeConfig with minima 1 and sandbox_uid=500, sandbox_gid=30; validate_sandbox_identity_config deterministically rejects it. Rendering a policy requesting 500/30 with the default resolved pair emits 1000/1000, which the supervisor applies authoritatively.

PR ownership: This patch adds Kubernetes minimum fields and propagation while leaving the driver's identity-selection boundary on the old floor.

Requested change: Use the configured UID and GID minima in explicit-config validation and SCC parsing, define the deterministic relationship to explicit policy identities, and add a render/identity regression test proving 500/30 survives the Kubernetes path.

drew · 2026-08-13T22:22:41Z

        normalize_process_identity_for_driver(policy, state.compute.driver_kind());
        validate_no_reserved_provider_policy_keys(policy)?;
-        validate_policy_safety(policy)?;
+        validate_policy_safety_with_limits(policy, identity_limits(&state.config))?;


gator-agent

Warning — GATOR-b1b4bb32-02

Invariant: Every supported backend must propagate the gateway-validated workload identity minima to its supervisor, or reject unsupported non-default minima before accepting affected policies.

Prerequisite: An operator selects the VM driver, lowers either gateway minimum, and submits a policy identity below 1000 but within that configured range.

Entry point → sink: CreateSandbox/UpdateConfig on a VM-backed gateway → VM guest supervisor policy validation, where SandboxIdentityLimits::from_env() falls back to 1000.

Base → head: The gateway previously rejected such a policy → it now accepts and persists it, while VmComputeConfig, VmDriverConfig, and build_guest_environment carry neither minimum.

Impact: A supported, accepted policy can fail VM startup or runtime policy loading and leave the sandbox unavailable/fail-closed.

Reproducer: Configure a VM gateway with minima 1, submit run_as_user=500 and run_as_group=30, and inspect build_guest_environment; neither minimum variable is present, so the guest deterministically rejects both values against 1000.

PR ownership: This patch changes gateway validation globally but propagates the new contract only through Docker, Podman, and Kubernetes.

Requested change: Add protected minimum fields to the VM driver contract and inject both variables into the guest, with a render-level regression test; alternatively reject non-default minima at gateway startup when VM is selected if VM support is intentionally out of scope.

The lack of Kubernetes and VM support is a fair criticism. Selfishly, getting this working with the Docker driver is what's important for the internal compute farm effort.

Is support for those two drivers something that can be deferred? Thoughts?

Actually, let me take a stab at VM and Kubernetes support.

Pass [openshell.gateway] min_sandbox_uid/gid to the VM driver subprocess and into the guest supervisor environment so a lowered range is enforced inside the microVM, matching Docker and Podman. Testing: - cargo test -p openshell-driver-vm --lib -- validate_sandbox_identity build_guest_environment_sets_supervisor_defaults build_guest_environment_includes_configured_identity_limits - cargo test -p openshell-server --lib -- vm_driver_command_includes_identity_limits - mise run gateway:vm with min_sandbox_uid/gid = 1; sandbox policy process.run_as_user/group 500; guest `id` reported uid=500 gid=500 Signed-off-by: Eric Busto <ebusto@nvidia.com>

drew · 2026-08-14T17:45:17Z

gator-agent

Blocked

Head SHA: af883c40f9e017b3ea4258bbcce7188379848fd5
Gator payload: 4

Gator is blocked because this PR is currently a draft.

Thanks @ebusto — I saw your update that you are taking a pass at VM and Kubernetes support, and the latest head includes changes in both driver paths. The independent follow-up review of those changes will resume once the PR is ready for review.

Next action: @ebusto, mark the PR ready for review when the implementation is ready for another pass.

ebusto and others added 7 commits August 12, 2026 14:40

feat(gateway): make sandbox UID/GID minima configurable

b2bc2b8

Operators can lower min_sandbox_uid and min_sandbox_gid in gateway.toml so enterprise system IDs such as GID 30 are accepted. Root remains rejected. Signed-off-by: Eric Busto <ebusto@nvidia.com>

Ensure the supervisor is using the same limits.

5e48a6d

Signed-off-by: Eric Busto <ebusto@nvidia.com>

fix(gateway): gate default policy-safety helper to tests

7fb9b28

Production paths now pass configured identity limits, so the default wrapper was unused in non-test builds and triggered dead_code. Signed-off-by: Eric Busto <ebusto@nvidia.com>

fix(policy): satisfy clippy on sandbox identity limits

5aed0b4

Rename from_mins parameters to avoid similar_names, and use RangeInclusive::contains when parsing supervisor env minima. Signed-off-by: Eric Busto <ebusto@nvidia.com>

Merge branch 'NVIDIA:main' into 2707-configurable-uid-gid-range/ebusto

9dabb90

fix(gateway): avoid clippy similar_names on identity limits

b1b4bb3

Rename apply_identity_limits_from_file parameters so pre-commit clippy -D warnings passes. Signed-off-by: Eric Busto <ebusto@nvidia.com>

ebusto requested review from a team, derekwaynecarr, maxamillion and mrunalp as code owners August 13, 2026 22:04

drew reviewed Aug 13, 2026

View reviewed changes

drew added the gator:in-review Gator is reviewing or awaiting PR review feedback label Aug 13, 2026

ebusto marked this pull request as draft August 14, 2026 17:19

drew added gator:blocked Gator is blocked by process or repository gates and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Aug 14, 2026

Navigation Menu

Uh oh!

2707 configurable uid gid range/ebusto - #2737

2707 configurable uid gid range/ebusto#2737
ebusto wants to merge 8 commits into
NVIDIA:mainfrom
ebusto:2707-configurable-uid-gid-range/ebusto

ebusto commented Aug 13, 2026

Uh oh!

copy-pr-bot Bot commented Aug 13, 2026

Uh oh!

github-actions Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

ebusto commented Aug 13, 2026

Uh oh!

drew left a comment

Uh oh!

drew Aug 13, 2026

Uh oh!

drew Aug 13, 2026

Uh oh!

ebusto Aug 13, 2026 •

edited

Loading

Uh oh!

ebusto Aug 14, 2026

Uh oh!

drew commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ebusto commented Aug 13, 2026

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Aug 13, 2026

Uh oh!

github-actions Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ebusto commented Aug 13, 2026

Uh oh!

drew left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

drew Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

drew Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

ebusto Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ebusto Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

drew commented Aug 14, 2026

Blocked

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 13, 2026 •

edited

Loading

ebusto Aug 13, 2026 •

edited

Loading