* docs(examples): add sandbox policy quickstart walkthrough
Add an interactive getting-started example that demonstrates OpenShell's
network policy system end-to-end: default-deny, L7 read-only access,
and audit logging — all with a single YAML policy file.
- examples/sandbox-policy-quickstart/policy.yaml: policy with default
static fields (filesystem, landlock, process) so it works out of the
box with `openshell policy set`
- examples/sandbox-policy-quickstart/demo.sh: automated demo script
using printf (portable) and openshell ssh-proxy for sandbox exec
- examples/sandbox-policy-quickstart/README.md: step-by-step manual
walkthrough
- README.md: add "See network policy in action" section linking to the
quickstart
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Made-with: Cursor
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Made-with: Cursor
* docs: soften default-deny wording to minimal outbound access
Sandbox defaults vary by type and community configs, so
"all outbound traffic is blocked" is too absolute.
Made-with: Cursor
* docs: use curl -sS so L4 deny errors are visible
curl -s suppresses stderr, hiding the 403 from the CONNECT
proxy. Adding -S ensures the error message is always shown.
Made-with: Cursor
---------
Signed-off-by: Alexander Watson <zredlined@gmail.com>
## Summary
- Rewrites the README quickstart with accurate, tested setup steps (Docker prerequisite, venv/uv usage)
- Moves the "developing from source" instructions into CONTRIBUTING.md
- Removes the manual cluster deploy step from quickstart (cluster bootstraps automatically on sandbox create)
- Fixes empty bash array expansion in Docker build scripts that broke on macOS default bash 3.2 (`set -u` treats `"${EMPTY_ARRAY[@]}"` as unbound)
## Changes
- **README.md**: Replace placeholder quickstart with working install and sandbox create steps; remove manual cluster deploy step since it happens automatically
- **CONTRIBUTING.md**: Add "developing from source" section with mise setup instructions
- **build/scripts/docker-build-cluster.sh**: Use `${arr[@]+"${arr[@]}"}` pattern for safe empty array expansion
- **build/scripts/docker-build-component.sh**: Same fix
John T. Myers