trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-27 07:03:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(website): sync dev docs from 1fff8b97b9

Browse Source
This commit is contained in:
github-actions[bot]
2026-10-07 22:16:23 +00:00
parent 25ad607cfe
commit e23de2a4b2
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fern/.docs-snapshots.yml
+3 -3
View File
@@ -1,8 +1,8 @@
snapshots:
dev:
source-ref: fa7dc269305f1cacf57efbfdb8a278293e4eb83a
source-sha: fa7dc269305f1cacf57efbfdb8a278293e4eb83a
version: 0.1.3.dev115
source-ref: 1fff8b97b95e2e10b1cb48dec65e80b357787475
source-sha: 1fff8b97b95e2e10b1cb48dec65e80b357787475
version: 0.1.4.dev3
latest:
source-ref: 6648bd0c290efbc41ba131ee9831ee45cd431f94
source-sha: 6648bd0c290efbc41ba131ee9831ee45cd431f94
fern/pages-dev/how-it-works/sandboxes/runtimes.mdx
+3 -1
View File
@@ -315,4 +315,6 @@ On Docker and Podman, set `process.run_as_user` and `process.run_as_group` in th
MicroVM persists the resolved UID:GID with the writable overlay and retains it across restarts, even if driver defaults change. Explicit policy selectors must match that identity. For example, `run_as_user: "10000"` fails when the overlay owner is `1000:1000`; OpenShell reports both values without changing file ownership. The symbolic selector `sandbox` refers to the guest account for that owner, and each omitted selector accepts its driver default. The `WorkloadIdentity` condition in `openshell sandbox get <name>` shows the resolved pair separately from workload readiness. Canonical and exec processes use this same pair; live policy updates cannot change it.
On Docker, the image's `WORKDIR` becomes the workspace. Images with no `WORKDIR`, `/`, or `/sandbox` use `/sandbox`. Any other `WORKDIR` must exist in the image and be writable by the sandbox user. Podman, Kubernetes, and MicroVM always use `/sandbox`.
On Docker and Podman, the image's `WORKDIR` becomes the workspace. Images with no `WORKDIR`, `/`, or `/sandbox` use `/sandbox`. Any other `WORKDIR` must exist in the image and be writable by the sandbox user. Kubernetes and MicroVM always use `/sandbox`.
Custom Docker and Podman workspaces use the workload container's writable layer, not a managed named volume. Files survive stop/start of the same container, but removing or replacing that container removes its workspace changes. Export files you need to retain before deleting the sandbox.