mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Eric Curtin
1c8417c4dd
The existing docs omitted or misstated several requirements when running the gateway as a container with the Docker compute driver: - OPENSHELL_GRPC_ENDPOINT is required; the Docker driver uses only the scheme (http/https) — host and port are substituted automatically with host.openshell.internal and the gateway's own bind port - Supervisor binary must be extracted to a host path before starting the gateway; bind-mount sources are resolved by the host Docker daemon so the path must be identical inside and outside the gateway container - Docker socket access requires adding the docker group (UID 1000 default) - Port binding should remain 127.0.0.1; Docker driver adds a bridge listener automatically - add --server-san host.openshell.internal to generate-certs for mTLS - Complete the mTLS docker run with all Docker driver requirements - Add deploy/docker/gateway.toml — TOML config for the Docker driver - Add deploy/docker/docker-compose.yml referencing the TOML - Add docs/get-started/tutorials/docker-compose.mdx tutorial page - Remote gateway registration instructions (--remote flag) Address reviewer feedback: - Move Docker Compose tutorials card to the bottom of the list - Replace inline YAML snippet in Docker Compose section with a reference to deploy/docker/ to avoid drift - Clarify OPENSHELL_DB_URL is safe in compose.yml (plain SQLite path, no credentials); the TOML block targets credential-bearing DSNs - Note that ./ in source: resolves relative to the compose file directory - Clarify that only the scheme from OPENSHELL_GRPC_ENDPOINT matters - Add note that the tilde volume mount resolves to the same absolute path on both host and container
46 lines
1.8 KiB
Plaintext
46 lines
1.8 KiB
Plaintext
---
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
title: "Tutorials"
|
|
slug: "get-started/tutorials"
|
|
description: "Step-by-step walkthroughs for OpenShell, from first sandbox to production-ready policies."
|
|
keywords: "Generative AI, Cybersecurity, Tutorial, Sandbox, Policy"
|
|
position: 1
|
|
---
|
|
|
|
Hands-on walkthroughs that teach OpenShell concepts by building real configurations. Each tutorial builds on the previous one, starting with core sandbox mechanics and progressing to production workflows.
|
|
|
|
<Cards>
|
|
|
|
<Card title="First Network Policy" href="/get-started/tutorials/first-network-policy">
|
|
|
|
Create a sandbox, observe default-deny networking, apply a read-only L7 policy, and inspect audit logs. No AI agent required.
|
|
</Card>
|
|
|
|
<Card title="GitHub Push Access" href="/get-started/tutorials/github-sandbox">
|
|
|
|
Launch Claude Code in a sandbox, diagnose a policy denial, and iterate on a custom GitHub policy from outside the sandbox.
|
|
</Card>
|
|
|
|
<Card title="Microsoft Graph Provider Refresh" href="/get-started/tutorials/microsoft-graph-provider-refresh">
|
|
|
|
Configure a Providers v2 Microsoft Graph provider with gateway-managed OAuth2 refresh-token rotation.
|
|
</Card>
|
|
|
|
<Card title="Inference with Ollama" href="/get-started/tutorials/inference-ollama">
|
|
|
|
Route inference through Ollama using cloud-hosted or local models, and verify it from a sandbox.
|
|
</Card>
|
|
|
|
<Card title="Local Inference with LM Studio" href="/get-started/tutorials/local-inference-lmstudio">
|
|
|
|
Route inference to a local LM Studio server using the OpenAI-compatible or Anthropic-compatible APIs.
|
|
</Card>
|
|
|
|
<Card title="Docker Compose Setup" href="/get-started/tutorials/docker-compose">
|
|
|
|
Run the OpenShell gateway as a Docker Compose service and create agent sandboxes including OpenClaw.
|
|
</Card>
|
|
|
|
</Cards>
|