trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-26 06:52:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(website): sync dev docs from f6a39833c3

Browse Source
This commit is contained in:
github-actions[bot]
2026-10-12 19:55:14 +00:00
parent 8cc904cd7c
commit 9bc6a69591
6 changed files with 16 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fern/.docs-snapshots.yml
+3 -3
View File
@@ -1,8 +1,8 @@
snapshots:
dev:
source-ref: 749d09e34459d86d402057f1c9564247ef3cc74e
source-sha: 749d09e34459d86d402057f1c9564247ef3cc74e
version: 0.1.4.dev16
source-ref: f6a39833c34f2ff9b74d07c8c87370f86ffc2a49
source-sha: f6a39833c34f2ff9b74d07c8c87370f86ffc2a49
version: 0.1.4.dev20
latest:
source-ref: e1f3c82caa3ed3b65de22889ae7ef32a774878ef
source-sha: e1f3c82caa3ed3b65de22889ae7ef32a774878ef
fern/pages-dev/CONTRIBUTING.mdx
+1
View File
@@ -153,6 +153,7 @@ Use these consistently:
| NVIDIA | Nvidia, nvidia |
| OpenShell | Open Shell, openShell, Openshell, openshell |
| mTLS | MTLS, mtls |
| snap, or Snap when required by sentence or title case | Snap as an inherent proper noun |
| YAML | yaml, Yaml |
## Submitting Doc Changes
fern/pages-dev/about/installation.mdx
+4 -4
View File
@@ -86,7 +86,7 @@ The gateway reads `~/.config/openshell/gateway.toml` if it exists, otherwise the
## Linux
The script installs a Debian package on Debian and Ubuntu or an RPM package on Fedora and RHEL. Set `OPENSHELL_INSTALL_METHOD=snap` to install the [Snap](#snap) package instead; hosts that already have the OpenShell snap keep refreshing it. Linux packages require glibc 2.28 or newer.
The script installs a Debian package on Debian and Ubuntu or an RPM package on Fedora and RHEL. Set `OPENSHELL_INSTALL_METHOD=snap` to install the [snap](#snap) package instead; hosts that already have the OpenShell snap keep refreshing it. Linux packages require glibc 2.28 or newer.
The gateway runs as a systemd user service at `https://127.0.0.1:17670` and reads `~/.config/openshell/gateway.toml`.
@@ -142,7 +142,7 @@ openshell status
Existing installations upgraded from the former `openshell.gateway` service retain their state under `/var/snap/openshell/common` through `openshell.system-gateway`. Existing HTTPS registrations continue to work because the endpoint and TLS identity do not change.
If this user still has an old HTTP registration, or has not previously been enrolled, wait for the system gateway to be active, copy its client credentials into the user's Snap state, and register its HTTPS endpoint:
If this user still has an old HTTP registration, or has not previously been enrolled, wait for the system gateway to be active, copy its client credentials into the user's snap state, and register its HTTPS endpoint:
```shell
snap services openshell.system-gateway
@@ -161,9 +161,9 @@ openshell gateway add https://127.0.0.1:17670 --local --name openshell
openshell status
```
Set `old_registration` to the name shown by `openshell gateway list`, and omit the variable assignment and `openshell gateway remove` when no registration exists. Older direct Snap instructions may have used `openshell-gateway`, while the install script uses `openshell`.
Set `old_registration` to the name shown by `openshell gateway list`, and omit the variable assignment and `openshell gateway remove` when no registration exists. Older direct snap instructions may have used `openshell-gateway`, while the install script uses `openshell`.
### Change the Snap gateway mode
### Change the snap gateway mode
The user and system gateways have separate configuration, databases, and cryptographic identities. Changing modes does not migrate gateway or sandbox state and interrupts active sandbox sessions. Back up any state you need and delete active sandboxes before changing modes.
fern/pages-dev/about/support-matrix.mdx
+2 -2
View File
@@ -112,9 +112,9 @@ OpenShell publishes standalone `openshell-prover` release assets for manual down
These artifacts are attached to GitHub releases. The Linux binaries are static and do not require glibc. All prover archives include the required solver linkage.
