Skip to content

docs(osep): propose secure PVC subpath initialization #1579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cwj2001 wants to merge 5 commits into from
Closed

docs(osep): propose secure PVC subpath initialization #1579

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f947602
docs(osep): propose secure PVC subpath initialization
cwj2001 Aug 19, 2026
f86522b
docs(osep): remove internal product reference
cwj2001 Aug 19, 2026
87ffeff
docs(osep): clarify subpath compatibility contract
cwj2001 Aug 20, 2026
91d007c
docs(osep): harden PVC subpath initialization design
cwj2001 Aug 20, 2026
34729a6
Merge remote-tracking branch 'origin/main' into feature/volume-subpat…
cwj2001 Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion oseps/0003-volume-and-volumebinding-support.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -492,7 +492,7 @@ post_sandboxes.sync(client=client, body=request)
- For `ossfs` backend, validate required fields (`bucket`, `endpoint`, `accessKeyId`, `accessKeySecret`).
- For `pvc` backend, validate `claimName` is a valid DNS label (lowercase alphanumeric and hyphens, max 63 characters). In Kubernetes, validate the PVC exists in the same namespace. In Docker, validate the named volume exists via the Docker API (`docker volume inspect`).
- For `nfs` backend, validate required fields (`server`, `path`).
- `subPath` is created if missing under the resolved backend path; if creation fails due to permissions or policy, the request is rejected.
- Missing `subPath` behavior is runtime-dependent and may fail if the path does not exist. Secure opt-in initialization for supported Kubernetes PVC mounts is governed by OSEP-0021; omission does not enable creation.

### Configuration (example)
Host path allowlists are configured by the control plane (server/execd) and enforced at validation time. Example `config.toml`:
Expand Down
Loading
Loading