From 14de52fa81ca6e080e8f97472c3a262be4d2c0e4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 21:09:46 +0000 Subject: [PATCH] docs(website): sync dev docs from 3495c8e92af8947046f4f938f929bfb7057eb455 --- fern/.docs-snapshots.yml | 6 +++--- fern/pages-dev/how-it-works/policies/schema.mdx | 7 ++++--- fern/pages-dev/kubernetes/ingress.mdx | 2 ++ fern/pages-dev/kubernetes/setup.mdx | 12 ++++++++++++ 4 files changed, 21 insertions(+), 6 deletions(-) diff --git a/fern/.docs-snapshots.yml b/fern/.docs-snapshots.yml index 47fb5e3fa..4759d2800 100644 --- a/fern/.docs-snapshots.yml +++ b/fern/.docs-snapshots.yml @@ -1,8 +1,8 @@ snapshots: dev: - source-ref: f01a664029888ac32b007acb7e1f8ff823ba85bc - source-sha: f01a664029888ac32b007acb7e1f8ff823ba85bc - version: 0.1.4.dev21 + source-ref: 3495c8e92af8947046f4f938f929bfb7057eb455 + source-sha: 3495c8e92af8947046f4f938f929bfb7057eb455 + version: 0.1.4.dev26 latest: source-ref: e1f3c82caa3ed3b65de22889ae7ef32a774878ef source-sha: e1f3c82caa3ed3b65de22889ae7ef32a774878ef diff --git a/fern/pages-dev/how-it-works/policies/schema.mdx b/fern/pages-dev/how-it-works/policies/schema.mdx index db85e3a19..693efb209 100644 --- a/fern/pages-dev/how-it-works/policies/schema.mdx +++ b/fern/pages-dev/how-it-works/policies/schema.mdx @@ -77,9 +77,10 @@ fails to enforce the policy's rules: | `best_effort` | The sandbox runs without the filesystem rules and logs a high-severity finding. | | `hard_requirement` | The sandbox fails to start. | -In either mode, a sandbox requires a kernel with Landlock ABI v3 or later. The -sandbox log's `Landlock ruleset built` event reports how many paths were applied -and skipped. +In either mode, a sandbox requires a kernel with Landlock ABI v3 or later. On an +older kernel, startup fails with an error that names the required and detected +ABI. The sandbox log's `Landlock ruleset built` event reports how many paths +were applied and skipped. ## Process diff --git a/fern/pages-dev/kubernetes/ingress.mdx b/fern/pages-dev/kubernetes/ingress.mdx index 69b18ea3f..b17d80640 100644 --- a/fern/pages-dev/kubernetes/ingress.mdx +++ b/fern/pages-dev/kubernetes/ingress.mdx @@ -265,6 +265,8 @@ If the release uses `workload.kind=deployment`, this upgrade replaces the Deploy Sandbox SSH uses the gateway endpoint registered with the CLI. No separate Helm SSH host or port values are required. +When a Gateway terminates TLS, register its externally reachable `https://` endpoint with the CLI. OpenShell uses that registered endpoint for `sandbox connect`, `sandbox exec`, and port forwarding, even when the gateway pod reports an internal plaintext endpoint. + ## Next Steps Return to [Setup](/kubernetes/setup) to complete the installation. diff --git a/fern/pages-dev/kubernetes/setup.mdx b/fern/pages-dev/kubernetes/setup.mdx index 53ecd932c..9b924c9d0 100644 --- a/fern/pages-dev/kubernetes/setup.mdx +++ b/fern/pages-dev/kubernetes/setup.mdx @@ -228,6 +228,18 @@ openshell status +## Upgrade OpenShell + +To upgrade, rerun `helm upgrade --install` with the new `--version` and the values you installed with. Running sandboxes keep their supervisor and sandbox runtime images until they stop. When a stopped sandbox starts, it takes both images from the upgraded gateway and keeps its workload image and workspace. + +If you override images, set `supervisor.image` and `sandboxRuntime.image` to the same release, or set only `global.image.tag`. An incompatible pair fails when a sandbox starts, and the supervisor log shows the cause while the start is in progress: + +```shell +kubectl -n openshell logs -l openshell.ai/sandbox-id=,openshell.ai/component=supervisor +``` + +After you correct the images, recover a sandbox whose start timed out as described in [Sandbox Lifecycle](/how-it-works/sandboxes/overview#sandbox-lifecycle). + ## Configure Chart Values The Helm chart renders `gatewayConfig` into the mounted `gateway.toml`