Add shared Podman and Apptainer runtimes - #2528
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0373dc6973
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — The PR adds Podman and Apptainer capabilities while refactoring shared container execution and changing existing Docker, service-exposure, callback, and egress-policy behavior. Its cross-cutting runtime and network-boundary impact requires human review. No code changes detected at You can add or adjust custom eligibility rules. Learn more. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4caf3c4057
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef30215d05
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6112ce7447
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3c46865fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c3c4686. Configure here.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38cf0c2941
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 72bfe978e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| forward_authorization=( | ||
| callback.forward_authorization | ||
| and redirected.scheme == scheme | ||
| and redirect_host == callback.host | ||
| and redirect_port == callback.port | ||
| ), |
There was a problem hiding this comment.
When a callback flow redirects A → B → A, this propagates forward_authorization=False onto the return URL for A. Because _Callback includes that flag in the callback-token key, the return uses a different token from A's original URL; A's session cookie is scoped to the original token path and is therefore not sent, breaking common OAuth/login round trips. Fresh evidence in the post-fix code is that token-prefixed cookies now preserve B's session but still cannot restore A's earlier session when the redirect returns; credential suppression needs to apply only to credentials from the origin being left, while reusing the destination origin's scoped state.
Useful? React with 👍 / 👎.
72bfe97 to
f012c79
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Overview
Adds
podmanandapptaineras local runtimes through one shared command, process, and file implementation. Docker and Podman use engine-managed bridge networking and the existing Verifiers proxy so host callbacks and published services remain reachable during restricted execution.Details
ContainerRuntime; Podman shares Docker's lifecycle and networking with native NVIDIA CDI device selection. Use native detached exec for Docker/Podman background servers.iptablesinstalled. Preserve host-published service traffic while blocking peer requests and replies after the egress cut, retain background-server proxy settings, and route MCP exposure throughRuntime.expose().Performance
Isolating the helper-cache change on main (
1e3e729) on an Apple M4 Max running macOS 27.0 and OrbStack Docker 29.4.0 reduced medianDockerRuntime.start()+prepare_execution()latency from 0.823 s to 0.291 s: 64.6% lower latency (2.82×), saving 0.531 s per restricted start. This used six warm samples per variant, interleaved in three ABBA blocks after warmups. One cold helper build took 1.107 s, with 1.486 s for that first full start and policy application; base images were already cached. These measurements cover the helper cache on this machine only. Whole-PR performance, registry-cold pulls, Linux, model latency, and full evaluation throughput remain unmeasured.Supersedes #2469, #2470, #2473, and #2509. Related to #2319 and #2359.
Note
High Risk
Changes sandbox networking, egress filtering, and MCP/interception URL routing across rollouts; mistakes could break tool reachability or weaken restricted execution.
Overview
Adds
podmanandapptaineras first-class v1 runtimes (config unions, public exports, architecture notes, pytestpodman/apptainermarks, and conditional e2e placement rows when the CLI is installed).Shared container stack: Docker’s exec/process/file helpers move into
ContainerRuntimeincontainer.py. Podman reuses Docker’s lifecycle, bridge networking, egress proxy, and publishedSERVICE_PORT. Apptainer runs contained instances on the host network with cached SIF pulls and no execution-time network policy.Reachability refactor: Base
Runtime.expose()always returns a URL (loopback by default). Docker/Podman publish one host port and route framework loopback HTTP(S) through the egress proxy via tokenized/.vf-host/callback URLs (cookie/path scoping, redirect handling). MCP serving usesprovision_runtime, applieshost_urlto full paths (/v1,/state,/tool), gatesMCP_HOSTon exposed published ports, and simplifiesreachable_urlaroundexposeplus tunnels.Restricted Docker/Podman execution shifts to bridge mode (not host networking), caches the
verifiers-networkiptables helper image, and tightens post-cut firewall rules while keeping published service traffic working.Reviewed by Cursor Bugbot for commit f012c79. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Add Podman and Apptainer runtimes with shared container runtime base
PodmanConfig/PodmanRuntimeandApptainerConfig/ApptainerRuntimeto the v1 runtime discriminated unions, with pytest markers and conditional e2e placement rows for both engines.runtime.host_urlto complete endpoint paths including/state, and only setsMCP_HOSTfor exposed runtimes with a published port.runtimes.Runtime.exposebase implementation now returns a concrete host-loopback URL instead ofNone;runtimes.NetworkPolicy.permitsno longer treats recognized loopback destinations as ordinary egress targets.Macroscope summarized f012c79.