feat(cli): add --annotation to sandbox create by ericcurtin · Pull Request #4325 · NVIDIA/OpenShell

ericcurtin · 2026-10-08T09:30:01Z

Summary

Add repeatable --annotation KEY=VALUE to sandbox create.

Related Issue

Closes #4303

Changes

New --annotation flag, merged with the ephemeral retention annotation.
--label now uses the shared parse_key_value_pairs (also trims keys and rejects empty ones).
Docs and CLI skill updated.

Testing

Checks appropriate to the affected code and behavior pass
Unit tests added/updated (if applicable)
E2E tests added/updated (if applicable)

cargo fmt, cargo clippy -p openshell-cli --all-targets -- -D warnings, cargo test -p openshell-cli (lib, bin, sandbox_create_lifecycle_integration), and markdownlint on changed docs.

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (if applicable)

copy-pr-bot · 2026-10-08T09:30:05Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

ericcurtin · 2026-10-08T13:02:21Z

@elezar @johntmyers PTAL when you get a chance. Thank you!

elezar

Please remove the CLI-only reserved annotation key check, its associated test, and the documentation stating that openshell.nvidia.com/ is reserved.

Annotation ownership should be defined consistently and enforced by the gateway across all clients. Existing annotations use both openshell.nvidia.com/ and internal.openshell.ai/, and some keys under the former already support caller/interceptor-supplied provenance.

Follow-up issue #4333 covers namespace consistency and gateway enforcement where reservation applies, including compatibility with retention and provenance workflows. This PR can stay focused on exposing creation-time annotations.

ericcurtin · 2026-10-08T16:57:32Z

Please remove the CLI-only reserved annotation key check, its associated test, and the documentation stating that openshell.nvidia.com/ is reserved.

Annotation ownership should be defined consistently and enforced by the gateway across all clients. Existing annotations use both openshell.nvidia.com/ and internal.openshell.ai/, and some keys under the former already support caller/interceptor-supplied provenance.

Follow-up issue #4333 covers namespace consistency and gateway enforcement where reservation applies, including compatibility with retention and provenance workflows. This PR can stay focused on exposing creation-time annotations.

Good call removing the company name from openshell.nvidia.com/ and allowing internal.openshell.ai/ FWIW. When you start blurring the name of the company with the name of the upstream project things can get messy fast...

ericcurtin · 2026-10-08T21:04:58Z

Removed the reserved key check, its test, and the docs note. @elezar PTAL, and /ok to test 2c1004639c36d1178093ae057542de0eabb58f12 if it looks good. Thank you!

johntmyers · 2026-10-12T19:18:50Z

/ok to test 2c10046

github-actions · 2026-10-12T19:18:57Z

Label test:e2e applied for 2c10046. Open Branch E2E Checks, find the run for commit 2c10046, and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

johntmyers

gator-agent

PR Review Status

The full patch has no blocking findings. Thanks @ericcurtin, I checked your update removing the reserved-key check, test, and docs note requested by @elezar; those changes are present, and gateway-wide annotation ownership remains tracked in #4333. The annotation parser, creation request, ephemeral retention handling, tests, and published docs are consistent with this focused change.

Required tests are now queued or running on this head after applying test:e2e and posting /ok to test. The label-help bot suggested rerunning E2E, but the mirror push created a fresh E2E run after the label was applied; run 38296825072 is queued with its PR-metadata job complete. Gator will monitor its results. Maintainer approval remains outstanding.

Blocking findings: None.
Carried findings: None.
Non-blocking suggestions: None.

Gator metadata

Validation: Concentrated CLI implementation of accepted issue #4303.
Docs: Fern sandbox overview and public CLI skill updated; no navigation change needed.
Checks: DCO and Trivy pass; current-head Branch Checks and Helm Lint running.
E2E: test:e2e applied; fresh current-head Branch E2E Checks run 38296825072 queued.
Head SHA: 2c1004639c36d1178093ae057542de0eabb58f12
Base SHA: 67adcf1a3cf054be54dfdbf6a44c65b4d426b1ec
Merge base SHA: 67adcf1a3cf054be54dfdbf6a44c65b4d426b1ec
Patch ID: ae252e0cbe00a52d2e864f6375e4bc3f15a77e1a
Gator payload: 12
Review mode: initial
Previous reviewed SHA: none
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

ericcurtin · 2026-10-14T20:29:10Z

Rebased and fixed the test compile break from main. @johntmyers PTAL, and /ok to test bdd8c4dde9892fd503c38fd9a8b2888749371015 if it looks good. Thank you!

johntmyers · 2026-10-14T20:40:27Z

/ok to test bdd8c4d

johntmyers

gator-agent

PR Review Status

No blocking findings remain after the follow-up review. Thanks @ericcurtin, I checked your rebase and test compilation fix in response to @johntmyers: both annotation tests now use the current environment helper, and the author-only delta introduces no identified regression. @elezar's earlier request to remove CLI-only annotation reservation remains addressed; gateway-wide ownership stays tracked in #4333.

The current-head Branch Checks and E2E workflows are queued or running after @johntmyers posted /ok to test. E2E run 38634070862 was created with test:e2e already applied and has build jobs queued, so no additional rerun is needed. Gator will monitor the results; maintainer approval is still outstanding.

Blocking findings: None.
Carried findings: None.

