feat(data-plane): deploy Rust edge and node proxy

.dockerignore

@@ -33,6 +33,7 @@ src/yuanrong/
 **/*.egg-info/
 
 # Local image and archive outputs.
+.artifacts/
 builder/*.img
 builder/*.tar
 builder/*.tar.gz

.gitignore

@@ -16,6 +16,7 @@ __pycache__/
 /sdk/python/dist/
 
 # Local build artifacts.
+.artifacts/
 builder/*.img
 builder/*.tar
 builder/*.tar.gz

AGENTS.md

@@ -117,11 +117,12 @@ The build creates only the selected image reference; it does not add a second
 
 The build helper performs two Docker builds. `builder/runtime.Dockerfile`
 creates `yr-runtime-rootfs.img`; the default `rrt` profile contains the
-pinned openYuanRong RRT binary without Python. Set
+pinned openYuanRong RRT binary without Python and verifies that it is byte-for-
+byte identical to the binary in the matching `openyuanrong_rrt` wheel. Set
 `RUNTIME_PROFILE=python` to include the optional Python 3.10 through 3.14
-runtimes and `openyuanrong_sdk`. `builder/node.Dockerfile` then compiles the
-node components and produces the AKernel all-in-one image using the selected
-runtime image and its matching service configuration.
+runtimes, `openyuanrong_sdk`, and the RRT wheel. `builder/node.Dockerfile` then
+compiles the node components and produces the AKernel all-in-one image using
+the selected runtime image and its matching service configuration.
 
 The control-plane and RRT release version is independent of the optional
 actor-based `openyuanrong_sdk` installed in the Python runtime profile. This
@@ -161,6 +162,29 @@ To test an unreleased RRT binary, provide both `RRT_RUNTIME_URL` and
 `RRT_RUNTIME_SHA256` to `make build`. The runtime build verifies the binary
 before packaging it into the selected runtime root filesystem.
 
