Vouch request: arun-elr

[arun-elr]

What do you want to work on?

I filed #5476: sandboxes can't start under the EKS isolated-sandbox RuntimeClass. I deployed OpenShell 0.1.8 on EKS Auto Mode with Nitro Sandboxes and every sandbox failed with shared filesystem PVC is already mounted at /mnt/openshell-workspace; container agent requests /sandbox.

Why this change?

The runtime won't allow one PVC at two paths, and the driver mounts the workspace PVC at /mnt/openshell-workspace in the init container and /sandbox in the agent. There's no config that changes it, so there's no workaround. Runtime classes are the way to add a VM boundary on Kubernetes, so that path is unusable today.

I ran capability-probe inside an isolated-sandbox pod first and confirmed Landlock, NetworkPolicy, admission and image pulls all work in the micro-VM, so I have narrowed it to the workspace mount before filing. And I have the fix written with tests as well..

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md