diff --git a/fern/.docs-snapshots.yml b/fern/.docs-snapshots.yml index b9e41549e..ba9ea6896 100644 --- a/fern/.docs-snapshots.yml +++ b/fern/.docs-snapshots.yml @@ -1,8 +1,8 @@ snapshots: dev: - source-ref: fa7dc269305f1cacf57efbfdb8a278293e4eb83a - source-sha: fa7dc269305f1cacf57efbfdb8a278293e4eb83a - version: 0.1.3.dev115 + source-ref: 1fff8b97b95e2e10b1cb48dec65e80b357787475 + source-sha: 1fff8b97b95e2e10b1cb48dec65e80b357787475 + version: 0.1.4.dev3 latest: source-ref: 6648bd0c290efbc41ba131ee9831ee45cd431f94 source-sha: 6648bd0c290efbc41ba131ee9831ee45cd431f94 diff --git a/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx b/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx index b3b9fa051..382e800e2 100644 --- a/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx +++ b/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx @@ -315,4 +315,6 @@ On Docker and Podman, set `process.run_as_user` and `process.run_as_group` in th MicroVM persists the resolved UID:GID with the writable overlay and retains it across restarts, even if driver defaults change. Explicit policy selectors must match that identity. For example, `run_as_user: "10000"` fails when the overlay owner is `1000:1000`; OpenShell reports both values without changing file ownership. The symbolic selector `sandbox` refers to the guest account for that owner, and each omitted selector accepts its driver default. The `WorkloadIdentity` condition in `openshell sandbox get ` shows the resolved pair separately from workload readiness. Canonical and exec processes use this same pair; live policy updates cannot change it. -On Docker, the image's `WORKDIR` becomes the workspace. Images with no `WORKDIR`, `/`, or `/sandbox` use `/sandbox`. Any other `WORKDIR` must exist in the image and be writable by the sandbox user. Podman, Kubernetes, and MicroVM always use `/sandbox`. +On Docker and Podman, the image's `WORKDIR` becomes the workspace. Images with no `WORKDIR`, `/`, or `/sandbox` use `/sandbox`. Any other `WORKDIR` must exist in the image and be writable by the sandbox user. Kubernetes and MicroVM always use `/sandbox`. + +Custom Docker and Podman workspaces use the workload container's writable layer, not a managed named volume. Files survive stop/start of the same container, but removing or replacing that container removes its workspace changes. Export files you need to retain before deleting the sandbox.