Skip to content

feat: provide official CLI container image for non-native and Kubernetes environments #732

@tommylin-signalpro

Description

@tommylin-signalpro

Summary

The openshell CLI currently ships only as native binaries (Linux amd64/arm64, macOS aarch64). Environments where the CLI cannot run natively — such as Kubernetes-based deployments, CI pipelines, or unsupported host platforms — have no official way to run it.

Motivation

The OpenShell gateway already runs inside a Docker container (ghcr.io/nvidia/openshell/cluster), so Docker is always available. An official CLI container image would enable:

  1. Kubernetes deployments — the CLI could run as a Pod/Job for managing gateways and sandboxes from within a cluster
  2. CI/CD pipelines — predictable, portable CLI execution without platform-specific binary management
  3. Unsupported platforms — as a workaround for platforms without native binaries (e.g., macOS x86_64)

What I tried

I built a shell wrapper that runs the Linux x86_64 binary inside an Alpine container with openssh-client. It works, but requires mounting $HOME, temp dirs, Docker socket, and forwarding env vars — all of which are fragile and undocumented:

docker run --rm -i \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$HOME:$HOME" \
  -v /tmp:/tmp \
  -e "HOME=$HOME" \
  -e "DOCKER_HOST=unix:///var/run/docker.sock" \
  --network host \
  alpine-with-ssh \
  /openshell "$@"

Key issues encountered:

  • Gateway metadata (~/.config/openshell/gateways/) must be persisted across invocations
  • ssh client is required for sandbox connect and post-create commands
  • DOCKER_HOST must be explicitly set to avoid Docker context mismatches
  • Host temp dirs (e.g., macOS /var/folders/) must be mounted for --from Dockerfile builds

Suggestion

Publish an official CLI image (e.g., ghcr.io/nvidia/openshell/cli) containing:

  • The openshell binary
  • openssh-client
  • Documentation for required volume mounts and env vars

This could be a simple Dockerfile.cli added to the repo with CI to build/push on release.

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions