Build embedded minimal OCI rootfs for `auto-review gateway` #118

New issue

Closed

opened 2026-05-06 11:57:45 -07:00 by jwilger · 0 comments

jwilger commented

2026-05-06 11:57:45 -07:00

Owner

Follow-up implementation slice from #115.

Decision context

The default isolated gateway mode should use an embedded minimal OCI bundle/rootfs payload, not a host-provided bundle. This keeps the direct-download auto-review release usable without a separate rootfs install.

Scope

Build a minimal Linux rootfs/bundle for the inner gateway.
Embed the bundle payload into the downloadable auto-review binary or an equivalent one-file release artifact.
Include only the minimal runtime contents:
- auto-review
- git
- CA certificates
- resolver/passwd/group basics
- required shared libraries if the binary is not fully static
- explicit writable tmp/state mounts
Exclude shell/coreutils/debug extras from the default embedded rootfs.
Define bundle unpack/cache/update semantics and cleanup behavior.

Acceptance criteria

The embedded bundle is sufficient for clone/context/review gateway runtime.
The rootfs is read-only except for explicit writable mounts.
Bundle generation is reproducible through Nix.
The implementation explains how the embedded rootfs relates to the published Docker image.

Required tests

Nix/package tests for bundle contents.
Contract test that no shell/debug extras are included unless intentionally added later.
Runtime smoke test that the inner gateway can find git and CA certificates inside the bundle.

Follow-up implementation slice from #115. ## Decision context The default isolated gateway mode should use an embedded minimal OCI bundle/rootfs payload, not a host-provided bundle. This keeps the direct-download `auto-review` release usable without a separate rootfs install. ## Scope - Build a minimal Linux rootfs/bundle for the inner gateway. - Embed the bundle payload into the downloadable `auto-review` binary or an equivalent one-file release artifact. - Include only the minimal runtime contents: - `auto-review` - `git` - CA certificates - resolver/passwd/group basics - required shared libraries if the binary is not fully static - explicit writable tmp/state mounts - Exclude shell/coreutils/debug extras from the default embedded rootfs. - Define bundle unpack/cache/update semantics and cleanup behavior. ## Acceptance criteria - The embedded bundle is sufficient for clone/context/review gateway runtime. - The rootfs is read-only except for explicit writable mounts. - Bundle generation is reproducible through Nix. - The implementation explains how the embedded rootfs relates to the published Docker image. ## Required tests - Nix/package tests for bundle contents. - Contract test that no shell/debug extras are included unless intentionally added later. - Runtime smoke test that the inner gateway can find `git` and CA certificates inside the bundle.

jwilger added a new dependency

2026-05-06 12:13:08 -07:00

#116 Implement unified auto-review CLI with grouped commands

jwilger added a new dependency

2026-05-06 12:14:05 -07:00

#117 Implement embedded youki OCI gateway launcher

jwilger added this to the 1.0 milestone

2026-05-06 12:17:50 -07:00

jwilger referenced this issue

2026-05-06 14:52:03 -07:00

feat(gateway): add fail-closed OCI launcher seam #127

jwilger referenced this issue from a commit