feat(docker): project CDI spec directories and record the CDI context

For GPU sandboxes, record the selected CDI device IDs and the spec
directories the Docker daemon currently reports in the protected
boundary configuration, and project those directories read-only under
/.openshell/cdi-specs so the sandbox runtime can resolve the same
specs. User mounts, image volumes and the workspace cannot overlap the
projection path.

Before creating the sandbox, probe each directory with a stopped
container from the prepared workload image and skip directories that
do not exist on the Docker host. Probes are bounded by a timeout,
labelled for cleanup with their sandbox, and remove their anonymous
volumes. A probe that cannot be removed no longer fails creation.

With resource admission enabled, containers with a CDI context must
keep a CDI device request matching the recorded selection and one
read-only, non-recursive, private bind per recorded directory.
Admission reads the bootstrap only for CDI containers, and boundary
files are replaced atomically so it never observes a partial write.

The Docker e2e gateway enables resource admission in GPU mode.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

crates/openshell-driver-docker/src/isolation.rs

@@ -11,6 +11,7 @@ use std::collections::{BTreeMap, HashMap};
 use std::net::IpAddr;
 use std::path::PathBuf;
 
+use openshell_core::cdi::CdiContext;
 use openshell_isolation_interface::contract::{
     BackendError, OuterFenceGuarantee, OuterFenceGuarantees, ResolvedWorkloadIdentity,
 };
@@ -70,6 +71,7 @@ pub struct DockerBoundarySpec {
     pub container_id: String,
     pub image_identity: String,
     pub gpu_requested: bool,
+    pub cdi_context: Option<CdiContext>,
     pub listener_socket: PathBuf,
     pub control_socket: PathBuf,
     pub sandbox_tls: SandboxTlsServerConfig,
@@ -118,7 +120,7 @@ impl DockerBoundarySpec {
                 },
                 resource_claims: resource_claims.clone(),
                 resource_claim_files: BTreeMap::new(),
-                cdi_context: None,
+                cdi_context: self.cdi_context,
                 workload_identity: self.workload_identity.clone(),
                 outer_fence: outer_fence.clone(),
                 child_env: self.child_env,
@@ -188,6 +190,13 @@ mod tests {
             container_id: "sha256:container".to_string(),
             image_identity: "sha256:image".to_string(),
             gpu_requested: true,
+            cdi_context: Some(CdiContext::new(
+                vec!["nvidia.com/gpu=0".to_string()],
+                vec![openshell_core::cdi::CdiSpecDirectory::new(
+                    openshell_core::cdi::cdi_spec_mount_path(0),
+                    "/var/run/cdi",
+                )],
+            )),
             listener_socket: PathBuf::from("/run/openshell/boundary/control.sock"),
             control_socket: PathBuf::from("/host/control.sock"),
             sandbox_tls: SandboxTlsServerConfig {
@@ -224,6 +233,15 @@ mod tests {
             provisioned.runtime_descriptor.resource_claims[GPU_RESOURCE_CLAIM],
             "true"
         );
+        assert_eq!(
+            provisioned
+                .boundary_config
+                .cdi_context
+                .as_ref()
+                .unwrap()
+                .selected_devices,
+            ["nvidia.com/gpu=0"]
+        );
         assert_eq!(
             provisioned.boundary_config.outer_fence,
             provisioned.runtime_descriptor.outer_fence