diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 6ff9b04..454cc73 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -63,7 +63,7 @@ release: Unpacking the archive by hand instead? The binary is unsigned — run `xattr -d com.apple.quarantine openshell-driver-applecontainer` after extracting. - Compatibility: OpenShell 0.0.96 – 0.0.111, apple/container 1.2.0 – 1.2.2, Apple silicon macOS 26. + Compatibility: OpenShell 0.0.96 – 0.0.113, apple/container 1.2.0 – 1.3.0, Apple silicon macOS 26. `openshell sandbox stop`/`start` are unimplemented by this driver. # Published to https://github.com/vyncint/homebrew-tap as a cask, not a formula: diff --git a/CHANGELOG.md b/CHANGELOG.md index 0f24072..bc9ba97 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,25 @@ All notable changes to this project are documented here. The format follows ## [Unreleased] +### Changed + +- **Compatibility verified against OpenShell 0.0.113 and apple/container 1.3.0** (previously + 0.0.111 and 1.2.2). No driver change was needed. `compute_driver.proto` is byte-identical + between 0.0.111 and 0.0.113. apple/container 1.3.0 is a minor release with one breaking CLI + change — `--scheme auto` removed for image operations — which this driver never used; its + `tmpfsMounts()` refactor and new default Kata kernel also proved harmless here. +- Checked live on the reference machine against a baseline captured on 1.2.2 first: create → + Ready → `exec` (kernel 6.18.15, workload uid 998), policy still blocking egress, a `tmpfs` + driver-config mount (`tmpfs on /scratch type tmpfs (rw,relatime)`, writable), restart adoption, + and clean delete. Every result matched the baseline. An already-configured guest kernel + survives the upgrade, so `ensureKernel()` correctly skips re-downloading — this machine stayed + on `vmlinux-6.18.15-186`. +- Note for **fresh** installs on apple/container 1.3.0: `setup` runs + `container system kernel set --recommended`, and 1.3.0 points that at Kata 3.32.0, which + supplies `vmlinux-6.18.35-197-debug`. Newer than before, and a *debug* build — upstream's + choice, not ours, but worth knowing before comparing timings between an upgraded machine and a + freshly installed one. + ## [0.2.12] - 2026-08-22 ### Fixed diff --git a/README.md b/README.md index 20d29a5..4be9d5f 100644 --- a/README.md +++ b/README.md @@ -54,7 +54,7 @@ Two commands manage the stack's lifecycle, mirroring apple/container's own openshell-driver-applecontainer update # update the driver to the latest release, then re-setup openshell-driver-applecontainer update --all # also update OpenShell (brew) and apple/container openshell-driver-applecontainer update --version vX.Y.Z # pin a specific driver release -openshell-driver-applecontainer update --all --openshell-version 0.0.111 --container-version 1.2.2 +openshell-driver-applecontainer update --all --openshell-version 0.0.113 --container-version 1.3.0 # pin the prerequisites too (reproducible / rollback) openshell-driver-applecontainer cleanup # remove the driver service + gateway wiring (data kept) @@ -213,7 +213,7 @@ source of truth. See [docs/architecture.md](docs/architecture.md). | anything looks broken | re-run `openshell-driver-applecontainer setup` — it repairs all wiring | | `openshell status` fails | `brew services info openshell`; gateway log: `/opt/homebrew/var/log/openshell/openshell-gateway.err.log` | | sandbox stuck / failed | driver log: `~/Library/Logs/openshell-driver-applecontainer.log`; failed sandboxes carry the guest console tail in their status | -| `default kernel not configured for architecture` | apple/container has no guest kernel (a fresh install, or one whose data was deleted). `setup` installs one automatically; if its download failed, retry `container system kernel set --recommended` | +| `default kernel not configured for architecture` | apple/container has no guest kernel (a fresh install, or one whose data was deleted). `setup` installs one automatically; if its download failed, retry `container system kernel set --recommended`. On apple/container 1.3.0 that resolves to Kata 3.32.0's `vmlinux-6.18.35-197-debug`; an existing kernel is left alone, so upgraded machines keep the one they had | | slow first create | the base image (~2.6 GB) is pulling; `setup` without `--no-pull` pre-pulls it | ## Configuration reference @@ -362,8 +362,9 @@ recon in `docs/CONTRACT.md`. | driver | OpenShell | apple/container | host | |---|---|---|---| -| v0.2.12+ | contract derived from v0.0.96 (`5541398ccbda`); **verified against 0.0.96, 0.0.97 and 0.0.111** | **1.2.0 and 1.2.2** | Apple silicon, macOS 26 | -| v0.1.x – v0.2.11 | contract derived from v0.0.96; verified against 0.0.96 and 0.0.97 | 1.2.0 | Apple silicon, macOS 26 | +| v0.2.13+ | contract derived from v0.0.96 (`5541398ccbda`); **verified against 0.0.96, 0.0.97, 0.0.111 and 0.0.113** | **1.2.0, 1.2.2 and 1.3.0** | Apple silicon, macOS 26 | +| v0.2.12 | same contract; verified against 0.0.96, 0.0.97 and 0.0.111 | 1.2.0 and 1.2.2 | Apple silicon, macOS 26 | +| v0.1.x – v0.2.11 | same contract; verified against 0.0.96 and 0.0.97 | 1.2.0 | Apple silicon, macOS 26 | **Newer gateways stay compatible by design, not by luck.** The contract grew four RPCs after v0.0.96 — `GetGatewayListenerRequirements`, `StartSandbox`, `EnsureWorkspace`, `DeleteWorkspace` — @@ -372,7 +373,7 @@ and this driver implements none of them. Three are explicitly optional: the gate in `compute/mod.rs`), which is upstream's stated forward-compatibility contract for independently versioned external drivers. `StopSandbox`/`StartSandbox` are the exception, and are reached only by an explicit `openshell sandbox stop`/`start`, or by lifecycle sweeps a driver opts into with -the `gateway_manages_lifecycle` capability, which this driver does not advertise. So on 0.0.111 +the `gateway_manages_lifecycle` capability, which this driver does not advertise. So on 0.0.113 everything works except those two commands, which fail with a clear message rather than damaging anything. @@ -389,8 +390,8 @@ matching tag is unpublished the driver falls back to the pinned one rather than Pin the whole stack for a reproducible install (or to roll back a bad upstream release): ```sh -curl -LsSf …/install.sh | sh -s -- --version v0.2.12 --openshell-version 0.0.111 --container-version 1.2.2 -openshell-driver-applecontainer update --all --openshell-version 0.0.111 --container-version 1.2.2 +curl -LsSf …/install.sh | sh -s -- --version v0.2.13 --openshell-version 0.0.113 --container-version 1.3.0 +openshell-driver-applecontainer update --all --openshell-version 0.0.113 --container-version 1.3.0 ``` ## Install from a release (manual) diff --git a/STATUS.md b/STATUS.md index ac380d2..5d3f45f 100644 --- a/STATUS.md +++ b/STATUS.md @@ -3,8 +3,8 @@ Single source of truth for milestone state. Updated at every milestone boundary. Pinned upstream: OpenShell **v0.0.96** (`5541398ccbda05fd951e08e5741b9ca090717f3a`). -Verified against OpenShell 0.0.96, 0.0.97 and 0.0.111. -Host: Apple silicon, macOS 26.6, apple/container 1.2.0 and 1.2.2, Go 1.26.6. +Verified against OpenShell 0.0.96, 0.0.97, 0.0.111 and 0.0.113. +Host: Apple silicon, macOS 26.6, apple/container 1.2.0, 1.2.2 and 1.3.0, Go 1.26.6. | Milestone | State | Notes | |---|---|---| diff --git a/docs/CONTRACT.md b/docs/CONTRACT.md index f3c9f4d..8d31971 100644 --- a/docs/CONTRACT.md +++ b/docs/CONTRACT.md @@ -3,14 +3,15 @@ Everything below was derived by reading NVIDIA/OpenShell at tag **v0.0.96** (commit `5541398ccbda05fd951e08e5741b9ca090717f3a`). File:line references are into that tree. -> **The upstream contract has grown since.** As of OpenShell v0.0.111 it adds four RPCs — +> **The upstream contract has grown since.** As of OpenShell v0.0.113 it adds four RPCs — > `GetGatewayListenerRequirements`, `StartSandbox`, `EnsureWorkspace`, `DeleteWorkspace` — plus > `GetCapabilitiesResponse.gateway_manages_lifecycle` and `DriverSandboxSpec.command` / `.tty`. > This driver implements none of them and remains compatible: the gateway maps `Unimplemented` > to success for the three optional RPCs, and reaches `StopSandbox`/`StartSandbox` only through > the explicit `openshell sandbox stop`/`start` commands or lifecycle sweeps gated on the > `gateway_manages_lifecycle` capability this driver does not advertise. Verified live on -> 0.0.111. The sections below still describe the v0.0.96 baseline this driver was written to. +> 0.0.111 and 0.0.113, whose `compute_driver.proto` are byte-identical. The sections below +> still describe the v0.0.96 baseline this driver was written to. The two contract protos are vendored verbatim under `proto/` (see NOTICE). ## 1. RPC surface (proto/compute_driver.proto, package openshell.compute.v1)