marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

plane(1.7): gvisor tarball reachability documented as planned (manual, k3s)

Browse Source 
docs/deployment.md B.1: Substrate's ateom-gvisor worker runs runsc from the
release tarball named in manifests/ate-install/sandboxconfig-gvisor.yaml
(gs://gvisor/releases/nightly/2026-09-02/<arch>/gvisor.tar.zstd, sha256-pinned
per architecture), fetched by the atelet on the node; the node must reach it or
a copied SandboxConfig must name a mirror with the same sha256. The check is the
atelet's fetch line in the worker pod's logs, run by hand on the day k3s exists;
labelled planned until then (design open question 3 stays open).

Gates: docs only; mkdocs build --strict passed with this paragraph present in
the 1.4 gate; no file a test or linter reads changed since the 1.5 gate.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 20:50:14 +02:00
co-authored by Claude Fable 5.1
parent 2afa20e2ea
commit 2cca03c1c0
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+8
View File
@@ -150,6 +150,14 @@ cluster. Everything else below is either a step you take or a code change that i
receiver, TLS passthrough to the Workspaces' Git hosts and the Model's declared hosts.
- Deploy ax (`make deploy AX_IMAGE_REPO=<your registry>` in the ax checkout) **after** B.2.
- Apply a WorkerPool (B.6). Substrate installs none by itself ("no free workers").
- **gVisor on the nodes (planned, checked by hand on the day k3s exists).** Substrate does not use a Kubernetes
`RuntimeClass`: the `ateom-gvisor` worker runs `runsc` itself, from the gVisor release tarball named in
`manifests/ate-install/sandboxconfig-gvisor.yaml` of the Substrate checkout
(`gs://gvisor/releases/nightly/2026-09-02/<arch>/gvisor.tar.zstd`, sha256-pinned per architecture), which
the atelet fetches on the worker node. The node must reach that URL, or a copied `SandboxConfig` must name a
mirrored copy with the same sha256 and the ActorTemplates must name that config. The check is the atelet's
fetch line in `kubectl -n ate-system logs` of the worker pod; it is labelled planned until that log has been
read on a k3s node (plane-on-kubernetes task 1.7, design open question 3).
### B.2 ax's snapshot bucket: `AX_SNAPSHOTS_BUCKET`