rfc-0006: add driver config passthrough proposal

crates/openshell-driver-docker/README.md

@@ -56,12 +56,15 @@ paths to sandbox requests. Image mounts are not part of the Docker
 driver-config schema. The driver still uses internal bind mounts for
 OpenShell-owned supervisor, token, and TLS material.
 
-Docker `bind` mounts accept `source`, `target`, and optional `read_only`.
-Docker `volume` mounts may include `subpath`. User-supplied bind and volume
-mounts are read-only by default; set `read_only: false` to make them writable.
-Mount targets must be absolute container paths and must not replace the
-workspace root (`/sandbox`) or overlap OpenShell supervisor files,
-`/etc/openshell`, `/etc/openshell-tls`, or `/run/netns`.
+Docker `bind` mounts accept `source`, `target`, optional `read_only`, and an
+optional `selinux_label` of `shared` (applies `:z`) or `private` (applies
+`:Z`) for SELinux-enforcing hosts. Docker `volume` mounts may include
+`subpath`. User-supplied bind and volume mounts are read-only by default; set
+`read_only: false` to make them writable. Mount `source`, `target`, and
+`subpath` values must not contain surrounding whitespace. Mount targets must be
+absolute container paths and must not replace the workspace root (`/sandbox`)
+or overlap OpenShell supervisor files, `/etc/openshell`, `/etc/openshell-tls`,
+or `/run/netns`.
 
 Example named-volume usage:
 

crates/openshell-driver-kubernetes/README.md

@@ -70,10 +70,11 @@ for `nvidia.com/gpu` and requests the configured GPU count in the workload spec.
 When no count is set, the driver requests one GPU resource. The sandbox image
 must provide the user-space libraries needed by the agent workload.
 
-## Driver Config POC
+## Driver Config
 
-The RFC 0005 POC accepts the selected `SandboxTemplate.driver_config.kubernetes`
-block as `DriverSandboxTemplate.driver_config`. The Kubernetes driver owns the
+Following RFC 0006, this driver accepts the selected
+`SandboxTemplate.driver_config.kubernetes` block as
+`DriverSandboxTemplate.driver_config`. The Kubernetes driver owns the
 nested schema and currently accepts:
 
 - `pod.node_selector`
@@ -97,7 +98,7 @@ openshell sandbox create \
 ```
 
 Resource keys use native Kubernetes resource names and quantity strings. The
-POC parser renders the keys listed above and rejects unknown fields.
+parser renders the keys listed above and rejects unknown fields.
 `pod.runtime_class_name` maps to PodSpec `runtimeClassName` and overrides the
 driver's configured `default_runtime_class_name`; the typed public
 `SandboxTemplate.runtime_class_name` still takes precedence when set. Use the

crates/openshell-driver-podman/README.md

@@ -71,13 +71,15 @@ Host bind mounts are disabled by default because they expose gateway host paths
 to sandbox requests. The driver still uses internal bind mounts for
 OpenShell-owned token and TLS material.
 
-Podman `bind` mounts accept `source`, `target`, and optional `read_only`.
-User-supplied bind and volume mounts are read-only by default; set
-`read_only: false` to make them writable. Podman image and volume mounts do not
-support `subpath` in OpenShell driver config. Mount targets must be absolute
-container paths and must not replace the workspace root (`/sandbox`) or overlap
-OpenShell supervisor files, `/etc/openshell`, `/etc/openshell-tls`, or
-`/run/netns`.
+Podman `bind` mounts accept `source`, `target`, optional `read_only`, and an
+optional `selinux_label` of `shared` (applies `:z`) or `private` (applies
+`:Z`) for SELinux-enforcing hosts. User-supplied bind and volume mounts are
+read-only by default; set `read_only: false` to make them writable. Podman
+image and volume mounts do not support `subpath` in OpenShell driver config.
+Mount `source` and `target` values must not contain surrounding whitespace.
+Mount targets must be absolute container paths and must not replace
+the workspace root (`/sandbox`) or overlap OpenShell supervisor files,
+`/etc/openshell`, `/etc/openshell-tls`, or `/run/netns`.
 
 Example named-volume usage:
 

docs/reference/sandbox-compute-drivers.mdx

@@ -166,10 +166,11 @@ Docker mount schema:
 | `volume` | `source`, `target`, optional `read_only` (`true` by default), optional `subpath`. The named volume must already exist. Docker local-driver bind-backed volumes require `enable_bind_mounts = true`. |
 | `tmpfs` | `target`, optional `options`, optional `size_bytes`, optional `mode`. |
 
-OpenShell rejects mount targets that replace the workspace root, container root,
-supervisor files, `/etc/openshell`, `/etc/openshell-tls`, authentication
-material, or network namespace paths. These checks do not make host bind mounts
-safe.
+OpenShell rejects mount `source`, `target`, and Docker volume `subpath` values
+with surrounding whitespace. OpenShell also rejects mount targets that replace
+the workspace root, container root, supervisor files, `/etc/openshell`,
+`/etc/openshell-tls`, authentication material, or network namespace paths. These
+checks do not make host bind mounts safe.
 
 ## Podman Driver
 
@@ -233,10 +234,11 @@ Podman mount schema:
 | `image` | `source`, `target`, optional `read_only` (`true` by default). |
 
 Podman `volume` and `image` mounts do not support `subpath` in OpenShell driver
-config. OpenShell rejects mount targets that replace the workspace root,
-container root, supervisor files, `/etc/openshell`, `/etc/openshell-tls`,
-authentication material, or network namespace paths. These checks do not make
-host bind mounts safe.
+config, and OpenShell rejects `subpath` for those mount types. OpenShell rejects
+mount `source` and `target` values with surrounding whitespace. OpenShell also
+rejects mount targets that replace the workspace root, container root, supervisor
+files, `/etc/openshell`, `/etc/openshell-tls`, authentication material, or
+network namespace paths. These checks do not make host bind mounts safe.
 
 ## MicroVM Driver