Create a sandbox container.
(&self, sandbox: &DriverSandbox)
| 465 | |
| 466 | /// Create a sandbox container. |
| 467 | pub async fn create_sandbox(&self, sandbox: &DriverSandbox) -> Result<(), ComputeDriverError> { |
| 468 | if sandbox.name.is_empty() { |
| 469 | return Err(ComputeDriverError::Precondition( |
| 470 | "sandbox name is required".into(), |
| 471 | )); |
| 472 | } |
| 473 | if sandbox.id.is_empty() { |
| 474 | return Err(ComputeDriverError::Precondition( |
| 475 | "sandbox id is required".into(), |
| 476 | )); |
| 477 | } |
| 478 | |
| 479 | // Validate the composed container name early, before creating any |
| 480 | // resources (volume), so we don't leave orphans when the name is |
| 481 | // invalid. |
| 482 | let name = validated_container_name(&sandbox.name)?; |
| 483 | let validated = self.validated_sandbox_create(sandbox).await?; |
| 484 | |
| 485 | let vol_name = container::volume_name(&sandbox.id); |
| 486 | |
| 487 | info!( |
| 488 | sandbox_id = %sandbox.id, |
| 489 | sandbox_name = %sandbox.name, |
| 490 | container = %name, |
| 491 | "Creating sandbox container" |
| 492 | ); |
| 493 | |
| 494 | // 1a. Pull the supervisor image if needed. The supervisor binary |
| 495 | // is shipped in a standalone OCI image and mounted into sandbox |
| 496 | // containers via Podman's type=image mount. Refresh mutable tags |
| 497 | // like latest/dev, but avoid registry checks for pinned images. |
| 498 | let supervisor_pull_policy = supervisor_image_pull_policy(&self.config.supervisor_image); |
| 499 | info!( |
| 500 | image = %self.config.supervisor_image, |
| 501 | policy = supervisor_pull_policy, |
| 502 | "Ensuring supervisor image" |
| 503 | ); |
| 504 | self.client |
| 505 | .pull_image(&self.config.supervisor_image, supervisor_pull_policy) |
| 506 | .await |
| 507 | .map_err(ComputeDriverError::from)?; |
| 508 | |
| 509 | // 1b. Pull the sandbox image if needed (Podman does not pull on create). |
| 510 | let image = container::resolve_image(sandbox, &self.config); |
| 511 | if image.is_empty() { |
| 512 | return Err(ComputeDriverError::Precondition( |
| 513 | "no sandbox image configured: set default_image in [openshell.drivers.podman] \ |
| 514 | or provide an image in the sandbox template" |
| 515 | .to_string(), |
| 516 | )); |
| 517 | } |
| 518 | let pull_policy = self.config.image_pull_policy.as_str(); |
| 519 | info!(image = %image, policy = %pull_policy, "Ensuring sandbox image"); |
| 520 | self.client |
| 521 | .pull_image(image, pull_policy) |
| 522 | .await |
| 523 | .map_err(ComputeDriverError::from)?; |
| 524 |
nothing calls this directly
no test coverage detected