chore(stack): merge isolated TLS and Docker test fixes

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-driver-docker/src/tests.rs

@@ -2100,7 +2100,14 @@ fn build_container_create_body_replaces_inherited_cmd_with_boundary_mode() {
         Some(&vec!["apparmor=unconfined".to_string()])
     );
     assert_eq!(host_config.network_mode.as_deref(), Some("none"));
-    assert!(host_config.extra_hosts.is_none());
+    assert_eq!(
+        host_config.extra_hosts,
+        Some(vec![
+            "host.openshell.internal:host-gateway".to_string(),
+            "host.docker.internal:host-gateway".to_string(),
+        ]),
+        "networkless workloads still receive stable host aliases"
+    );
     assert!(create_body.networking_config.is_none());
 }
 

crates/openshell-isolation-interface/src/remote.rs

@@ -177,6 +177,7 @@ fn validate_tcp_address(address: std::net::SocketAddr) -> Result<(), BackendErro
 }
 
 fn tls_client_config(ca_certificate_pem: &str) -> Result<rustls::ClientConfig, BackendError> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     let certificates = rustls_pemfile::certs(&mut ca_certificate_pem.as_bytes())
         .collect::<Result<Vec<_>, _>>()
         .map_err(|error| {

crates/openshell-sandbox/src/boundary_server.rs

@@ -1674,6 +1674,7 @@ mod linux {
         certificate_chain_path: &Path,
         private_key_path: &Path,
     ) -> io::Result<rustls::ServerConfig> {
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let certificate_bytes = std::fs::read(certificate_chain_path)?;
         let certificates = rustls_pemfile::certs(&mut certificate_bytes.as_slice())
             .collect::<Result<Vec<_>, _>>()?;

crates/openshell-supervisor-network/src/l7/tls.rs

@@ -100,6 +100,7 @@ impl SandboxCa {
     /// Load a durable CA while preserving the exact certificate bytes supplied
     /// by the provisioner for boundary launch replay.
     pub fn from_pem(certificate_pem: &str, private_key_pem: &str) -> Result<Self> {
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let ca_key = KeyPair::from_pem(private_key_pem)
             .into_diagnostic()
             .wrap_err("parse proxy CA private key")?;