OpenShell Compute driver for LXD / MicroCloud.
The driver utilizes system containers provided by LXD to host sandboxes managed by OpenShell and provides the necessary integration between both sides.
openshell-driver-lxd is an out-of-tree OpenShell
compute driver. It implements OpenShell's compute_driver.proto contract and serves it
over gRPC via a Unix domain socket, which the OpenShell gateway connects to at startup.
A sandbox is two containers. From OpenShell v0.1.0 the supervisor is split into an out-of-workload companion, which holds the gateway credentials, and an in-workload boundary, which runs beside the user's own image — see docs/architecture.md.
Three OCI images are published in lock step, all built from one pinned upstream revision:
| image | contents |
|---|---|
ghcr.io/canonical/openshell-gateway |
the OpenShell gateway and this driver |
ghcr.io/canonical/openshell-supervisor |
the out-of-workload half of a sandbox |
ghcr.io/canonical/openshell-sandbox |
the in-workload boundary |
Sandboxes need an OVN network. Their egress ACL is the outer network fence
OpenShell v0.1.0 requires before a workload runs, and LXD applies a per-NIC ACL
only on OVN; the driver refuses to create a sandbox it cannot fence. LXD's
network type is checked against --network-mode (default ovn), so a network
of another type is refused rather than silently run unfenced. A bridge, which
cannot carry a per-NIC ACL, is accepted — without the outer network fence — only
on an explicit --network-mode bridge.
Licensed under the GNU Affero General Public License v3.0.
Also see THIRD-PARTY-NOTICES.