NVIDIA · drew · Aug 26, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
@@ -69,28 +69,14 @@ mise run helm:skaffold:dev
 mise run helm:skaffold:run
 ```
 
-**Supervisor sidecar topology** (build once and leave running):
-```bash
-mise run helm:skaffold:run:sidecar
-```
-
-**Supervisor sidecar topology with TLS/mTLS enabled** (build once and leave running):
-```bash
-mise run helm:skaffold:run:sidecar-mtls
-```
-
-Both commands build the `gateway` and `supervisor` images and deploy the OpenShell Helm
-chart. The sidecar profile renders an `openshell-network-init` init container for
-nftables setup and an `openshell-supervisor-network` runtime sidecar for proxying.
-Binary-aware policy mode runs that sidecar as UID 0 with `SYS_PTRACE` and
-`DAC_READ_SEARCH`; relaxed mode can run it as the configured proxy UID, which
-must be at least `1000` and distinct from the workload UID. The
-sidecar-mTLS profile reuses `ci/values-sidecar.yaml` and restores
-`server.disableTls=false` inline for Skaffold. The `pkiInitJob` hook (a pre-install
-Job that runs `openshell-gateway generate-certs`) generates mTLS secrets on first
-install. The default Skaffold values export gateway and Kubernetes-driver traces to
-the collector service installed by `helm:k3s:create`. Envoy Gateway opt-in; see the
-Optional Add-ons section below.
+The Skaffold flow builds distinct `gateway`, `sandbox`, and `supervisor` images
+and deploys the OpenShell Helm chart. The Kubernetes compute driver places
+`openshell-sandbox` in the workload Pod and `openshell-supervisor` in a separate
+Pod, then creates their authenticated channel and NetworkPolicy fence. The
+`pkiInitJob` hook (a pre-install Job that runs `openshell-gateway generate-certs`)
+generates mTLS secrets on first install. The default Skaffold values export
+gateway and Kubernetes-driver traces to the collector service installed by
+`helm:k3s:create`. Envoy Gateway is opt-in; see the Optional Add-ons section.
 
 The gateway Service uses ClusterIP. Access is via Envoy Gateway (port `8080`) or
 the unified local forwarding task:
@@ -102,9 +88,9 @@ mise run helm:k3s:forward
 The task forwards OTLP/gRPC to `http://127.0.0.1:4317` and the trace UI to
 `http://127.0.0.1:18888`. When Skaffold has deployed a Kubernetes gateway, it
 also forwards the gateway to `http://127.0.0.1:8090`; otherwise it continues
-with the collector ports only. A successful plaintext `helm:skaffold:run` or
-`helm:skaffold:run:sidecar` registers the gateway under the worktree-specific
-k3d cluster name and selects it as the active gateway. Keep the forwarding
+with the collector ports only. A successful plaintext `helm:skaffold:run`
+registers the gateway under the worktree-specific k3d
+cluster name and selects it as the active gateway. Keep the forwarding
 task running while using those endpoints.
 
 ### Viewing local traces
@@ -134,8 +120,7 @@ create the Secret named `openshell-ha-pg` with a `uri` key, then run
 ### TLS behaviour
 
 `ci/values-skaffold.yaml` sets `server.disableTls: true`, so Skaffold-based deploys run
-plaintext by default. To test sidecar topology with TLS enabled, use
-`mise run helm:skaffold:run:sidecar-mtls`.
+plaintext by default. Override `server.disableTls=false` to exercise TLS/mTLS.
 
 | Mode | `server.disableTls` | Gateway scheme |
 |------|---------------------|----------------|
@@ -188,12 +173,6 @@ openshell sandbox list --gateway-endpoint https://localhost:8090
 mise run helm:skaffold:delete
 ```
 
-For a sidecar-profile deployment:
-
-```bash
-mise run helm:skaffold:delete:sidecar
-```
-
 ### Delete the cluster entirely
 
 ```bash
@@ -320,7 +299,6 @@ for dependencies still declared in `Chart.yaml`.
 | `deploy/helm/openshell/ci/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
 | `deploy/helm/openshell/ci/values-high-availability.yaml` | HA test overlay (`replicaCount: 2` with external PostgreSQL Secret) |
 | `deploy/helm/openshell/ci/values-keycloak.yaml` | Keycloak OIDC overlay |
-| `deploy/helm/openshell/ci/values-sidecar.yaml` | Supervisor sidecar topology overlay for Kubernetes e2e/dev |
 | `deploy/helm/openshell/ci/values-spire.yaml` | SPIFFE/SPIRE provider token grant overlay |
 | `deploy/helm/openshell/ci/values-spire-stack.yaml` | SPIRE hardened chart values for local dev |
 | `deploy/helm/openshell/ci/values-tls-disabled.yaml` | Lint-only: TLS + auth disabled (reverse-proxy edge termination) |

@@ -15,7 +15,7 @@ The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft,
 
 SBOMs are **release artifacts only** -- they are generated on demand and not committed to the repository. Output lands in `deploy/sbom/output/` (gitignored).
