fix(tmachine): build and load separate runtime images

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Author: SDAChess

architecture/build.md

@@ -255,6 +255,13 @@ Galaxy release pins in `requirements.yaml` are treated as immutable, including
 any transitive dependency pins. Cache misses with Galaxy enabled reinstall
 the required roles and their dependencies before running playbooks.
 
+The `tests/artifacts.nix` helpers build the CLI, conformance CLI, and sandbox
+with musl, and the gateway and supervisor with GNU. Image assembly stages
+the gateway, sandbox, and supervisor as separate binaries for their respective
+Dockerfiles. The Fedora Podman scenarios import both local runtime images and
+configure the gateway to use them. The Ubuntu Docker scenario takes the sandbox
+binary directly as an input to its VM installation playbook.
+
 ## Python Wheel Packaging
 
 The generated protobuf/gRPC stubs under `python/openshell/_proto/` are gitignored

tests/ansible/roles/openshell_gateway/tasks/podman.yaml

@@ -2,24 +2,32 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ---
-- name: Copy OpenShell supervisor image
+- name: Copy OpenShell runtime images
   become: true
   ansible.builtin.copy:
-    src: "{{ openshell_supervisor_image }}"
-    dest: /var/lib/openshell/supervisor.tar
+    src: "{{ item.src }}"
+    dest: "/var/lib/openshell/{{ item.name }}.tar"
     owner: "{{ openshell_gateway_user }}"
     group: "{{ openshell_gateway_user }}"
     mode: "0600"
+  loop:
+    - name: sandbox
+      src: "{{ openshell_sandbox_image }}"
+    - name: supervisor
+      src: "{{ openshell_supervisor_image }}"
 
-- name: Load OpenShell supervisor image
+- name: Load OpenShell runtime images
   become: true
   become_user: "{{ openshell_gateway_user }}"
   ansible.builtin.command:
     argv:
       - podman
       - load
       - --input
-      - /var/lib/openshell/supervisor.tar
+      - "/var/lib/openshell/{{ item }}.tar"
+  loop:
+    - sandbox
+    - supervisor
   environment:
     HOME: "{{ openshell_gateway_home }}"
     XDG_RUNTIME_DIR: "/run/user/{{ openshell_gateway_uid }}"

tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2

@@ -6,6 +6,7 @@
 socket_path = "{{ openshell_runtime_socket }}"
 default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy = "if_not_present"
+sandbox_runtime_image = "docker.io/openshell/sandbox:tmachine"
 supervisor_image = "docker.io/openshell/supervisor:tmachine"
 network_name = "tmachine"
 health_check_interval_secs = 10

tests/artifacts.nix

@@ -34,7 +34,8 @@ rec {
         -p openshell-sandbox
 
       cargo build --target ${gnuToolchain.target} \
-        -p openshell-gateway
+        -p openshell-gateway \
+        -p openshell-supervisor
     '';
   };
 
@@ -52,6 +53,10 @@ rec {
         target/${gnuToolchain.target}/debug/openshell-gateway \
         deploy/docker/.build/prebuilt-binaries/${dockerArch}/openshell-gateway
 
+      install -D -m 0755 \
+        target/${gnuToolchain.target}/debug/openshell-supervisor \
+        deploy/docker/.build/prebuilt-binaries/${dockerArch}/openshell-supervisor
+
       install -D -m 0755 \
         target/${muslToolchain.target}/debug/openshell-sandbox \
         deploy/docker/.build/prebuilt-binaries/${dockerArch}/openshell-sandbox
@@ -70,6 +75,13 @@ rec {
         --tag openshell/supervisor:tmachine \
         .
 
+      docker build \
+        --platform linux/${dockerArch} \
+        --file deploy/docker/Dockerfile.sandbox \
+        --target sandbox \
+        --tag openshell/sandbox:tmachine \
+        .
+
       mkdir -p artifacts/images
 
       docker save \
@@ -79,6 +91,10 @@ rec {
       docker save \
         --output artifacts/images/openshell-supervisor-tmachine.tar \
         openshell/supervisor:tmachine
+
+      docker save \
+        --output artifacts/images/openshell-sandbox-tmachine.tar \
+        openshell/sandbox:tmachine
     '';
   };
 

tests/config.nix

@@ -69,6 +69,7 @@ let
             openshell_cli_binary = "../target/${muslTarget}/debug/openshell";
             openshell_gateway_binary = "../target/${gnuTarget}/debug/openshell-gateway";
             openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
+            openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
           };
         };
       }
@@ -89,6 +90,7 @@ let
             openshell_cli_binary = "../target/${muslTarget}/debug/openshell";
             openshell_gateway_binary = "../target/${gnuTarget}/debug/openshell-gateway";
             openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
+            openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
           };
         };
       }