trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-27 07:03:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(website): sync dev docs from 4188eabaf2

Browse Source
This commit is contained in:
github-actions[bot]
2026-10-03 20:50:38 +00:00
parent 1437e5dc1c
commit b6722c8b1c
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fern/.docs-snapshots.yml
+3 -3
View File
@@ -1,8 +1,8 @@
snapshots:
dev:
source-ref: 48d9ab3d0d9a343365dea1b0cd87565050ac658e
source-sha: 48d9ab3d0d9a343365dea1b0cd87565050ac658e
version: 0.1.3.dev74
source-ref: 4188eabaf2d41fbf94f7d793f411af21b3a4685b
source-sha: 4188eabaf2d41fbf94f7d793f411af21b3a4685b
version: 0.1.3.dev78
latest:
source-ref: 6648bd0c290efbc41ba131ee9831ee45cd431f94
source-sha: 6648bd0c290efbc41ba131ee9831ee45cd431f94
fern/pages-dev/how-it-works/policies/schema.mdx
+3 -5
View File
@@ -89,11 +89,9 @@ and skipped.
| `run_as_group` | string | Driver default | `sandbox` or a numeric GID for the workload. |
A numeric ID must be from `1` through `4294967294`, so OpenShell rejects root.
Each field is independent, so you can set one and let the compute driver choose
the other. Only Docker and Podman apply these fields, and only from the policy
that you pass when you create the sandbox. Without them, Docker and Podman use
the image's `USER`. Kubernetes and VM sandboxes run as the identity configured
for their driver.
Each field is independent, so you can set one and let the compute driver choose the other. Docker and Podman use these fields to select the workload identity from the policy passed at creation; omitted fields use the image's `USER`. Kubernetes uses the identity configured for its driver.
MicroVM preserves the driver's resolved overlay owner. An explicit numeric selector must match that owner; `sandbox` names the guest account reconciled to that owner. A conflicting selector fails before the workload starts, and omitted fields accept the driver default. `openshell sandbox get <name>` reports the resolved UID:GID in its `WorkloadIdentity` condition. This condition reports identity selection, not workload readiness. Sandbox policy updates cannot change process selectors; global policy updates must still match the resolved identity. Ordinary exec uses the same identity as the canonical process.
```yaml showLineNumbers={false}
process:
fern/pages-dev/how-it-works/sandboxes/runtimes.mdx
+3 -1
View File
@@ -292,7 +292,7 @@ openshell sandbox create \
## Sandbox User Identity
Set `process.run_as_user` and `process.run_as_group` in the sandbox policy to choose the sandbox user. Any non-root UID or GID is allowed. When a field is unset, the driver supplies it:
On Docker and Podman, set `process.run_as_user` and `process.run_as_group` in the creation policy to choose the sandbox user. Selectors accept `sandbox` or numeric IDs from `1` through `4294967294`. Kubernetes and MicroVM select the identity through driver configuration. When a field is unset, the driver supplies it:
| Driver | Default identity |
|---|---|
@@ -300,4 +300,6 @@ Set `process.run_as_user` and `process.run_as_group` in the sandbox policy to ch
| Kubernetes | OpenShift SCC namespace annotations, otherwise `1000`. Override with `sandbox_uid` and `sandbox_gid`. |
| MicroVM | The image's `sandbox` account, otherwise `1000`. Override with `sandbox_uid` and `sandbox_gid`. |
MicroVM persists the resolved UID:GID with the writable overlay and retains it across restarts, even if driver defaults change. Explicit policy selectors must match that identity. For example, `run_as_user: "10000"` fails when the overlay owner is `1000:1000`; OpenShell reports both values without changing file ownership. The symbolic selector `sandbox` refers to the guest account for that owner, and each omitted selector accepts its driver default. The `WorkloadIdentity` condition in `openshell sandbox get <name>` shows the resolved pair separately from workload readiness. Canonical and exec processes use this same pair; live policy updates cannot change it.
On Docker, the image's `WORKDIR` becomes the workspace. Images with no `WORKDIR`, `/`, or `/sandbox` use `/sandbox`. Any other `WORKDIR` must exist in the image and be writable by the sandbox user. Podman, Kubernetes, and MicroVM always use `/sandbox`.