feat(openshell-saw): switch OpenShell images to ODH/quay.io builds - #24
Open
mtalvi wants to merge 1 commit into
Open
feat(openshell-saw): switch OpenShell images to ODH/quay.io builds#24mtalvi wants to merge 1 commit into
mtalvi wants to merge 1 commit into
Conversation
Replace upstream NVIDIA OpenShell gateway/supervisor/CLI images with Red Hat's ODH builds (quay.io/opendatahub/odh-openshell-*, RHAIV pip index) to align with the supported supply chain. Pinned to v0.0.99-rhaiv.0, which resolves the supervisor privilege-dropping issue previously reported against v0.0.96-rhaiv.0. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Ticket:
APPENG-5962
Summary
Replaces the upstream NVIDIA OpenShell images (
ghcr.io/nvidia/openshell/*) and upstream PyPI CLI package with Red Hat's ODH builds (quay.io/opendatahub/odh-openshell-*) and the RHAIV pip index, aligning the pattern with Red Hat's supported supply chain. Values-only change — no template or script changes required.openshell.gatewayImageghcr.io/nvidia/openshell/gateway:0.0.96quay.io/opendatahub/odh-openshell-gateway:v0.0.99-rhaiv.0openshell.supervisorImageghcr.io/nvidia/openshell/supervisor:0.0.96quay.io/opendatahub/odh-openshell-supervisor:v0.0.99-rhaiv.0openshell.version(pip)0.0.960.0.99+rhaiv.0openshell.pipIndexUrl""(PyPI default)https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.6-EA1/cpu-ubi9-test/simple/Old NVIDIA values are kept as commented-out fallback lines for easy rollback.
Why
OpenShell itself does not require the NVIDIA images — the "missing Docker-driver binaries" issue that originally motivated using them is a NemoClaw-specific preflight check, not an OpenShell limitation, and is already handled by the existing
NEMOCLAW_OPENSHELL_GATEWAY_BIN/NEMOCLAW_OPENSHELL_SANDBOX_BINoverrides in this chart. Switching to ODH aligns with Red Hat's supported supply chain and enables consistent versioning across the stack.Testing performed
Tested end-to-end on a live OpenShift cluster using a fresh, isolated sandbox (kept separate from any existing sandbox so nothing else was disturbed). All image builds/pushes during testing went to a personal quay repo, never the shared team registry.
Headline result: the previously-reported ODH supervisor permission-denied blocker (
EACCESon/sandbox/.openclaw/openclaw.jsonand/sandbox/.profile, reported againstv0.0.96-rhaiv.0) does not reproduce withv0.0.99-rhaiv.0. Verified directly: created a sandbox from the real NemoClaw sandbox image with the ODH supervisor installed, confirmed the process runs as the unprivilegedsandboxuser (not root), both previously-broken config files are readable, and OpenClaw starts cleanly. No image-level mitigation (e.g. changes to the sandbox image'schownstep) was needed — the fix appears to have already landed upstream betweenv0.0.96andv0.0.99.Picture:
Final status against acceptance criteria
openshell-gateway --versionshows the RHAIV version (0.0.99-rhaiv.0)openshell --versionshows the RHAIV version (0.0.99+rhaiv.0)openshell provider createworksopenshell sandbox createworks, sandbox reachesReadymake openshell-saw-tui) — including a live end-to-end chat round-trip through a real inference provideropenshell --gateway-insecure sandbox list)values.yamlRollback
Swap the comment markers back in
charts/openshell-saw/values.yamlto restore the NVIDIA image lines (kept in the file, commented out).