Matthew Grossman
537805568d
feat(sandbox): honor OCI image working directories ( #2530 )
...
* feat(sandbox): honor Docker OCI working directories
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): honor effective workspace access
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(sandbox): cover enforced workspace denial
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* docs(docker): explain effective workdir checks
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): validate effective workspace writes
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): reserve supervisor control roots
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* refactor(sandbox): centralize control paths
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): reserve OCI runtime mount roots
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
2026-08-04 17:38:51 +00:00
Matthew Grossman
bc14018cad
feat(sandbox): use policy-first OCI image identity ( #2509 )
...
* feat(sandbox): use policy-first OCI image identity
Closes #2331
Preserve per-field policy omission, derive Docker and Podman fallbacks from the inspected immutable image, and resolve the final numeric identity before starting agent children.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): preserve declared process identities
Keep explicit policy values and OCI-declared names intact, defer passwd lookup until a primary GID is required, and refresh stale policy examples.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(supervisor): reuse resolved OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(supervisor): allow Linux pre-exec arguments
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(kubernetes): protect resolved sandbox identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): prepare workspace for OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* refactor(sandbox): own only workspace root
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): harden partial identity drops
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(sandbox): scope OCI image e2e to Docker
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): narrow OCI identity fallback scope
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(podman): cover OCI identity launch
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(podman): exercise OCI fallback in E2E
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
2026-07-29 05:27:21 +00:00
Miyoung Choi
8322e4fd00
docs: style fixes ( #1341 )
...
* docs: style fixes
* docs: drop observability section overview page and rename a section title
* docs: title updates
2026-05-12 16:36:15 -07:00
Drew Newberry
f56c09c7df
docs: update gateway deployment architecture ( #1108 )
2026-05-04 22:52:29 -07:00
John T. Myers
6b21804258
feat(policy): add GraphQL L7 inspection ( #1083 )
...
Support GraphQL L7 policies
2026-05-04 11:50:09 -07:00
Mesut Oezdil
c0352272e5
docs: fix broken link and capitalise GitHub correctly ( #1135 )
...
Close the missing closing parenthesis on the Manage Providers link in
github-sandbox.mdx and correct four instances of "Github" to "GitHub"
across the docs.
Signed-off-by: mesutoezdil <mesudozdil@gmail.com >
2026-05-02 08:06:34 -07:00
Piotr Mlocek
df38d1f66f
feat(ci): add Markdown and Mermaid linting ( #933 )
2026-04-24 11:27:02 -07:00
Miyoung Choi
2c9c146cb6
docs: fix TOC structure ( #797 )
...
* docs: fix TOC structure
* docs: fix wrong section title
* remove Home
* fix(fern): properly add the landing page
2026-04-17 13:15:29 -07:00
Matthew Grossman