fix(tmachine): use local runtime images for Docker

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Author: SDAChess

architecture/build.md

@@ -258,9 +258,8 @@ the required roles and their dependencies before running playbooks.
 The `tests/artifacts.nix` helpers build the CLI, conformance CLI, and sandbox
 with musl, and the gateway and supervisor with GNU. Image assembly stages
 the gateway, sandbox, and supervisor as separate binaries for their respective
-Dockerfiles. The Fedora Podman scenarios import both local runtime images and
-configure the gateway to use them. The Ubuntu Docker scenario takes the sandbox
-binary directly as an input to its VM installation playbook.
+Dockerfiles. The Ubuntu Docker and Fedora Podman scenarios import both local
+runtime images and configure the gateway to use them.
 
 ## Python Wheel Packaging
 

tests/ansible/playbooks/openshell.yaml

@@ -9,13 +9,6 @@
     - name: Wait for SSH
       ansible.builtin.wait_for_connection:
 
-    - name: Create OpenShell library directory
-      become: true
-      ansible.builtin.file:
-        path: /usr/local/libexec/openshell
-        state: directory
-        mode: "0755"
-
     - name: Install OpenShell CLI
       become: true
       ansible.builtin.copy:
@@ -29,11 +22,3 @@
         src: "{{ openshell_gateway_binary }}"
         dest: /usr/local/bin/openshell-gateway
         mode: "0755"
-
-    - name: Install OpenShell sandbox supervisor
-      become: true
-      ansible.builtin.copy:
-        src: "{{ openshell_sandbox_binary }}"
-        dest: /usr/local/libexec/openshell/openshell-sandbox
-        mode: "0755"
-      when: openshell_sandbox_binary is defined

tests/ansible/roles/openshell_gateway/tasks/docker.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+---
+- name: Copy OpenShell runtime images
+  become: true
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "/var/lib/openshell/{{ item.name }}.tar"
+    owner: "{{ openshell_gateway_user }}"
+    group: "{{ openshell_gateway_user }}"
+    mode: "0600"
+  loop:
+    - name: sandbox
+      src: "{{ openshell_sandbox_image }}"
+    - name: supervisor
+      src: "{{ openshell_supervisor_image }}"
+
+- name: Load OpenShell runtime images
+  become: true
+  ansible.builtin.command:
+    argv:
+      - docker
+      - load
+      - --input
+      - "/var/lib/openshell/{{ item }}.tar"
+  loop:
+    - sandbox
+    - supervisor

tests/ansible/roles/openshell_gateway/tasks/main.yaml

@@ -14,6 +14,10 @@
     group: "{{ openshell_gateway_user }}"
     mode: "0700"
 
+- name: Prepare Docker gateway
+  ansible.builtin.include_tasks: docker.yaml
+  when: openshell_gateway_driver == "docker"
+
 - name: Prepare Podman gateway
   ansible.builtin.include_tasks: podman.yaml
   when: openshell_gateway_driver == "podman"

tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2

@@ -8,5 +8,6 @@ default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy = "if_not_present"
 sandbox_label = "tmachine"
 grpc_endpoint = "http://host.openshell.internal:17670"
-supervisor_bin = "/usr/local/libexec/openshell/openshell-sandbox"
+sandbox_runtime_image = "docker.io/openshell/sandbox:tmachine"
+supervisor_image = "docker.io/openshell/supervisor:tmachine"
 {% endblock %}

tests/config.nix

@@ -48,7 +48,8 @@ let
           inputs = {
             openshell_cli_binary = "../target/${muslTarget}/debug/openshell";
             openshell_gateway_binary = "../target/${gnuTarget}/debug/openshell-gateway";
-            openshell_sandbox_binary = "../target/${muslTarget}/debug/openshell-sandbox";
+            openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
+            openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
           };
         };
       }