[ericcurtin]

Summary

Move the sandbox identity from top-level container to device.container, which OCSF 1.8.0 defines.

Related Issue

Closes #4915

Changes

• Emit device.container instead of a top-level container.
• Omit container.image, since OCSF requires an image ID we do not have.
• Strip device.container on downgrade to 1.1 and 1.3.
• Drop the validator exemption for container.
• Update docs and tests.

Release Notes

Sandbox ID and name move from container to device.container in OCSF records. Update parsers that read container.uid or container.name.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

All 10 builder samples return 0 errors from schema.ocsf.io/api/1.8.0/v2/validate. The e2e assertion is updated but not run.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@krishicks PTAL, and /ok to test 5d171ac753c47cfe1a9bf4a922cfc77c278a3f46 if it looks good. Thank you!

[ericcurtin]

@krishicks Merged main. The validator moved to openshell-ocsf-validate, so the container exemption is dropped there. PTAL, and /ok to test abbefa5b0f8bd2f9d6ed7675ec529796cc2fb01f if it looks good. Thank you!