 
-Pushed gateway and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
+Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
 
 ## Prerequisites
 

@@ -92,7 +92,7 @@ Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${h
 `Release Dev` publishes two chart versions for every dev build (see `.github/actions/release-helm-oci/action.yml:89-102`):
 
 - `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` — floating, overwritten on every main push.
-- `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls `ghcr.io/nvidia/openshell/gateway:<sha>` and `:supervisor:<sha>`.
+- `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls the matching `gateway`, `sandbox`, and `supervisor` images.
 
 To smoke-test the chart for a specific dev build, dispatch `Release Dev` on the branch first, then run the kind canary steps locally pointed at the SHA-pinned chart (see "Local kind reproduction" below). The release-canary workflow itself does not currently expose `chart_version` / `image_tag` inputs.
 

@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  interpreter:
+    description: Expected ELF program interpreter, "none" for static, or "skip"
+    required: false
+    default: skip
 
 runs:
   using: composite
@@ -71,11 +75,24 @@ runs:
       env:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_INTERPRETER: ${{ inputs.interpreter }}
       run: |
+        binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
         # Confirm the binary runs and reports the expected name.
-        target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} --version | grep -q "^${INPUTS_BINARY} "
+        "$binary" --version | grep -q "^${INPUTS_BINARY} "
         # Confirm Syft can decode the embedded cargo-auditable metadata.
-        SYFT_CHECK_FOR_APP_UPDATE=false syft file:target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        if [ "$INPUTS_INTERPRETER" != skip ]; then
+          actual_interpreter="$(readelf -l "$binary" | sed -n 's/.*Requesting program interpreter: \(.*\)]/\1/p')"
+          expected_interpreter="$INPUTS_INTERPRETER"
+          if [ "$expected_interpreter" = none ]; then
+            expected_interpreter=""
+          fi
+          if [ "$actual_interpreter" != "$expected_interpreter" ]; then
+            echo "error: expected interpreter '${expected_interpreter:-<none>}', got '${actual_interpreter:-<none>}'" >&2
+            exit 1
+          fi
+        fi
 
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

@@ -8,6 +8,10 @@ inputs:
   results:
     description: JSON-encoded GitHub Actions needs context
     required: true
+  allowed-skipped-jobs:
+    description: Comma-separated job IDs that may be skipped but must not fail
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -16,12 +20,20 @@ runs:
       shell: bash
       env:
         JOB_RESULTS: ${{ inputs.results }}
+        ALLOWED_SKIPPED_JOBS: ${{ inputs.allowed-skipped-jobs }}
       run: |
         set -euo pipefail
         failures="$(
-          jq -r '
+          jq -r --arg allowed_skipped "$ALLOWED_SKIPPED_JOBS" '
+            ($allowed_skipped | split(",") | map(select(length > 0))) as $allowed_skipped_jobs
+            |
             to_entries[]
+            | . as $job
             | select(.value.result != "success")
+            | select(
+                .value.result != "skipped"
+                or ($allowed_skipped_jobs | index($job.key)) == null
+              )
             | "\(.key) concluded \(.value.result)"
           ' <<< "$JOB_RESULTS"
         )"

@@ -14,7 +14,7 @@ inputs:
   images:
     description: Space-separated OpenShell image components to load
     required: false
-    default: gateway supervisor
+    default: gateway sandbox supervisor
   registry:
     description: Container registry and namespace
     required: false
@@ -71,7 +71,7 @@ runs:
         set -euo pipefail
         for component in $IMAGE_COMPONENTS; do
           case "$component" in
-            gateway | supervisor) ;;
+            gateway | sandbox | supervisor) ;;
             *) echo "ERROR: unsupported OpenShell image component: $component" >&2; exit 1 ;;
           esac
           image="${REGISTRY}/${component}:${IMAGE_TAG}"

@@ -179,8 +179,8 @@ jobs:
           tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
           cargo build -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
-          cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
-          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
+          cargo build -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor
 
       - name: Verify selective gateway compute-driver builds
         run: |
@@ -197,12 +197,12 @@ jobs:
 
       - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
         run: |
-          cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots
-          if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
+          cargo check -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots
+          if cargo tree -p openshell-supervisor -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
             echo "ERROR: webpki-roots found in system CA roots build" >&2
             exit 1
           fi
-          if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
+          if cargo tree -p openshell-supervisor -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
             echo "ERROR: webpki-root-certs found in system CA roots build" >&2
             exit 1
           fi