From 626b9f7c2428cfadb884466b8caee042398675cd Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Wed, 23 Sep 2026 14:40:27 +0200 Subject: [PATCH] fix(drivers): normalize label namespace Signed-off-by: Evan Lezar --- crates/openshell-driver-podman/NETWORKING.md | 4 ++-- crates/openshell-driver-podman/src/isolation.rs | 4 ++-- crates/openshell-driver-podman/src/watcher.rs | 4 ++-- crates/openshell-driver-vm/src/lifecycle.rs | 2 +- e2e/rust/tests/podman_gateway_start.rs | 2 +- e2e/rust/tests/podman_oci_identity.rs | 2 +- e2e/with-podman-gateway.sh | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/crates/openshell-driver-podman/NETWORKING.md b/crates/openshell-driver-podman/NETWORKING.md index 3e52cccd3c..be86ac335e 100644 --- a/crates/openshell-driver-podman/NETWORKING.md +++ b/crates/openshell-driver-podman/NETWORKING.md @@ -39,8 +39,8 @@ does not share the workload's PID, mount, or network namespaces. ## Troubleshooting Inspect both containers with the same sandbox-ID label, distinguishing -`openshell.io/isolation-role=sandbox` from -`openshell.io/isolation-role=supervisor`. +`openshell.ai/isolation-role=sandbox` from +`openshell.ai/isolation-role=supervisor`. - Sandbox fails its qualification probe: use its log to identify the denied kernel/runtime primitive. Do not add capabilities or disable runtime seccomp. diff --git a/crates/openshell-driver-podman/src/isolation.rs b/crates/openshell-driver-podman/src/isolation.rs index 421ae32757..2524186cbe 100644 --- a/crates/openshell-driver-podman/src/isolation.rs +++ b/crates/openshell-driver-podman/src/isolation.rs @@ -21,8 +21,8 @@ use openshell_sandbox_backend::boundary_protocol::{ }; use serde::{Deserialize, Serialize}; -pub const LABEL_ROLE: &str = "openshell.io/isolation-role"; -pub const WORKLOAD_FILTER: &str = "openshell.io/isolation-role=sandbox"; +pub const LABEL_ROLE: &str = "openshell.ai/isolation-role"; +pub const WORKLOAD_FILTER: &str = "openshell.ai/isolation-role=sandbox"; pub const CHANNEL_ROOT: &str = "/.openshell/channel"; pub const BOOTSTRAP_PATH: &str = "/.openshell/channel/sandbox/bootstrap.json"; pub const RUNTIME_DESCRIPTOR_PATH: &str = "/.openshell/supervisor/runtime-descriptor.json"; diff --git a/crates/openshell-driver-podman/src/watcher.rs b/crates/openshell-driver-podman/src/watcher.rs index ff0d0b12e4..d7364d4f6c 100644 --- a/crates/openshell-driver-podman/src/watcher.rs +++ b/crates/openshell-driver-podman/src/watcher.rs @@ -618,7 +618,7 @@ mod tests { vec![ StubResponse::new( StatusCode::OK, - r#"{"Id":"workload","Name":"workload","State":{"Status":"running","Running":true},"Config":{"Labels":{"openshell.ai/sandbox-id":"test","openshell.io/isolation-role":"sandbox"}}}"#, + r#"{"Id":"workload","Name":"workload","State":{"Status":"running","Running":true},"Config":{"Labels":{"openshell.ai/sandbox-id":"test","openshell.ai/isolation-role":"sandbox"}}}"#, ), StubResponse::new(StatusCode::NOT_FOUND, "missing companion"), StubResponse::new(StatusCode::NO_CONTENT, ""), @@ -651,7 +651,7 @@ mod tests { vec![ StubResponse::new( StatusCode::OK, - r#"{"Id":"workload","Name":"workload","State":{"Status":"running","Running":true},"Config":{"Labels":{"openshell.ai/sandbox-id":"test","openshell.io/isolation-role":"sandbox"}}}"#, + r#"{"Id":"workload","Name":"workload","State":{"Status":"running","Running":true},"Config":{"Labels":{"openshell.ai/sandbox-id":"test","openshell.ai/isolation-role":"sandbox"}}}"#, ), StubResponse::new( StatusCode::OK, diff --git a/crates/openshell-driver-vm/src/lifecycle.rs b/crates/openshell-driver-vm/src/lifecycle.rs index 51977ccef2..f92082d99e 100644 --- a/crates/openshell-driver-vm/src/lifecycle.rs +++ b/crates/openshell-driver-vm/src/lifecycle.rs @@ -18,7 +18,7 @@ use crate::runtime::VmBackend; /// gateway), so a guest cannot self-activate an extension. This contract /// lives with the lifecycle framework that consumes it rather than in the /// shared settings registry. -pub const SANDBOX_EXTENSION_LABEL_PREFIX: &str = "openshell.io/extension."; +pub const SANDBOX_EXTENSION_LABEL_PREFIX: &str = "openshell.ai/extension."; #[derive(Debug, Clone, PartialEq, Eq)] pub enum LaunchAbortReason { diff --git a/e2e/rust/tests/podman_gateway_start.rs b/e2e/rust/tests/podman_gateway_start.rs index 7e159ffa78..2dee7c333e 100644 --- a/e2e/rust/tests/podman_gateway_start.rs +++ b/e2e/rust/tests/podman_gateway_start.rs @@ -55,7 +55,7 @@ fn sandbox_container_running(sandbox_name: &str) -> Result { "--filter", MANAGED_BY_LABEL_FILTER, "--filter", - "label=openshell.io/isolation-role=sandbox", + "label=openshell.ai/isolation-role=sandbox", "--filter", ]) .arg(sandbox_name_filter) diff --git a/e2e/rust/tests/podman_oci_identity.rs b/e2e/rust/tests/podman_oci_identity.rs index c56c700d01..54a5437397 100644 --- a/e2e/rust/tests/podman_oci_identity.rs +++ b/e2e/rust/tests/podman_oci_identity.rs @@ -137,7 +137,7 @@ fn container_id_for_role( role: &str, ) -> Result { let name_filter = format!("label=openshell.ai/sandbox-name={sandbox_name}"); - let role_filter = format!("label=openshell.io/isolation-role={role}"); + let role_filter = format!("label=openshell.ai/isolation-role={role}"); let stdout = run_engine( engine, &[ diff --git a/e2e/with-podman-gateway.sh b/e2e/with-podman-gateway.sh index 97cb750dde..338217453c 100755 --- a/e2e/with-podman-gateway.sh +++ b/e2e/with-podman-gateway.sh @@ -196,7 +196,7 @@ cleanup() { local workload_ids workload_id workload_ids="$(podman_cmd ps -aq --filter "label=openshell.managed=true" \ --filter "label=openshell.ai/sandbox-id=${sandbox_id}" \ - --filter "label=openshell.io/isolation-role=sandbox" 2>/dev/null || true)" + --filter "label=openshell.ai/isolation-role=sandbox" 2>/dev/null || true)" for workload_id in ${workload_ids}; do podman_cmd rm -f "${workload_id}" >/dev/null 2>&1 || true done