feat: registry expansion — 8 new plugins#16
Merged
Conversation
Browser-based notebooks/Python via JupyterLab in a /opt/jupyterlab venv, run as a systemd service on loopback:8888 (reached via SSH tunnel/Tailscale, like rstudio-server). Config: port, token, notebook_dir. Declares permissions (instance root+network, port 8888); passes 'spawn plugin validate --strict'. First of the registry-expansion plugins (spore-plugins#8 companion track). Merged now (installable via bare 'jupyterlab'); signed release cut after the gated real-AWS smoke.
VS Code in the browser via the official code-server installer, run as the code-server@ec2-user systemd service on loopback:8080 with password auth (reached via SSH tunnel/Tailscale). Config: port, password. Passes --strict.
Installs the Docker engine as a persistent service + adds ec2-user to the docker group, for interactive/long-lived instances (complements task run --container's on-demand install). Health via docker info. Passes --strict.
Mounts an S3 bucket as a local filesystem via Mountpoint for Amazon S3, run as a systemd service; credentials from the instance IAM role (documented precondition — a plugin can't set the role). Pinned version + sha256sum -c verify; arch-aware via run+curl (fetch step can't select arch). Config: bucket/prefix/mount_path/ read_only. Passes --strict.
Installs+configures the Amazon CloudWatch agent (CPU/mem/disk metrics under CWAgent + optional log-file tail), started via its ctl; credentials from the instance IAM role (documented precondition). Config: namespace/interval/log_file/ log_group. Passes --strict.
Runs 'code tunnel' as a per-user systemd service — outbound relay, no port, no SG concern. Install writes the CLI (root); tunnel runs as_user (per-user auth + state). Not auto-started: needs a one-time interactive device login (documented recipe). Static-validated (--strict); not auto-smoked (needs user auth).
Registers a self-hosted GitHub Actions runner: controller mints a short-lived registration token from GITHUB_TOKEN via the API + pushes it (long-lived PAT never leaves your machine); remote downloads actions/runner, config.sh as_user, svc.sh install/start as root. No port (outbound long-poll). Static-validated (--strict); not auto-smoked (needs your GITHUB_TOKEN + repo).
Mounts a preconfigured rclone remote: controller reads local rclone.conf, JSON-encodes via jq -Rs + captures + pushes it (globus-style secret handoff, so OAuth remotes work with no instance login); remote installs rclone + FUSE-mounts via systemd. Config: remote/path/mount_path. Static-validated (--strict); not auto-smoked (needs your authed rclone.conf).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Grows the registry from 4 demo plugins to 12, now that the supply-chain machinery (signing, checksums,
--strict, provenance) is shipped. Each new plugin passesspawn plugin validate --strictand has a README.New plugins
task run --container's on-demand installsha256sum -c; needs instance IAM role with S3code tunneloutbound relay, no portGITHUB_TOKEN→ pushrclone.confTriage (excluded — already first-class, a plugin would duplicate)
DCV (
spawn app launch+ catalog AMI), GPU/NVIDIA drivers (auto-selected DL Base AMI), EFS/FSx/EBS mounts (pkg/userdata/storage.go,spawn fsx create).Design notes
sha256:+ pinned immutable asset where one exists (mountpoint-s3);run+curlvia the vendor's own installer where the download is a moving redirect or multi-arch (code-server, docker, vscode-tunnel, rclone) — matching rstudio-server.Validation & release
Per the agreed plan: merge now (all installable via bare
name→ tracks main). Signed<name>-vX.Y.Zreleases cut after each plugin's validation:No spawn code changes; no registry-workflow changes (release.yml + lint.yml
--strictalready handle new plugins).