mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-22 06:19:47 +08:00
Alexander Watson
158c925342
* docs(examples): add sandbox policy quickstart walkthrough Add an interactive getting-started example that demonstrates OpenShell's network policy system end-to-end: default-deny, L7 read-only access, and audit logging — all with a single YAML policy file. - examples/sandbox-policy-quickstart/policy.yaml: policy with default static fields (filesystem, landlock, process) so it works out of the box with `openshell policy set` - examples/sandbox-policy-quickstart/demo.sh: automated demo script using printf (portable) and openshell ssh-proxy for sandbox exec - examples/sandbox-policy-quickstart/README.md: step-by-step manual walkthrough - README.md: add "See network policy in action" section linking to the quickstart Signed-off-by: Alexander Watson <zredlined@gmail.com> Made-with: Cursor Signed-off-by: Alexander Watson <zredlined@gmail.com> Made-with: Cursor * docs: soften default-deny wording to minimal outbound access Sandbox defaults vary by type and community configs, so "all outbound traffic is blocked" is too absolute. Made-with: Cursor * docs: use curl -sS so L4 deny errors are visible curl -s suppresses stderr, hiding the 403 from the CONNECT proxy. Adding -S ensures the error message is always shown. Made-with: Cursor --------- Signed-off-by: Alexander Watson <zredlined@gmail.com>
34 lines
955 B
YAML
34 lines
955 B
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Allow curl to read from the GitHub REST API.
|
|
# POST, PUT, PATCH, and DELETE are blocked by the "read-only" preset.
|
|
|
|
version: 1
|
|
|
|
# Default sandbox filesystem and process settings.
|
|
# These static fields are required when using `openshell policy set`
|
|
# because it replaces the entire policy.
|
|
filesystem_policy:
|
|
include_workdir: true
|
|
read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
|
|
read_write: [/sandbox, /tmp, /dev/null]
|
|
landlock:
|
|
compatibility: best_effort
|
|
process:
|
|
run_as_user: sandbox
|
|
run_as_group: sandbox
|
|
|
|
network_policies:
|
|
github_api:
|
|
name: github-api-readonly
|
|
endpoints:
|
|
- host: api.github.com
|
|
port: 443
|
|
protocol: rest
|
|
tls: terminate
|
|
enforcement: enforce
|
|
access: read-only
|
|
binaries:
|
|
- { path: /usr/bin/curl }
|