The Debian, RPM, Homebrew, and Snap packages also include the prover. Debian,
The Debian, RPM, Homebrew, and snap packages also include the prover. Debian,
RPM, and Homebrew installations expose it as `openshell-prover`; use
`openshell.prover` with the Snap. The `openshell-prover` Snap alias requires
`openshell.prover` with the snap. The `openshell-prover` snap alias requires
Store approval and may not be available.
## Runtimes
fern/pages-dev/how-it-works/gateways/configuration.mdx
+2 -2
View File
@@ -65,7 +65,7 @@ Package-managed gateways use either built-in defaults or a package-seeded TOML f
| Homebrew | `$XDG_CONFIG_HOME/openshell/gateway.toml` when it exists, otherwise the Homebrew prefix config such as `/opt/homebrew/var/openshell/gateway.toml`. |
| Debian/Ubuntu | `$XDG_CONFIG_HOME/openshell/gateway.toml`, usually `~/.config/openshell/gateway.toml` for the systemd user service. |
| Fedora/RHEL RPM | `$XDG_CONFIG_HOME/openshell/gateway.toml`, usually `~/.config/openshell/gateway.toml`; the systemd user service seeds this file from the packaged template on first start. |
| Snap | New installations use `$SNAP_USER_COMMON/.config/openshell/gateway.toml`, usually `~/snap/openshell/common/.config/openshell/gateway.toml`. Upgraded legacy installations retain `$SNAP_COMMON/gateway.toml`, usually `/var/snap/openshell/common/gateway.toml`. |
| snap | New installations use `$SNAP_USER_COMMON/.config/openshell/gateway.toml`, usually `~/snap/openshell/common/.config/openshell/gateway.toml`. Upgraded legacy installations retain `$SNAP_COMMON/gateway.toml`, usually `/var/snap/openshell/common/gateway.toml`. |
The Fedora/RHEL RPM template leaves `[openshell.gateway].bind_address` unset. The gateway therefore uses its built-in `127.0.0.1:17670` primary listener. Host-networked Podman supervisors use that same loopback endpoint, so the primary listener does not need a wildcard address. Set `bind_address` explicitly only when clients must reach the primary multiplexed API through another interface.
@@ -1335,7 +1335,7 @@ openshell-gateway config preflight -- --config /etc/openshell/gateway.toml --grp
Debian and Ubuntu run preflight from the systemd user unit before local certificate
generation. The unit still loads the `gateway.env` environment file and starts the
gateway with no configuration arguments. Snap replays the exact effective daemon
gateway with no configuration arguments. snap replays the exact effective daemon
arguments through preflight. It gives a nonempty `OPENSHELL_GATEWAY_CONFIG`
precedence; otherwise it validates and passes its canonical service-specific
path only when that path exists in the filesystem. The legacy system service
fern/pages-dev/how-it-works/policies/prover.mdx
+4 -4
View File
@@ -36,8 +36,8 @@ contain access that the proposal risk check would flag.
This page covers the boundary check. To learn about the proposal risk check,
refer to [Policy Advisor](/how-it-works/policies/advisor).
For Snap installations, replace `openshell-prover` in these examples with
`openshell.prover`. The `openshell-prover` Snap alias requires Store approval
For snap installations, replace `openshell-prover` in these examples with
`openshell.prover`. The `openshell-prover` snap alias requires Store approval
and may not be available.
The prover remains independent of the gateway at runtime. If you only need the
@@ -60,9 +60,9 @@ or MCP rules, the prover reports that it cannot check the policy instead of
ignoring those rules. [What the Boundary Check
Covers](#what-the-boundary-check-covers) describes each part and its limits.
The Homebrew, Debian, RPM, and Snap packages install the prover. Homebrew,
The Homebrew, Debian, RPM, and snap packages install the prover. Homebrew,
Debian, and RPM expose it as `openshell-prover`; use `openshell.prover` with the
Snap. The CLI reads policy files on your machine, does not need a gateway, and
snap. The CLI reads policy files on your machine, does not need a gateway, and
does not apply or approve policies.
Create `boundary.yaml`, a boundary that allows reading `/usr` and `/etc`: