Matthew Grossman
537805568d
feat(sandbox): honor OCI image working directories ( #2530 )
...
* feat(sandbox): honor Docker OCI working directories
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): honor effective workspace access
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(sandbox): cover enforced workspace denial
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* docs(docker): explain effective workdir checks
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): validate effective workspace writes
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): reserve supervisor control roots
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* refactor(sandbox): centralize control paths
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): reserve OCI runtime mount roots
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
2026-08-04 17:38:51 +00:00
Matthew Grossman
bc14018cad
feat(sandbox): use policy-first OCI image identity ( #2509 )
...
* feat(sandbox): use policy-first OCI image identity
Closes #2331
Preserve per-field policy omission, derive Docker and Podman fallbacks from the inspected immutable image, and resolve the final numeric identity before starting agent children.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): preserve declared process identities
Keep explicit policy values and OCI-declared names intact, defer passwd lookup until a primary GID is required, and refresh stale policy examples.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(supervisor): reuse resolved OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(supervisor): allow Linux pre-exec arguments
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(kubernetes): protect resolved sandbox identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): prepare workspace for OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* refactor(sandbox): own only workspace root
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): harden partial identity drops
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(sandbox): scope OCI image e2e to Docker
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): narrow OCI identity fallback scope
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(podman): cover OCI identity launch
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(podman): exercise OCI fallback in E2E
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
2026-07-29 05:27:21 +00:00
Ignas Baranauskas
a72711697d
chore: remove deprecated --keep flag from docs, scripts, and e2e tests ( #2126 )
...
* docs: remove deprecated --keep flag from tutorials and examples
The --keep flag is deprecated, hidden, and a no-op since sandboxes
are kept by default. Remove references from tutorial docs and example
READMEs that explain it as a real feature.
- Remove --keep from sandbox create commands
- Remove --keep explanation text
- Clarify that sandboxes are kept by default
Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com >
* chore: remove deprecated --keep usage from scripts and e2e tests
The --keep flag is a deprecated no-op since sandboxes are kept by
default. Stop passing it in internal scripts, e2e test scripts,
and example demo scripts.
Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com >
---------
Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com >
2026-07-07 14:36:25 +02:00
Miyoung Choi
8322e4fd00
docs: style fixes ( #1341 )
...
* docs: style fixes
* docs: drop observability section overview page and rename a section title
* docs: title updates
2026-05-12 16:36:15 -07:00
Mesut Oezdil
721c39f1f3
docs: fix tutorial links pointing to /tutorials instead of /get-started/tutorials ( #1137 )
2026-05-02 13:35:31 -07:00
Mesut Oezdil
c0352272e5
docs: fix broken link and capitalise GitHub correctly ( #1135 )
...
Close the missing closing parenthesis on the Manage Providers link in
github-sandbox.mdx and correct four instances of "Github" to "GitHub"
across the docs.
Signed-off-by: mesutoezdil <mesudozdil@gmail.com >
2026-05-02 08:06:34 -07:00
Miyoung Choi
2c9c146cb6
docs: fix TOC structure ( #797 )
...
* docs: fix TOC structure
* docs: fix wrong section title
* remove Home
* fix(fern): properly add the landing page
2026-04-17 13:15:29 -07:00
Matthew Grossman