+The Rust data plane is packaged separately from the core wheel. Every image
+build must provide its SHA-256 plus exactly one source: a local authenticated
+Buildkite download or a public URL. A local wheel is exposed to Docker through
+a dedicated read-only BuildKit context and is not copied into the primary build
+context or a persistent image layer:
+
+```bash
+make build \
+  OPEN_YR_DATA_PLANE_WHEEL_PATH=/absolute/path/openyuanrong_data_plane.whl \
+  OPEN_YR_DATA_PLANE_WHEEL_SHA256=<sha256>
+```
+
+Use `OPEN_YR_DATA_PLANE_WHEEL_URL` instead of the path after the artifact has a
+public URL. The all-in-one image installs both wheels through Python packaging,
+keeps `/usr/bin/yr` as the legacy native CLI for Kubernetes entrypoints, and
+uses `/usr/local/bin/yr` to start the Rust Node Proxy and Edge Frontend in
+standalone mode.
+
+On a development host whose proxy only listens on loopback, set
+`AKERNEL_BUILD_NETWORK=host` while building. The helper then gives BuildKit host
+network access and forwards the standard proxy environment variables as Docker
+proxy build arguments. The default remains Docker's isolated build network.
+
 Inspect the selected local versions without building an image:
 
 ```bash
@@ -392,6 +416,13 @@ sandbox port URLs and reverse tunnels; exec and file transfer continue to use
 `AKERNEL_SERVER_ADDRESS`. Standalone uses `akerneldev/all-in-one:latest` by
 default; pass `IMAGE` to test a locally built or differently tagged image.
 
+In standalone mode Traefik terminates neither YuanRong protocol nor TLS. Its
+HTTPS TCP entrypoint passes TLS through to the Rust Edge Frontend on port 8443,
+and its HTTP entrypoint forwards to the Edge plain listener on port 8080. Edge
+routes control traffic to the core frontend; sandbox traffic follows the Rust
+Edge Frontend to Node Proxy path. Their local readiness endpoints are 18080
+and 18443 respectively.
+
 Standalone GPU testing additionally requires NVIDIA Container Toolkit on the
 host and `AKERNEL_ENABLE_GPU=true`. sandboxd uses the read-only cgroup
 node-resource provider in standalone mode; Kubernetes deployments retain the

Makefile

@@ -12,6 +12,9 @@ OPEN_YR_CORE_WHEEL_URL ?=
 OPEN_YR_CORE_WHEEL_SHA256 ?=
 RRT_RUNTIME_URL ?=
 RRT_RUNTIME_SHA256 ?=
+OPEN_YR_DATA_PLANE_WHEEL_PATH ?=
+OPEN_YR_DATA_PLANE_WHEEL_URL ?=
+OPEN_YR_DATA_PLANE_WHEEL_SHA256 ?=
 TOKEN_TTL ?= $(if $(TTL),$(TTL),24h)
 TENANT ?= default
 ROLE ?= developer
@@ -55,6 +58,7 @@ help:
 	@echo "  make build AKERNEL_ENABLE_FIRECRACKER=false Exclude Firecracker"
 	@echo "  make build AKERNEL_ENABLE_RUNC=true Include the optional runc payload"
 	@echo "  make build RRT_RUNTIME_URL=... RRT_RUNTIME_SHA256=... Override RRT artifact"
+	@echo "  make build OPEN_YR_DATA_PLANE_WHEEL_PATH=<wheel> Use a local Rust data-plane wheel"
 	@echo "  make versions                       Show locally selected component versions"
 	@echo "  make push                          Push the configured all-in-one image"
 	@echo "  make plan                          Terraform plan"
@@ -107,6 +111,9 @@ build:
 	if [[ -n "$(OPEN_YR_CORE_WHEEL_SHA256)" ]]; then args+=(--open-yr-core-wheel-sha256 "$(OPEN_YR_CORE_WHEEL_SHA256)"); fi; \
 	if [[ -n "$(RRT_RUNTIME_URL)" ]]; then args+=(--rrt-runtime-url "$(RRT_RUNTIME_URL)"); fi; \
 	if [[ -n "$(RRT_RUNTIME_SHA256)" ]]; then args+=(--rrt-runtime-sha256 "$(RRT_RUNTIME_SHA256)"); fi; \
+	if [[ -n "$(OPEN_YR_DATA_PLANE_WHEEL_PATH)" ]]; then args+=(--open-yr-data-plane-wheel-path "$(OPEN_YR_DATA_PLANE_WHEEL_PATH)"); fi; \
+	if [[ -n "$(OPEN_YR_DATA_PLANE_WHEEL_URL)" ]]; then args+=(--open-yr-data-plane-wheel-url "$(OPEN_YR_DATA_PLANE_WHEEL_URL)"); fi; \
+	if [[ -n "$(OPEN_YR_DATA_PLANE_WHEEL_SHA256)" ]]; then args+=(--open-yr-data-plane-wheel-sha256 "$(OPEN_YR_DATA_PLANE_WHEEL_SHA256)"); fi; \
 	./deploy/scripts/build-image.sh "$${args[@]}"
 
 .PHONY: versions

builder/node.Dockerfile

@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1.7
+
 # Copyright (c) 2026 Ant Group Corporation.
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -16,6 +18,9 @@ ARG OPEN_YR_CORE_WHEEL_SHA256=
 ARG OPEN_YR_RELEASE_BASE_URL=https://openyuanrong.obs.cn-southwest-2.myhuaweicloud.com/release
 ARG OPEN_YR_CORE_AMD64_SHA256=65c1f27e7e700a253a2e907dea0273e85f1c76610e48c93544caa6bcc07ac3af
