From facd02e71bcd31b052cb83725a977f742529e98a Mon Sep 17 00:00:00 2001 From: Wayne Sun Date: Tue, 30 Jun 2026 14:38:50 -0400 Subject: [PATCH] fix: pin supervisor image to match openshell CLI version The OpenShell gateway defaults to pulling ghcr.io/nvidia/openshell/supervisor:latest for the sandbox supervisor binary. When NVIDIA released v0.0.73 (2026-06-30 15:31 UTC), the :latest tag was re-pointed to a supervisor that drops the Linux capability bounding set (NVIDIA/OpenShell#2001), which crashes with EINVAL in rootless Podman on GitHub Actions runners. Write a gateway.toml that pins supervisor_image to the version from openshell-version.sh so the supervisor always matches the installed gateway and is immune to upstream :latest tag changes. Fixes #2792 Assisted-by: Claude (investigation, fix) Signed-off-by: Wayne Sun --- .github/workflows/functional-tests.yml | 8 ++++++++ action.yml | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/.github/workflows/functional-tests.yml b/.github/workflows/functional-tests.yml index 9922f8e20..57dedaf45 100644 --- a/.github/workflows/functional-tests.yml +++ b/.github/workflows/functional-tests.yml @@ -163,8 +163,16 @@ jobs: - name: Configure OpenShell gateway if: steps.changes.outputs.relevant != 'false' run: | + source .github/scripts/openshell-version.sh mkdir -p "$HOME/.config/openshell" echo "OPENSHELL_BIND_ADDRESS=0.0.0.0" > "$HOME/.config/openshell/gateway.env" + cat > "$HOME/.config/openshell/gateway.toml" << EOF + [openshell] + version = 1 + + [openshell.gateway] + supervisor_image = "ghcr.io/nvidia/openshell/supervisor:${OPENSHELL_VERSION}" + EOF - name: Install OpenShell CLI if: steps.changes.outputs.relevant != 'false' diff --git a/action.yml b/action.yml index 2c8df3fb7..121c8fad5 100644 --- a/action.yml +++ b/action.yml @@ -269,10 +269,18 @@ runs: - name: Configure OpenShell gateway shell: bash run: | + source "$GITHUB_ACTION_PATH/.github/scripts/openshell-version.sh" mkdir -p $HOME/.config/openshell/ cat > $HOME/.config/openshell/gateway.env << EOF OPENSHELL_BIND_ADDRESS=0.0.0.0 EOF + cat > $HOME/.config/openshell/gateway.toml << EOF + [openshell] + version = 1 + + [openshell.gateway] + supervisor_image = "ghcr.io/nvidia/openshell/supervisor:${OPENSHELL_VERSION}" + EOF - name: Install OpenShell CLI shell: bash