Gator metadata

Validation: Concentrated CLI implementation of accepted issue #4303.
Docs: Fern sandbox overview and public CLI skill updated; no navigation change needed.
Checks: DCO, Helm Lint, and Trivy pass; current-head Branch Checks running.
E2E: test:e2e applied; current-head Branch E2E Checks run 38634070862 queued with build jobs queued.
Head SHA: bdd8c4dde9892fd503c38fd9a8b2888749371015
Base SHA: 68b10822ce1b65b376c5c60176b765f793f460fd
Merge base SHA: 68b10822ce1b65b376c5c60176b765f793f460fd
Patch ID: f7976e37ed0a82e040598b4aa749d60d66f36abe
Gator payload: 12
Review mode: follow_up
Previous reviewed SHA: 2c1004639c36d1178093ae057542de0eabb58f12
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers · 2026-10-15T18:21:43Z

/ok to test ff0192c

johntmyers

gator-agent

PR Review Status

No blocking findings remain after reviewing the author-only delta and merge resolution. @johntmyers, I checked your update integrating main and boxing the forwarding-test future: the merge resolution changes test allocation without changing annotation behavior. @ericcurtin's earlier test-helper fix and @elezar's request to remove CLI-only annotation reservation remain addressed; gateway-wide annotation ownership stays tracked in #4333.

Branch Checks and E2E are already running for this head after @johntmyers posted /ok to test. The E2E workflow was created with test:e2e already applied and has completed build jobs, so no additional rerun is needed. Gator will monitor the results; maintainer approval remains outstanding.

Blocking findings: None.
Carried findings: None.

Gator metadata

Validation: Concentrated CLI implementation of accepted issue #4303.
Docs: Fern sandbox overview and public CLI skill updated; no navigation change needed.
Checks: DCO, issue acceptance, and Helm Lint pass; Branch Checks running. No current-head Trivy Changes status is published; recheck required gate coverage before approval handoff.
E2E: test:e2e applied; current-head Branch E2E Checks run 38784991295 dispatched with build jobs complete or running.
Head SHA: ff0192caefa2360291832b85253dc0445c47e72a
Base SHA: 253884414a8c878ad8f3509be9b63140610fa598
Merge base SHA: 253884414a8c878ad8f3509be9b63140610fa598
Patch ID: e0cd528114e9d99b713e8d17013029778ca24c54
Gator payload: 12
Review mode: follow_up
Previous reviewed SHA: bdd8c4dde9892fd503c38fd9a8b2888749371015
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

ericcurtin requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners October 8, 2026 09:30

elezar reviewed Oct 8, 2026

View reviewed changes

Comment thread crates/openshell-cli/src/commands/common.rs Outdated

elezar mentioned this pull request Oct 8, 2026

feat: define annotation namespaces and gateway-enforced ownership #4333

Open

6 tasks

elezar previously requested changes Oct 8, 2026

View reviewed changes

johntmyers added the test:e2e Requires end-to-end coverage label Oct 12, 2026

johntmyers reviewed Oct 12, 2026

View reviewed changes

johntmyers added gator:watch-pipeline Gator is monitoring PR CI/CD status gator:approval-needed Gator completed review; maintainer approval needed and removed gator:watch-pipeline Gator is monitoring PR CI/CD status labels Oct 12, 2026

johntmyers previously approved these changes Oct 12, 2026

View reviewed changes

johntmyers requested a review from elezar October 12, 2026 20:07

johntmyers enabled auto-merge October 12, 2026 20:07

johntmyers added gator:merge-ready gator:blocked Gator is blocked by process or repository gates and removed gator:approval-needed Gator completed review; maintainer approval needed gator:merge-ready gator:blocked Gator is blocked by process or repository gates labels Oct 12, 2026

johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Oct 14, 2026

ericcurtin added 3 commits October 14, 2026 21:20

feat(cli): add --annotation to sandbox create

919189a

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

fix(cli): drop reserved annotation check

df9aa28

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

test(cli): adapt annotation tests to env helper

bdd8c4d

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

ericcurtin dismissed johntmyers’s stale review via bdd8c4d October 14, 2026 20:29

ericcurtin force-pushed the feat/4303-sandbox-create-annotations/ericcurtin branch from 2c10046 to bdd8c4d Compare October 14, 2026 20:29

johntmyers reviewed Oct 14, 2026

View reviewed changes

johntmyers previously approved these changes Oct 15, 2026

View reviewed changes

johntmyers added this pull request to the merge queue Oct 15, 2026

johntmyers added gator:merge-ready and removed gator:approval-needed Gator completed review; maintainer approval needed labels Oct 15, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 15, 2026

test(cli): box forwarding future after main integration

ff0192c

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers dismissed their stale review via ff0192c October 15, 2026 18:21

johntmyers reviewed Oct 15, 2026

View reviewed changes

Conversation

ericcurtin commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Oct 8, 2026

Uh oh!

Uh oh!

ericcurtin commented Oct 8, 2026

Uh oh!

elezar left a comment

Choose a reason for hiding this comment

Uh oh!

ericcurtin commented Oct 8, 2026

Uh oh!

ericcurtin commented Oct 8, 2026

Uh oh!

johntmyers commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

ericcurtin commented Oct 14, 2026

Uh oh!

johntmyers commented Oct 14, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

johntmyers commented Oct 15, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ericcurtin commented Oct 8, 2026 •

edited

Loading