Drew Newberry
9244868056
docs: refresh architecture and agent guides ( #3705 )
...
* docs: refresh architecture and agent guides
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: describe updated security architecture neutrally
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: highlight new isolation primitives
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs(sandboxes): clarify how to disconnect
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: align architecture and guides with current navigation
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs(extensibility): streamline extension authentication guidance
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
---------
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
2026-09-25 02:38:00 -07:00
Drew Newberry
a649aa42fc
docs: add 0.1.0 upgrade guide outline ( #3540 )
...
* docs: add 0.1.0 upgrade guide outline
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: add upgrade change provenance
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: update 0.1.0 upgrade guidance
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: move upgrade navigation below security
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: remove release notes page
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: announce OpenShell 0.1.0
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: reorganize guides and require user-owned images
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: reorganize navigation around core concepts
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: simplify navigation and tutorial catalog
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: refine 0.1.0 release highlights
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
* docs: align navigation and 0.1.0 guidance
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
---------
Signed-off-by: Drew Newberry <anewberry@nvidia.com >
2026-09-23 20:26:25 +00:00
Russell Bryant
172b65e788
docs: fix first-network-policy sandbox lifecycle flow ( #3140 )
...
The tutorial told users to exit the sandbox and reconnect later, but
exiting the interactive shell stops the sandbox's main process and it is
not reconnectable under the default restart policy. Switch to the
two-terminal flow already used by the github-sandbox tutorial so the
sandbox stays running, matching what examples/sandbox-policy-quickstart/
demo.sh actually does.
Related: #2998 , #2798
Signed-off-by: Russell Bryant <rbryant@redhat.com >
2026-09-02 21:22:25 +00:00
Matthew Grossman
537805568d
feat(sandbox): honor OCI image working directories ( #2530 )
...
* feat(sandbox): honor Docker OCI working directories
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): honor effective workspace access
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(sandbox): cover enforced workspace denial
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* docs(docker): explain effective workdir checks
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): validate effective workspace writes
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): reserve supervisor control roots
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* refactor(sandbox): centralize control paths
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): reserve OCI runtime mount roots
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
2026-08-04 17:38:51 +00:00
Matthew Grossman
bc14018cad
feat(sandbox): use policy-first OCI image identity ( #2509 )
...
* feat(sandbox): use policy-first OCI image identity
Closes #2331
Preserve per-field policy omission, derive Docker and Podman fallbacks from the inspected immutable image, and resolve the final numeric identity before starting agent children.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): preserve declared process identities
Keep explicit policy values and OCI-declared names intact, defer passwd lookup until a primary GID is required, and refresh stale policy examples.
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(supervisor): reuse resolved OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(supervisor): allow Linux pre-exec arguments
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(kubernetes): protect resolved sandbox identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): prepare workspace for OCI identity
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* refactor(sandbox): own only workspace root
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): harden partial identity drops
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(sandbox): scope OCI image e2e to Docker
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(sandbox): narrow OCI identity fallback scope
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* test(podman): cover OCI identity launch
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
* fix(podman): exercise OCI fallback in E2E
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
---------
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com >
2026-07-29 05:27:21 +00:00
Ignas Baranauskas
a72711697d
chore: remove deprecated --keep flag from docs, scripts, and e2e tests ( #2126 )
...
* docs: remove deprecated --keep flag from tutorials and examples
The --keep flag is deprecated, hidden, and a no-op since sandboxes
are kept by default. Remove references from tutorial docs and example
READMEs that explain it as a real feature.
- Remove --keep from sandbox create commands
- Remove --keep explanation text
- Clarify that sandboxes are kept by default
Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com >
* chore: remove deprecated --keep usage from scripts and e2e tests
The --keep flag is a deprecated no-op since sandboxes are kept by
default. Stop passing it in internal scripts, e2e test scripts,
and example demo scripts.
Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com >
---------
Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com >
2026-07-07 14:36:25 +02:00
Miyoung Choi
8322e4fd00
docs: style fixes ( #1341 )
...
* docs: style fixes
* docs: drop observability section overview page and rename a section title
* docs: title updates
2026-05-12 16:36:15 -07:00
Mesut Oezdil
721c39f1f3
docs: fix tutorial links pointing to /tutorials instead of /get-started/tutorials ( #1137 )
2026-05-02 13:35:31 -07:00
Mesut Oezdil
c0352272e5
docs: fix broken link and capitalise GitHub correctly ( #1135 )
...
Close the missing closing parenthesis on the Manage Providers link in
github-sandbox.mdx and correct four instances of "Github" to "GitHub"
across the docs.
Signed-off-by: mesutoezdil <mesudozdil@gmail.com >
2026-05-02 08:06:34 -07:00
Miyoung Choi
2c9c146cb6
docs: fix TOC structure ( #797 )
...
* docs: fix TOC structure
* docs: fix wrong section title
* remove Home
* fix(fern): properly add the landing page
2026-04-17 13:15:29 -07:00
Drew Newberry