[ericcurtin]

Summary

Add --log-dir (OPENSHELL_LOG_DIR) to the supervisor, default /var/log. The VM driver points it at a private logs/ dir in the sandbox state dir.

Related Issue

Closes #3855

Changes

• Supervisor log dir is configurable; one shared default replaces three /var/log literals.
• /v1/denials reads from the configured dir.
• VM driver creates an owner-only logs/ dir per sandbox.
• Docs updated.

Release Notes

VM sandboxes now write supervisor log files to their state dir.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Ran cargo fmt, cargo clippy -D warnings and unit tests for the supervisor and network crates. VM E2E not run.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@krishicks @TaylorMutch PTAL, and /ok to test 8e5c5f3257bbfee475c38596fe26a21cddf59206 if it looks good. Thank you!