 ARG OPEN_YR_CORE_ARM64_SHA256=29d25c3388c2913346035ee8df9b8159e702de7a8e6f783e3e218ab773896333
+ARG OPEN_YR_DATA_PLANE_WHEEL_URL=
+ARG OPEN_YR_DATA_PLANE_WHEEL_SHA256=
+ARG OPEN_YR_DATA_PLANE_WHEEL_NAME=
 ARG GVISOR_DOWNLOAD_IMAGE=ubuntu:24.04
 ARG GVISOR_RELEASE
 ARG GVISOR_AMD64_URL
@@ -223,6 +228,9 @@ ARG AKERNEL_REVISION
 ARG OPEN_YR_VERSION
 ARG OPEN_YR_CORE_WHEEL_URL
 ARG OPEN_YR_CORE_WHEEL_SHA256
+ARG OPEN_YR_DATA_PLANE_WHEEL_URL
+ARG OPEN_YR_DATA_PLANE_WHEEL_SHA256
+ARG OPEN_YR_DATA_PLANE_WHEEL_NAME
 ARG OPEN_YR_RELEASE_BASE_URL
 ARG OPEN_YR_CORE_AMD64_SHA256
 ARG OPEN_YR_CORE_ARM64_SHA256
@@ -297,10 +305,11 @@ RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && \
 
 ENV YR_INSTALLATION_DIR=/home/yuanrong
 
-# Install the complete, language-runtime-free openYuanRong control plane from
-# its checksum-pinned core wheel. A URL and checksum pair may override the
-# release asset when validating an unreleased daily build.
-RUN set -eux; \
+# Install the complete, language-runtime-free openYuanRong control plane and
+# the standalone Rust data-plane executables. The data-plane wheel can arrive
+# either from a public URL or from a BuildKit file mount supplied by the build
+# helper for authenticated Buildkite artifacts.
+RUN --mount=type=bind,from=open_yr_data_plane_wheel,source=.,target=/run/open_yr_data_plane_wheel,ro set -eux; \
     case "${TARGETARCH:-}" in \
       amd64) wheel_arch=x86_64; wheel_platform=amd64; release_sha="${OPEN_YR_CORE_AMD64_SHA256}" ;; \
       arm64) wheel_arch=aarch64; wheel_platform=arm64; release_sha="${OPEN_YR_CORE_ARM64_SHA256}" ;; \
@@ -325,21 +334,41 @@ RUN set -eux; \
       test -z "${OPEN_YR_CORE_WHEEL_SHA256}"; \
     fi; \
     wheel="/tmp/${wheel_name}"; \
-    target=/tmp/openyuanrong-core; \
     curl -fSL --retry 10 --retry-delay 2 --retry-all-errors \
       "${wheel_url}" -o "${wheel}"; \
     echo "${wheel_sha}  ${wheel}" | sha256sum -c -; \
+    data_plane_wheel_name="${OPEN_YR_DATA_PLANE_WHEEL_NAME}"; \
+    if [ -n "${OPEN_YR_DATA_PLANE_WHEEL_URL}" ]; then \
+      data_plane_wheel_name="$(python3 -c 'import os, sys, urllib.parse; print(os.path.basename(urllib.parse.unquote(urllib.parse.urlparse(sys.argv[1]).path)))' "${OPEN_YR_DATA_PLANE_WHEEL_URL}")"; \
+    fi; \
+    case "${data_plane_wheel_name}" in openyuanrong_data_plane-*.whl) ;; *) echo "the data-plane source must reference a valid openyuanrong_data_plane wheel filename" >&2; exit 1 ;; esac; \
+    data_plane_wheel="/tmp/${data_plane_wheel_name}"; \
+    if [ -n "${OPEN_YR_DATA_PLANE_WHEEL_URL}" ]; then \
+      curl -fSL --retry 10 --retry-delay 2 --retry-all-errors \
+        "${OPEN_YR_DATA_PLANE_WHEEL_URL}" -o "${data_plane_wheel}"; \
+    else \
+      test -f "/run/open_yr_data_plane_wheel/${data_plane_wheel_name}"; \
+      cp "/run/open_yr_data_plane_wheel/${data_plane_wheel_name}" "${data_plane_wheel}"; \
+    fi; \
+    echo "${OPEN_YR_DATA_PLANE_WHEEL_SHA256}  ${data_plane_wheel}" | sha256sum -c -; \
     python3 -m pip install \
       --break-system-packages \
       --no-cache-dir \
-      --no-deps \
-      --target "${target}" \
-      "${wheel}"; \
-    test -x "${target}/yr/functionsystem/bin/yr"; \
+      --index-url "${PIP_INDEX_URL}" \
+      --timeout 120 \
+      --retries 10 \
+      "${wheel}" \
+      "${data_plane_wheel}"; \
+    yr_package_dir="$(python3 -c 'from pathlib import Path; import yr; print(Path(yr.__file__).resolve().parent)')"; \
+    python_bin_dir="$(python3 -c 'import sysconfig; print(sysconfig.get_path("scripts"))')"; \
+    test -x "${yr_package_dir}/functionsystem/bin/yr"; \
+    test -x "${yr_package_dir}/data_plane/bin/yr-node-proxy"; \
+    test -x "${yr_package_dir}/data_plane/bin/yr-edge-frontend"; \
+    test -x "${yr_package_dir}/data_plane/bin/yr-data-plane-forward"; \
+    test -x "${python_bin_dir}/yr"; \
     mkdir -p "${YR_INSTALLATION_DIR}"; \
-    cp -a "${target}/yr/." "${YR_INSTALLATION_DIR}/"; \
-    rm -rf "${target}" "${wheel}"; \
-    ln -sfn "${YR_INSTALLATION_DIR}/functionsystem/bin/yr" /usr/bin/yr
+    rm -f "${wheel}" "${data_plane_wheel}"; \
+    ln -sfn "${yr_package_dir}/functionsystem/bin/yr" /usr/bin/yr
 
 COPY --from=runtime-image /yr-runtime-rootfs.img ${YR_INSTALLATION_DIR}/yr-runtime-rootfs.img