fix(onboard): omit Docker-only Podman config by ericksoa · Pull Request #8415 · NVIDIA/NemoClaw

ericksoa · 2026-08-06T00:41:44Z

Summary

Portable onboarding selected the Podman driver but wrote the Docker-only supervisor_bin field into [openshell.drivers.podman]. OpenShell 0.0.85 rejected that table before the gateway could start.

This change omits supervisor_bin for Podman and preserves the existing Docker configuration. It follows the portable runtime override restored by #8408.

Changes

Omit supervisor_bin from the generated Podman driver table.
Preserve supervisor_bin in the generated Docker driver table.
Install pinned OpenShell 0.0.85 in the portable-profile E2E workflow.
Start the real rootless Podman gateway and fail if OpenShell rejects the generated configuration or exits.
Trigger the portable-profile workflow when its gateway-proof or pinned-runtime helpers change.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: The change repairs generated configuration for an existing hidden experimental profile. No supported public command, default, or workflow changed.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Aaron Erickson reviewed the driver-schema boundary. The exact-head rootless runner installs pinned OpenShell 0.0.85 and starts the real Podman gateway.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: Omits a Docker-only field from the generated configuration for an existing hidden experimental profile and adds pinned OpenShell E2E evidence. No supported public command, default, or workflow changed.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: E2E / Portable Profile passed on 91daf0836; npm run typecheck and npm run test:e2e-phases:check passed locally.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: CI / Pull Request passed on 91daf0836.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

copy-pr-bot · 2026-08-06T00:41:48Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

coderabbitai · 2026-08-06T00:41:52Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7307e0e0-0aa2-4055-89e5-0dff5ca8c565

📥 Commits

Reviewing files that changed from the base of the PR and between 91daf08 and 9403b99.

📒 Files selected for processing (2)

.github/workflows/portable-profile-e2e.yaml
test/e2e/support/e2e-workflow.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/portable-profile-e2e.yaml

📝 Walkthrough

Walkthrough

The PR updates portable-profile gateway configuration for Podman, adds pinned Podman startup verification, integrates the check into the rootless Linux E2E test, and updates workflow and semantic-phase handling.

Changes

Portable Podman gateway validation

Layer / File(s)	Summary
Gateway driver configuration contract `src/lib/onboard/docker-driver-gateway-config.ts`, `src/lib/onboard/docker-driver-gateway-env.test.ts`	`supervisor_bin` is emitted only for Docker. The portable profile test verifies that Podman configuration omits the field.
Pinned Podman startup proof `test/e2e/live/portable-profile-gateway-proof.ts`, `test/e2e/live/portable-profile-rootless-linux.test.ts`	The E2E test prepares gateway binaries, sandbox resolution, port 8080, and local TLS. The new helper verifies Podman readiness, stability, startup errors, timeouts, and cleanup.
E2E workflow and progress policy `.github/workflows/portable-profile-e2e.yaml`, `tools/e2e/check-semantic-phases.mts`, `test/e2e/support/e2e-workflow.test.ts`	The workflow tracks gateway-proof changes, installs pinned OpenShell non-interactively, exposes its local binary directory, and validates workflow triggers and the helper’s progress path.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PortableProfileTest
  participant verifyPinnedPodmanGatewayStarts
  participant PinnedPodmanGateway
  PortableProfileTest->>verifyPinnedPodmanGatewayStarts: provide gateway binary and environment
  verifyPinnedPodmanGatewayStarts->>PinnedPodmanGateway: start with merged environment
  PinnedPodmanGateway-->>verifyPinnedPodmanGatewayStarts: emit startup output and driver state
  verifyPinnedPodmanGatewayStarts-->>PortableProfileTest: report readiness or failure
  verifyPinnedPodmanGatewayStarts->>PinnedPodmanGateway: send SIGTERM during cleanup

Possibly related PRs

NVIDIA/NemoClaw#8376: Extends the portable-profile gateway configuration and E2E coverage introduced by this PR.
NVIDIA/NemoClaw#8408: Shares the portable-profile rootless Podman E2E test and workflow.

Suggested labels: bug-fix, area: onboarding, area: e2e, area: ci

Suggested reviewers: senthilr-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: omitting the Docker-only field from Podman configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/portable-podman-supervisor-bin

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-08-06T00:42:29Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 9403b99 in the fix/portable-podman-... branch remains at 96%, unchanged from commit 422fe95 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 9403b99 in the fix/portable-podman-... branch remains at 82%, unchanged from commit 422fe95 in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` 422fe95	`fix/portable-podman-...` 9403b99	+/-
`src/lib/actions...air-approval.ts`	90%	89%	-1%
`src/lib/sandbox...rce-identity.ts`	87%	87%	0%
`src/lib/tunnel/services.ts`	80%	80%	0%

_{Updated August 06, 2026 02:13 UTC}

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

github-actions · 2026-08-06T00:46:08Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 2 warnings · 0 suggestions
Model comparison: normalized findings differ; normalized terminology decisions differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 2 more warnings, the same number of suggestions.

3 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

gateway-proof at .github/workflows/portable-profile-e2e.yaml:20: selected only by the second-opinion lane as justified.
pinned at .github/workflows/portable-profile-e2e.yaml:67: selected only by the second-opinion lane as established.
portable at src/lib/onboard/docker-driver-gateway-config.ts:86: selected only by the second-opinion lane as established.

3 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

full-e2e: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
token-rotation: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
network-policy: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

established — Docker-only at src/lib/onboard/docker-driver-gateway-config.ts:85: Keep Docker-only for the driver-specific schema distinction.
established — pinned OpenShell at .github/workflows/portable-profile-e2e.yaml:67: Keep pinned OpenShell for the repository-selected release.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, onboard-repair, onboard-resume

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

fix(onboard): omit Docker-only Podman config

5892061

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(e2e): launch pinned portable gateway

ea89db5

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added 3 commits August 5, 2026 17:51

test(e2e): normalize portable gateway logs

07f63c9

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(e2e): isolate portable gateway observer

1d952e8

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(e2e): trigger portable gateway proof

91daf08

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa self-assigned this Aug 6, 2026

ericksoa marked this pull request as ready for review August 6, 2026 01:37

test(e2e): cover portable proof inputs

9403b99

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa merged commit a632296 into main Aug 6, 2026
97 of 102 checks passed

ericksoa deleted the fix/portable-podman-supervisor-bin branch August 6, 2026 02:29

github-actions Bot added the v0.0.104 Release target label Aug 6, 2026

sandl99 mentioned this pull request Aug 6, 2026

Portable Podman sandbox cannot recover after a new user session #8441

Open

hulynn mentioned this pull request Aug 6, 2026

[Ubuntu 26.04][Onboard] onboard --experimental-profile portable fails preflight with "spawnSync docker ENOENT" on Podman-only host (no docker client) #8453

Open

Navigation Menu

Uh oh!

fix(onboard): omit Docker-only Podman config - #8415

fix(onboard): omit Docker-only Podman config#8415
ericksoa merged 6 commits into
mainfrom
fix/portable-podman-supervisor-bin

ericksoa commented Aug 6, 2026 •

edited

Loading

Uh oh!

copy-pr-bot Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-code-quality Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ericksoa commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Uh oh!

copy-pr-bot Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-code-quality Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ericksoa commented Aug 6, 2026 •

edited

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

github-code-quality Bot commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading