mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-27 07:03:17 +08:00
872 lines
46 KiB
HTML
872 lines
46 KiB
HTML
|
|
|
|
<!DOCTYPE html>
|
|
|
|
|
|
<html lang="en" data-content_root="../" >
|
|
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
|
|
<title>Set Up a Sandbox of Claude Code with a Custom GitHub Policy — NVIDIA OpenShell Developer Guide</title>
|
|
|
|
|
|
|
|
<script data-cfasync="false">
|
|
document.documentElement.dataset.mode = localStorage.getItem("mode") || "";
|
|
document.documentElement.dataset.theme = localStorage.getItem("theme") || "";
|
|
</script>
|
|
<!--
|
|
this give us a css class that will be invisible only if js is disabled
|
|
-->
|
|
<noscript>
|
|
<style>
|
|
.pst-js-only { display: none !important; }
|
|
|
|
</style>
|
|
</noscript>
|
|
|
|
<!-- Loaded before other Sphinx assets -->
|
|
<link href="../_static/styles/theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
|
|
<link href="../_static/styles/pydata-sphinx-theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
|
|
|
|
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=8f2a1f02" />
|
|
<link rel="stylesheet" type="text/css" href="../_static/styles/nvidia-sphinx-theme.css?v=933278ad" />
|
|
<link rel="stylesheet" type="text/css" href="../_static/copybutton.css?v=76b2166b" />
|
|
<link rel="stylesheet" type="text/css" href="../_static/enhanced-search.css?v=2e2db37d" />
|
|
<link rel="stylesheet" type="text/css" href="../_static/sphinx-design.min.css?v=95c83b7e" />
|
|
|
|
<!-- So that users can add custom icons -->
|
|
<script src="../_static/scripts/fontawesome.js?digest=8878045cc6db502f8baf"></script>
|
|
<!-- Pre-loaded scripts that we'll load fully later -->
|
|
<link rel="preload" as="script" href="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf" />
|
|
<link rel="preload" as="script" href="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf" />
|
|
|
|
|
|
|
|
<script src="../_static/documentation_options.js?v=2caa9db7"></script>
|
|
<script src="../_static/doctools.js?v=9a2dae69"></script>
|
|
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
|
|
<script src="../_static/clipboard.min.js?v=a7894cd8"></script>
|
|
<script src="../_static/copybutton.js?v=6dbb43f8"></script>
|
|
<script src="../_static/search-assets.bundle.js?v=00e3e057"></script>
|
|
<script src="../_static/design-tabs.js?v=f930bc37"></script>
|
|
<script>DOCUMENTATION_OPTIONS.pagename = 'tutorials/github-sandbox';</script>
|
|
|
|
<link rel="icon" href="../_static/favicon.png"/>
|
|
|
|
<link rel="search" title="Search" href="../search.html" />
|
|
<link rel="next" title="About Sandboxes" href="../sandboxes/index.html" />
|
|
<link rel="prev" title="Quickstart" href="../get-started/quickstart.html" />
|
|
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
|
<meta name="docsearch:language" content="en"/>
|
|
<meta name="docsearch:version" content="" />
|
|
|
|
|
|
</head>
|
|
|
|
|
|
|
|
<body data-bs-spy="scroll" data-bs-target=".bd-toc-nav" data-offset="180" data-bs-root-margin="0px 0px -60%" data-default-mode="">
|
|
|
|
|
|
|
|
<div id="pst-skip-link" class="skip-link d-print-none"><a href="#main-content">Skip to main content</a></div>
|
|
|
|
|
|
|
|
<div id="pst-scroll-pixel-helper"></div>
|
|
|
|
<button type="button" class="btn rounded-pill" id="pst-back-to-top">
|
|
<i class="fa-solid fa-arrow-up"></i>Back to top</button>
|
|
|
|
|
|
<dialog id="pst-search-dialog">
|
|
|
|
<form class="bd-search d-flex align-items-center"
|
|
action="../search.html"
|
|
method="get">
|
|
<i class="fa-solid fa-magnifying-glass"></i>
|
|
<input type="search"
|
|
class="form-control"
|
|
name="q"
|
|
placeholder="Search the docs ..."
|
|
aria-label="Search the docs ..."
|
|
autocomplete="off"
|
|
autocorrect="off"
|
|
autocapitalize="off"
|
|
spellcheck="false"/>
|
|
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd>K</kbd></span>
|
|
</form>
|
|
</dialog>
|
|
|
|
<div class="pst-async-banner-revealer d-none">
|
|
<aside id="bd-header-version-warning" class="d-none d-print-none" aria-label="Version warning"></aside>
|
|
</div>
|
|
|
|
|
|
<header class="bd-header navbar navbar-expand-lg bd-navbar d-print-none">
|
|
<div class="bd-header__inner bd-page-width">
|
|
<button class="pst-navbar-icon sidebar-toggle primary-toggle" aria-label="Site navigation">
|
|
<span class="fa-solid fa-bars"></span>
|
|
</button>
|
|
|
|
|
|
<div class="col-lg-3 navbar-header-items__start">
|
|
|
|
<div class="navbar-item">
|
|
|
|
|
|
|
|
|
|
|
|
<a class="navbar-brand logo" href="../index.html">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<img src="../_static/nvidia-logo-horiz-rgb-blk-for-screen.svg" class="logo__image only-light" alt="NVIDIA OpenShell Developer Guide - Home"/>
|
|
<img src="../_static/nvidia-logo-horiz-rgb-wht-for-screen.svg" class="logo__image only-dark pst-js-only" alt="NVIDIA OpenShell Developer Guide - Home"/>
|
|
|
|
|
|
<p class="title logo__title">NVIDIA OpenShell Developer Guide</p>
|
|
|
|
</a></div>
|
|
|
|
</div>
|
|
|
|
<div class="col-lg-9 navbar-header-items">
|
|
|
|
|
|
<div class="navbar-header-items__end">
|
|
|
|
<div class="navbar-item navbar-persistent--container">
|
|
|
|
|
|
<button class="btn search-button-field search-button__button pst-js-only" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
|
<i class="fa-solid fa-magnifying-glass"></i>
|
|
<span class="search-button__default-text">Search</span>
|
|
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
|
|
</button>
|
|
</div>
|
|
|
|
|
|
<div class="navbar-item">
|
|
|
|
<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button pst-js-only" aria-label="Color mode" data-bs-title="Color mode" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
|
<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light" title="Light"></i>
|
|
<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark" title="Dark"></i>
|
|
<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto" title="System Settings"></i>
|
|
</button></div>
|
|
|
|
<div class="navbar-item"><ul class="navbar-icon-links"
|
|
aria-label="Icon Links">
|
|
<li class="nav-item">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a href="https://github.com/NVIDIA/OpenShell" title="GitHub" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-github fa-lg" aria-hidden="true"></i>
|
|
<span class="sr-only">GitHub</span></a>
|
|
</li>
|
|
<li class="nav-item">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a href="https://pypi.org/project/openshell/" title="PyPI" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-python fa-lg" aria-hidden="true"></i>
|
|
<span class="sr-only">PyPI</span></a>
|
|
</li>
|
|
</ul></div>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
|
|
<div class="navbar-persistent--mobile">
|
|
|
|
<button class="btn search-button-field search-button__button pst-js-only" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
|
<i class="fa-solid fa-magnifying-glass"></i>
|
|
<span class="search-button__default-text">Search</span>
|
|
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
|
|
</button>
|
|
</div>
|
|
|
|
|
|
|
|
<button class="pst-navbar-icon sidebar-toggle secondary-toggle" aria-label="On this page">
|
|
<span class="fa-solid fa-outdent"></span>
|
|
</button>
|
|
|
|
</div>
|
|
|
|
</header>
|
|
|
|
|
|
<div class="bd-container">
|
|
<div class="bd-container__inner bd-page-width">
|
|
|
|
|
|
|
|
<dialog id="pst-primary-sidebar-modal"></dialog>
|
|
<div id="pst-primary-sidebar" class="bd-sidebar-primary bd-sidebar">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="navbar-brand logo" href="../index.html">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<img src="../_static/nvidia-logo-horiz-rgb-blk-for-screen.svg" class="logo__image only-light" alt="NVIDIA OpenShell Developer Guide - Home"/>
|
|
<img src="../_static/nvidia-logo-horiz-rgb-wht-for-screen.svg" class="logo__image only-dark pst-js-only" alt="NVIDIA OpenShell Developer Guide - Home"/>
|
|
|
|
|
|
<p class="title logo__title">NVIDIA OpenShell Developer Guide</p>
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<div class="sidebar-header-items sidebar-primary__section">
|
|
|
|
|
|
|
|
|
|
<div class="sidebar-header-items__end">
|
|
|
|
<div class="navbar-item">
|
|
|
|
<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button pst-js-only" aria-label="Color mode" data-bs-title="Color mode" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
|
<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light" title="Light"></i>
|
|
<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark" title="Dark"></i>
|
|
<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto" title="System Settings"></i>
|
|
</button></div>
|
|
|
|
<div class="navbar-item"><ul class="navbar-icon-links"
|
|
aria-label="Icon Links">
|
|
<li class="nav-item">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a href="https://github.com/NVIDIA/OpenShell" title="GitHub" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-github fa-lg" aria-hidden="true"></i>
|
|
<span class="sr-only">GitHub</span></a>
|
|
</li>
|
|
<li class="nav-item">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a href="https://pypi.org/project/openshell/" title="PyPI" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-python fa-lg" aria-hidden="true"></i>
|
|
<span class="sr-only">PyPI</span></a>
|
|
</li>
|
|
</ul></div>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div class="sidebar-primary-items__start sidebar-primary__section">
|
|
<div class="sidebar-primary-item">
|
|
|
|
|
|
|
|
<nav class="bd-docs-nav bd-links"
|
|
aria-label="Table of Contents">
|
|
<p class="bd-links__title" role="heading" aria-level="1">Table of Contents</p>
|
|
<div class="bd-toc-item navbar-nav"><ul class="nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../index.html">Home</a></li>
|
|
</ul>
|
|
<p aria-level="2" class="caption" role="heading"><span class="caption-text">About NVIDIA OpenShell</span></p>
|
|
<ul class="nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../about/overview.html">Overview</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../about/architecture.html">How It Works</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../about/release-notes.html">Release Notes</a></li>
|
|
</ul>
|
|
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Get Started</span></p>
|
|
<ul class="current nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../get-started/quickstart.html">Quickstart</a></li>
|
|
<li class="toctree-l1 current active"><a class="current reference internal" href="#">Sandboxing Agents with Custom GitHub Policies</a></li>
|
|
</ul>
|
|
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Sandboxes</span></p>
|
|
<ul class="nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/index.html">About Sandboxes</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/create-and-manage.html">Create and Manage Sandboxes</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/providers.html">Providers</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/policies.html">Customize Sandbox Policies</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/community-sandboxes.html">Community Sandboxes</a></li>
|
|
</ul>
|
|
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Inference Routing</span></p>
|
|
<ul class="nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../inference/index.html">About Inference Routing</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../inference/configure.html">Configure Inference Routing</a></li>
|
|
</ul>
|
|
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Reference</span></p>
|
|
<ul class="nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../reference/cli.html">CLI Reference</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../reference/default-policy.html">Default Policy Reference</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../reference/policy-schema.html">Policy Schema Reference</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="../reference/support-matrix.html">Support Matrix</a></li>
|
|
</ul>
|
|
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Resources</span></p>
|
|
<ul class="nav bd-sidenav">
|
|
<li class="toctree-l1"><a class="reference internal" href="../resources/eula.html">License</a></li>
|
|
</ul>
|
|
</div>
|
|
</nav></div>
|
|
</div>
|
|
|
|
|
|
<div class="sidebar-primary-items__end sidebar-primary__section">
|
|
</div>
|
|
|
|
|
|
|
|
</div>
|
|
|
|
<main id="main-content" class="bd-main" role="main">
|
|
|
|
|
|
<div class="bd-content">
|
|
<div class="bd-article-container">
|
|
|
|
<div class="bd-header-article d-print-none">
|
|
<div class="header-article-items header-article__inner">
|
|
|
|
<div class="header-article-items__start">
|
|
|
|
<div class="header-article-item">
|
|
|
|
<nav aria-label="Breadcrumb" class="d-print-none">
|
|
<ul class="bd-breadcrumbs">
|
|
|
|
<li class="breadcrumb-item breadcrumb-home">
|
|
<a href="../index.html" class="nav-link" aria-label="Home">
|
|
<i class="fa-solid fa-home"></i>
|
|
</a>
|
|
</li>
|
|
<li class="breadcrumb-item active" aria-current="page"><span class="ellipsis">Set Up a Sandbox of Claude Code with a Custom GitHub Policy</span></li>
|
|
</ul>
|
|
</nav>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div id="searchbox"></div>
|
|
<article class="bd-article">
|
|
|
|
<!--
|
|
SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
SPDX-License-Identifier: Apache-2.0
|
|
-->
|
|
<section class="tex2jax_ignore mathjax_ignore" id="set-up-a-sandbox-of-claude-code-with-a-custom-github-policy">
|
|
<h1>Set Up a Sandbox of Claude Code with a Custom GitHub Policy<a class="headerlink" href="#set-up-a-sandbox-of-claude-code-with-a-custom-github-policy" title="Link to this heading">#</a></h1>
|
|
<p>This tutorial walks through configuring a sandbox that grants different access levels to two GitHub repositories and enforces these rules at the network layer. The sandbox runs Claude Code as the agent.</p>
|
|
<p>The tutorial uses the following two example repositories for illustration purposes.</p>
|
|
<ul class="simple">
|
|
<li><p>A <code class="docutils literal notranslate"><span class="pre">alpha-repo</span></code> repository with read-write access. The agent can clone, push, and call mutating GitHub API endpoints such as pull requests, issues, and comments.</p></li>
|
|
<li><p>A <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code> repository with read-only access. The agent can clone and fetch, but push operations and mutating API calls are denied.</p></li>
|
|
<li><p>All other GitHub repositories are denied by default. No clone, fetch, or API call to an unlisted repository is allowed.</p></li>
|
|
</ul>
|
|
<p>After completing this tutorial, the sandbox environment includes the following:</p>
|
|
<ul class="simple">
|
|
<li><p>A GitHub credential provider that injects your GitHub token into the sandbox at runtime.</p></li>
|
|
<li><p>A network policy that extends the default policy with per-repository GitHub access rules.</p></li>
|
|
<li><p>A running sandbox in which Claude Code operates under the defined access constraints.</p></li>
|
|
</ul>
|
|
<section id="prerequisites">
|
|
<h2>Prerequisites<a class="headerlink" href="#prerequisites" title="Link to this heading">#</a></h2>
|
|
<p>This tutorial requires the following:</p>
|
|
<ul class="simple">
|
|
<li><p>Completed the <a class="reference internal" href="../get-started/quickstart.html"><span class="doc">Quickstart</span></a> tutorial.</p></li>
|
|
<li><p>A GitHub personal access token (PAT) with <code class="docutils literal notranslate"><span class="pre">repo</span></code> scope, exported as <code class="docutils literal notranslate"><span class="pre">GITHUB_TOKEN</span></code>.</p></li>
|
|
<li><p>An agent API key configured in the environment. For example, <code class="docutils literal notranslate"><span class="pre">ANTHROPIC_API_KEY</span></code> for Claude Code.</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="create-a-github-provider">
|
|
<h2>Create a GitHub Provider<a class="headerlink" href="#create-a-github-provider" title="Link to this heading">#</a></h2>
|
|
<p>In this section, you learn how to create a GitHub provider that injects your token into the sandbox at runtime.</p>
|
|
<div class="tip admonition">
|
|
<p class="admonition-title">Already have a sandbox running?</p>
|
|
<p>If you completed the Quickstart tutorial and have the default sandbox without a GitHub provider, there are two options to add the provider.</p>
|
|
<ul class="simple">
|
|
<li><p><strong>Option 1</strong>: Recreate with a provider. Delete the existing sandbox, create the provider below, then recreate the sandbox with <code class="docutils literal notranslate"><span class="pre">--provider</span> <span class="pre">my-github</span></code>.</p></li>
|
|
<li><p><strong>Option 2</strong>: Inject the token manually. Connect with <code class="docutils literal notranslate"><span class="pre">openshell</span> <span class="pre">sandbox</span> <span class="pre">connect</span> <span class="pre"><name></span></code> and run <code class="docutils literal notranslate"><span class="pre">export</span> <span class="pre">GITHUB_TOKEN=<your-token></span></code>. This bypasses the provider workflow. Note that the token does not persist across sandbox recreations.</p></li>
|
|
</ul>
|
|
</div>
|
|
<p>Create a provider that sources your GitHub token from the host environment:</p>
|
|
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="gp">$ </span>openshell<span class="w"> </span>provider<span class="w"> </span>create<span class="w"> </span>--name<span class="w"> </span>my-github<span class="w"> </span>--type<span class="w"> </span>github<span class="w"> </span>--from-existing
|
|
</pre></div>
|
|
</div>
|
|
<p>This command reads <code class="docutils literal notranslate"><span class="pre">GITHUB_TOKEN</span></code> (and <code class="docutils literal notranslate"><span class="pre">GH_TOKEN</span></code> if set) from the current shell session and stores them in the provider configuration. At sandbox startup, the provider injects these values as environment variables into the container.</p>
|
|
<p>For additional provider types, refer to <a class="reference internal" href="../sandboxes/providers.html"><span class="doc">Providers</span></a>.</p>
|
|
</section>
|
|
<section id="write-the-policy">
|
|
<h2>Write the Policy<a class="headerlink" href="#write-the-policy" title="Link to this heading">#</a></h2>
|
|
<p>In this section, you learn how to write a policy that extends the default policy with per-repository GitHub access rules.</p>
|
|
<p>Run the following command to create a file named <code class="docutils literal notranslate"><span class="pre">github-policy.yaml</span></code> with policy blocks. This policy extends the <a class="reference internal" href="../reference/default-policy.html"><span class="doc">default policy</span></a> and overrides the GitHub network blocks with per-repository rules. The <code class="docutils literal notranslate"><span class="pre">alpha-repo</span></code> receives read-write access, the <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code> receives read-only access, and all other repositories are denied by default.</p>
|
|
<p>Replace every occurrence of <code class="docutils literal notranslate"><span class="pre"><org></span></code> with your GitHub organization or username.</p>
|
|
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="gp">$ </span>cat<span class="w"> </span><<<span class="w"> </span><span class="s1">'EOF'</span><span class="w"> </span>><span class="w"> </span>github-policy.yaml
|
|
<span class="go">version: 1</span>
|
|
|
|
<span class="gp"># </span>──<span class="w"> </span>Static<span class="w"> </span><span class="o">(</span>locked<span class="w"> </span>at<span class="w"> </span>sandbox<span class="w"> </span>creation<span class="o">)</span><span class="w"> </span>──────────────────────────
|
|
|
|
<span class="go">filesystem_policy:</span>
|
|
<span class="go"> include_workdir: true</span>
|
|
<span class="go"> read_only:</span>
|
|
<span class="go"> - /usr</span>
|
|
<span class="go"> - /lib</span>
|
|
<span class="go"> - /proc</span>
|
|
<span class="go"> - /dev/urandom</span>
|
|
<span class="go"> - /app</span>
|
|
<span class="go"> - /etc</span>
|
|
<span class="go"> - /var/log</span>
|
|
<span class="go"> read_write:</span>
|
|
<span class="go"> - /sandbox</span>
|
|
<span class="go"> - /tmp</span>
|
|
<span class="go"> - /dev/null</span>
|
|
|
|
<span class="go">landlock:</span>
|
|
<span class="go"> compatibility: best_effort</span>
|
|
|
|
<span class="go">process:</span>
|
|
<span class="go"> run_as_user: sandbox</span>
|
|
<span class="go"> run_as_group: sandbox</span>
|
|
|
|
<span class="gp"># </span>──<span class="w"> </span>Dynamic<span class="w"> </span><span class="o">(</span>hot-reloadable<span class="o">)</span><span class="w"> </span>─────────────────────────────────────
|
|
|
|
<span class="go">network_policies:</span>
|
|
|
|
<span class="gp"> # </span>Claude<span class="w"> </span>Code<span class="w"> </span>↔<span class="w"> </span>Anthropic<span class="w"> </span>API
|
|
<span class="go"> claude_code:</span>
|
|
<span class="go"> name: claude-code</span>
|
|
<span class="go"> endpoints:</span>
|
|
<span class="go"> - { host: api.anthropic.com, port: 443, protocol: rest, enforcement: enforce, access: full, tls: terminate }</span>
|
|
<span class="go"> - { host: statsig.anthropic.com, port: 443 }</span>
|
|
<span class="go"> - { host: sentry.io, port: 443 }</span>
|
|
<span class="go"> - { host: raw.githubusercontent.com, port: 443 }</span>
|
|
<span class="go"> - { host: platform.claude.com, port: 443 }</span>
|
|
<span class="go"> binaries:</span>
|
|
<span class="go"> - { path: /usr/local/bin/claude }</span>
|
|
<span class="go"> - { path: /usr/bin/node }</span>
|
|
|
|
<span class="gp"> # </span>NVIDIA<span class="w"> </span>inference<span class="w"> </span>endpoint
|
|
<span class="go"> nvidia_inference:</span>
|
|
<span class="go"> name: nvidia-inference</span>
|
|
<span class="go"> endpoints:</span>
|
|
<span class="go"> - { host: integrate.api.nvidia.com, port: 443 }</span>
|
|
<span class="go"> binaries:</span>
|
|
<span class="go"> - { path: /usr/bin/curl }</span>
|
|
<span class="go"> - { path: /bin/bash }</span>
|
|
<span class="go"> - { path: /usr/local/bin/opencode }</span>
|
|
|
|
<span class="gp"> # </span>──<span class="w"> </span>GitHub:<span class="w"> </span>git<span class="w"> </span>operations<span class="w"> </span><span class="o">(</span>clone,<span class="w"> </span>fetch,<span class="w"> </span>push<span class="o">)</span><span class="w"> </span>──────────────
|
|
|
|
<span class="go"> github_git:</span>
|
|
<span class="go"> name: github-git</span>
|
|
<span class="go"> endpoints:</span>
|
|
<span class="go"> - host: github.com</span>
|
|
<span class="go"> port: 443</span>
|
|
<span class="go"> protocol: rest</span>
|
|
<span class="go"> tls: terminate</span>
|
|
<span class="go"> enforcement: enforce</span>
|
|
<span class="go"> rules:</span>
|
|
<span class="gp"> # </span>alpha-repo:<span class="w"> </span>clone,<span class="w"> </span>fetch,<span class="w"> </span>and<span class="w"> </span>push
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: GET</span>
|
|
<span class="go"> path: "/<org>/alpha-repo.git/info/refs*"</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: POST</span>
|
|
<span class="go"> path: "/<org>/alpha-repo.git/git-upload-pack"</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: POST</span>
|
|
<span class="go"> path: "/<org>/alpha-repo.git/git-receive-pack"</span>
|
|
<span class="gp"> # </span>bravo-repo:<span class="w"> </span>clone<span class="w"> </span>and<span class="w"> </span>fetch<span class="w"> </span>only<span class="w"> </span><span class="o">(</span>no<span class="w"> </span>push<span class="o">)</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: GET</span>
|
|
<span class="go"> path: "/<org>/bravo-repo.git/info/refs*"</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: POST</span>
|
|
<span class="go"> path: "/<org>/bravo-repo.git/git-upload-pack"</span>
|
|
<span class="go"> binaries:</span>
|
|
<span class="go"> - { path: /usr/bin/git }</span>
|
|
|
|
<span class="gp"> # </span>──<span class="w"> </span>GitHub:<span class="w"> </span>REST<span class="w"> </span>API<span class="w"> </span>─────────────────────────────────────────
|
|
|
|
<span class="go"> github_api:</span>
|
|
<span class="go"> name: github-api</span>
|
|
<span class="go"> endpoints:</span>
|
|
<span class="go"> - host: api.github.com</span>
|
|
<span class="go"> port: 443</span>
|
|
<span class="go"> protocol: rest</span>
|
|
<span class="go"> tls: terminate</span>
|
|
<span class="go"> enforcement: enforce</span>
|
|
<span class="go"> rules:</span>
|
|
<span class="gp"> # </span>GraphQL<span class="w"> </span>API<span class="w"> </span><span class="o">(</span>used<span class="w"> </span>by<span class="w"> </span>gh<span class="w"> </span>CLI<span class="o">)</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: POST</span>
|
|
<span class="go"> path: "/graphql"</span>
|
|
<span class="gp"> # </span>alpha-repo:<span class="w"> </span>full<span class="w"> </span>read-write<span class="w"> </span><span class="o">(</span>PRs,<span class="w"> </span>issues,<span class="w"> </span>comments,<span class="w"> </span>etc.<span class="o">)</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: "*"</span>
|
|
<span class="go"> path: "/repos/<org>/alpha-repo/**"</span>
|
|
<span class="gp"> # </span>bravo-repo:<span class="w"> </span>read-only
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: GET</span>
|
|
<span class="go"> path: "/repos/<org>/bravo-repo/**"</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: HEAD</span>
|
|
<span class="go"> path: "/repos/<org>/bravo-repo/**"</span>
|
|
<span class="go"> - allow:</span>
|
|
<span class="go"> method: OPTIONS</span>
|
|
<span class="go"> path: "/repos/<org>/bravo-repo/**"</span>
|
|
<span class="go"> binaries:</span>
|
|
<span class="go"> - { path: /usr/local/bin/claude }</span>
|
|
<span class="go"> - { path: /usr/local/bin/opencode }</span>
|
|
<span class="go"> - { path: /usr/bin/gh }</span>
|
|
<span class="go"> - { path: /usr/bin/curl }</span>
|
|
|
|
<span class="gp"> # </span>──<span class="w"> </span>Package<span class="w"> </span>managers<span class="w"> </span>─────────────────────────────────────────
|
|
|
|
<span class="go"> pypi:</span>
|
|
<span class="go"> name: pypi</span>
|
|
<span class="go"> endpoints:</span>
|
|
<span class="go"> - { host: pypi.org, port: 443 }</span>
|
|
<span class="go"> - { host: files.pythonhosted.org, port: 443 }</span>
|
|
<span class="go"> - { host: github.com, port: 443 }</span>
|
|
<span class="go"> - { host: objects.githubusercontent.com, port: 443 }</span>
|
|
<span class="go"> - { host: api.github.com, port: 443 }</span>
|
|
<span class="go"> - { host: downloads.python.org, port: 443 }</span>
|
|
<span class="go"> binaries:</span>
|
|
<span class="go"> - { path: /sandbox/.venv/bin/python }</span>
|
|
<span class="go"> - { path: /sandbox/.venv/bin/python3 }</span>
|
|
<span class="go"> - { path: /sandbox/.venv/bin/pip }</span>
|
|
<span class="go"> - { path: /app/.venv/bin/python }</span>
|
|
<span class="go"> - { path: /app/.venv/bin/python3 }</span>
|
|
<span class="go"> - { path: /app/.venv/bin/pip }</span>
|
|
<span class="go"> - { path: /usr/local/bin/uv }</span>
|
|
<span class="go"> - { path: "/sandbox/.uv/python/**" }</span>
|
|
|
|
<span class="gp"> # </span>──<span class="w"> </span>VS<span class="w"> </span>Code<span class="w"> </span>Remote<span class="w"> </span>──────────────────────────────────────────
|
|
|
|
<span class="go"> vscode:</span>
|
|
<span class="go"> name: vscode</span>
|
|
<span class="go"> endpoints:</span>
|
|
<span class="go"> - { host: update.code.visualstudio.com, port: 443 }</span>
|
|
<span class="go"> - { host: "*.vo.msecnd.net", port: 443 }</span>
|
|
<span class="go"> - { host: vscode.download.prss.microsoft.com, port: 443 }</span>
|
|
<span class="go"> - { host: marketplace.visualstudio.com, port: 443 }</span>
|
|
<span class="go"> - { host: "*.gallerycdn.vsassets.io", port: 443 }</span>
|
|
<span class="go"> binaries:</span>
|
|
<span class="go"> - { path: /usr/bin/curl }</span>
|
|
<span class="go"> - { path: /usr/bin/wget }</span>
|
|
<span class="go"> - { path: "/sandbox/.vscode-server/**" }</span>
|
|
<span class="go"> - { path: "/sandbox/.vscode-remote-containers/**" }</span>
|
|
<span class="go">EOF</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>The following table summarizes the behavior of the GitHub policy blocks.</p>
|
|
<div class="pst-scrollable-table-container"><table class="table">
|
|
<thead>
|
|
<tr class="row-odd"><th class="head"><p>Block</p></th>
|
|
<th class="head"><p>Endpoint</p></th>
|
|
<th class="head"><p>Behavior</p></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">github_git</span></code></p></td>
|
|
<td><p><code class="docutils literal notranslate"><span class="pre">github.com:443</span></code></p></td>
|
|
<td><p>Git Smart HTTP protocol with TLS termination. Permits <code class="docutils literal notranslate"><span class="pre">info/refs</span></code> (clone/fetch) for both repositories. Permits <code class="docutils literal notranslate"><span class="pre">git-receive-pack</span></code> (push) for <code class="docutils literal notranslate"><span class="pre">alpha-repo</span></code> only. Denies all operations on unlisted repositories.</p></td>
|
|
</tr>
|
|
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">github_api</span></code></p></td>
|
|
<td><p><code class="docutils literal notranslate"><span class="pre">api.github.com:443</span></code></p></td>
|
|
<td><p>REST API with TLS termination. Permits all HTTP methods for <code class="docutils literal notranslate"><span class="pre">alpha-repo</span></code>. Restricts <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code> to GET, HEAD, and OPTIONS (read-only). Denies API access to unlisted repositories.</p></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<p>The remaining blocks (<code class="docutils literal notranslate"><span class="pre">claude_code</span></code>, <code class="docutils literal notranslate"><span class="pre">nvidia_inference</span></code>, <code class="docutils literal notranslate"><span class="pre">pypi</span></code>, <code class="docutils literal notranslate"><span class="pre">vscode</span></code>) are identical to the <a class="reference internal" href="../reference/default-policy.html"><span class="doc">default policy</span></a>. Sandbox behavior outside of GitHub operations is unchanged.</p>
|
|
<p>For details on network policy block structure, refer to <a class="reference internal" href="../sandboxes/index.html#network-access-rules"><span class="std std-ref">Network Access Rules</span></a>.</p>
|
|
</section>
|
|
<section id="create-the-sandbox">
|
|
<h2>Create the Sandbox<a class="headerlink" href="#create-the-sandbox" title="Link to this heading">#</a></h2>
|
|
<p>Run the following command to create the sandbox with the GitHub provider, the custom policy applied, and Claude Code running inside the sandbox:</p>
|
|
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="gp">$ </span>openshell<span class="w"> </span>sandbox<span class="w"> </span>create<span class="w"> </span><span class="se">\</span>
|
|
<span class="w"> </span>--provider<span class="w"> </span>my-github<span class="w"> </span><span class="se">\</span>
|
|
<span class="w"> </span>--policy<span class="w"> </span>github-policy.yaml<span class="w"> </span><span class="se">\</span>
|
|
<span class="w"> </span>--keep<span class="w"> </span><span class="se">\</span>
|
|
<span class="w"> </span>--<span class="w"> </span>claude
|
|
</pre></div>
|
|
</div>
|
|
<p>The <code class="docutils literal notranslate"><span class="pre">--keep</span></code> flag keeps the sandbox running after Claude Code exits. With this flag, you can reconnect to the same sandbox or apply policy updates without recreating the environment.</p>
|
|
</section>
|
|
<section id="verify-access">
|
|
<h2>Verify Access<a class="headerlink" href="#verify-access" title="Link to this heading">#</a></h2>
|
|
<p>With Claude Code running inside the sandbox, validate that the policy enforces the expected access levels for each repository.</p>
|
|
<section id="verify-read-write-access">
|
|
<h3>Verify Read-Write Access<a class="headerlink" href="#verify-read-write-access" title="Link to this heading">#</a></h3>
|
|
<p>Instruct Claude to clone, commit, and push to <code class="docutils literal notranslate"><span class="pre">alpha-repo</span></code>:</p>
|
|
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>Clone https://github.com/<org>/alpha-repo.git, add a blank line to the
|
|
README.md file, commit, and push.
|
|
</pre></div>
|
|
</div>
|
|
<p>The clone, commit, and push operations should complete successfully. Verify that the sandbox logs contain <code class="docutils literal notranslate"><span class="pre">action=allow</span></code> entries for <code class="docutils literal notranslate"><span class="pre">github.com</span></code> (the git push) and <code class="docutils literal notranslate"><span class="pre">api.github.com</span></code> (any associated API calls).</p>
|
|
</section>
|
|
<section id="verify-read-only-enforcement">
|
|
<h3>Verify Read-Only Enforcement<a class="headerlink" href="#verify-read-only-enforcement" title="Link to this heading">#</a></h3>
|
|
<p>Instruct Claude to perform the same operations on <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code>:</p>
|
|
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>Clone https://github.com/<org>/bravo-repo.git, add a blank line to the
|
|
README.md file, commit, and push.
|
|
</pre></div>
|
|
</div>
|
|
<p>The clone operation succeeds because the policy permits read access. The push operation fails because the proxy denies <code class="docutils literal notranslate"><span class="pre">git-receive-pack</span></code> for <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code>. Verify the denial by inspecting the sandbox logs:</p>
|
|
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="gp">$ </span>openshell<span class="w"> </span>logs<span class="w"> </span><sandbox-name><span class="w"> </span>--tail<span class="w"> </span>--source<span class="w"> </span>sandbox
|
|
</pre></div>
|
|
</div>
|
|
<p>The output contains an <code class="docutils literal notranslate"><span class="pre">action=deny</span></code> entry with <code class="docutils literal notranslate"><span class="pre">host=github.com</span></code> and <code class="docutils literal notranslate"><span class="pre">path=/<org>/bravo-repo.git/git-receive-pack</span></code>.</p>
|
|
</section>
|
|
<section id="verify-api-scoping">
|
|
<h3>Verify API Scoping<a class="headerlink" href="#verify-api-scoping" title="Link to this heading">#</a></h3>
|
|
<p>Instruct Claude to create a GitHub issue on each repository:</p>
|
|
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>Create a GitHub issue titled "Test from sandbox" on <org>/alpha-repo.
|
|
Then try to create the same issue on <org>/bravo-repo.
|
|
</pre></div>
|
|
</div>
|
|
<p>Expected result is that the issue is created on <code class="docutils literal notranslate"><span class="pre">alpha-repo</span></code>. The request to <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code> is denied because the policy restricts that repository to GET, HEAD, and OPTIONS methods. The POST required to create an issue is blocked by the proxy.</p>
|
|
</section>
|
|
</section>
|
|
<section id="iterate-on-the-policy">
|
|
<h2>Iterate on the Policy<a class="headerlink" href="#iterate-on-the-policy" title="Link to this heading">#</a></h2>
|
|
<p>In this section, you learn how to iterate on the policy to modify repository access or add new repositories.</p>
|
|
<p>Network policies support hot-reloading. To modify repository access or add new repositories, edit <code class="docutils literal notranslate"><span class="pre">github-policy.yaml</span></code> and run the following command to apply the updated policy to the running sandbox:</p>
|
|
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="gp">$ </span>openshell<span class="w"> </span>policy<span class="w"> </span><span class="nb">set</span><span class="w"> </span><sandbox-name><span class="w"> </span>--policy<span class="w"> </span>github-policy.yaml<span class="w"> </span>--wait
|
|
</pre></div>
|
|
</div>
|
|
<p>For example, to change the access level of <code class="docutils literal notranslate"><span class="pre">bravo-repo</span></code> from read-only to read-write, add the following rule under <code class="docutils literal notranslate"><span class="pre">github_api</span></code>:</p>
|
|
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">allow</span><span class="p">:</span>
|
|
<span class="w"> </span><span class="nt">method</span><span class="p">:</span><span class="w"> </span><span class="s">"*"</span>
|
|
<span class="w"> </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="s">"/repos/<org>/bravo-repo/**"</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Then add the corresponding push rule under <code class="docutils literal notranslate"><span class="pre">github_git</span></code>:</p>
|
|
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">allow</span><span class="p">:</span>
|
|
<span class="w"> </span><span class="nt">method</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">POST</span>
|
|
<span class="w"> </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="s">"/<org>/bravo-repo.git/git-receive-pack"</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>For the complete policy iteration workflow (pull, edit, push, verify), refer to <a class="reference internal" href="../sandboxes/policies.html"><span class="doc">Customize Sandbox Policies</span></a>.</p>
|
|
</section>
|
|
<section id="next-steps">
|
|
<h2>Next Steps<a class="headerlink" href="#next-steps" title="Link to this heading">#</a></h2>
|
|
<p>The following resources cover related topics in greater depth:</p>
|
|
<ul class="simple">
|
|
<li><p>To configure additional credential types, refer to <a class="reference internal" href="../sandboxes/providers.html"><span class="doc">Providers</span></a>.</p></li>
|
|
<li><p>To iterate on policy configuration, refer to <a class="reference internal" href="../sandboxes/policies.html"><span class="doc">Customize Sandbox Policies</span></a>.</p></li>
|
|
<li><p>To view the policy YAML specification, refer to the <a class="reference internal" href="../reference/policy-schema.html"><span class="std std-doc">Policy Schema Reference</span></a>.</p></li>
|
|
</ul>
|
|
</section>
|
|
</section>
|
|
|
|
|
|
</article>
|
|
|
|
|
|
|
|
|
|
|
|
<footer class="prev-next-footer d-print-none">
|
|
|
|
<div class="prev-next-area">
|
|
<a class="left-prev"
|
|
href="../get-started/quickstart.html"
|
|
title="previous page">
|
|
<i class="fa-solid fa-angle-left"></i>
|
|
<div class="prev-next-info">
|
|
<p class="prev-next-subtitle">previous</p>
|
|
<p class="prev-next-title">Quickstart</p>
|
|
</div>
|
|
</a>
|
|
<a class="right-next"
|
|
href="../sandboxes/index.html"
|
|
title="next page">
|
|
<div class="prev-next-info">
|
|
<p class="prev-next-subtitle">next</p>
|
|
<p class="prev-next-title">About Sandboxes</p>
|
|
</div>
|
|
<i class="fa-solid fa-angle-right"></i>
|
|
</a>
|
|
</div>
|
|
</footer>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<dialog id="pst-secondary-sidebar-modal"></dialog>
|
|
<div id="pst-secondary-sidebar" class="bd-sidebar-secondary bd-toc"><div class="sidebar-secondary-items sidebar-secondary__inner">
|
|
|
|
|
|
<div class="sidebar-secondary-item">
|
|
<div
|
|
id="pst-page-navigation-heading-2"
|
|
class="page-toc tocsection onthispage">
|
|
<i class="fa-solid fa-list"></i> On this page
|
|
</div>
|
|
<nav class="bd-toc-nav page-toc" aria-labelledby="pst-page-navigation-heading-2">
|
|
<ul class="visible nav section-nav flex-column">
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#prerequisites">Prerequisites</a></li>
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#create-a-github-provider">Create a GitHub Provider</a></li>
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#write-the-policy">Write the Policy</a></li>
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#create-the-sandbox">Create the Sandbox</a></li>
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#verify-access">Verify Access</a><ul class="nav section-nav flex-column">
|
|
<li class="toc-h3 nav-item toc-entry"><a class="reference internal nav-link" href="#verify-read-write-access">Verify Read-Write Access</a></li>
|
|
<li class="toc-h3 nav-item toc-entry"><a class="reference internal nav-link" href="#verify-read-only-enforcement">Verify Read-Only Enforcement</a></li>
|
|
<li class="toc-h3 nav-item toc-entry"><a class="reference internal nav-link" href="#verify-api-scoping">Verify API Scoping</a></li>
|
|
</ul>
|
|
</li>
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#iterate-on-the-policy">Iterate on the Policy</a></li>
|
|
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#next-steps">Next Steps</a></li>
|
|
</ul>
|
|
</nav></div>
|
|
|
|
</div></div>
|
|
|
|
|
|
|
|
</div>
|
|
<footer class="bd-footer-content">
|
|
|
|
</footer>
|
|
|
|
</main>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<!-- Scripts loaded after <body> so the DOM is not blocked -->
|
|
<script defer src="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf"></script>
|
|
<script defer src="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf"></script>
|
|
|
|
|
|
<footer class="bd-footer">
|
|
<div class="bd-footer__inner bd-page-width">
|
|
|
|
<div class="footer-items__start">
|
|
|
|
<div class="footer-item">
|
|
<a class="footer-brand logo" href="https://www.nvidia.com">
|
|
<img src="../_static/nvidia-logo-horiz-rgb-1c-blk-for-screen.svg" class="logo__image only-light" alt="NVIDIA"/>
|
|
<img src="../_static/nvidia-logo-horiz-rgb-1c-wht-for-screen.svg" class="logo__image only-dark" alt="NVIDIA"/>
|
|
</a></div>
|
|
|
|
<div class="footer-item">
|
|
|
|
<div class="footer-links">
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/privacy-policy/">Privacy Policy</a>
|
|
|
|
|
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/privacy-center/">Your Privacy Choices</a>
|
|
|
|
|
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/terms-of-service/">Terms of Service</a>
|
|
|
|
|
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/accessibility/">Accessibility</a>
|
|
|
|
|
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/company-policies/">Corporate Policies</a>
|
|
|
|
|
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/product-security/">Product Security</a>
|
|
|
|
|
|
|
|
|
|
|
<a class="external" href="https://www.nvidia.com/en-us/contact/">Contact</a>
|
|
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div class="footer-item">
|
|
|
|
|
|
|
|
|
|
<p class="copyright">
|
|
|
|
Copyright © 2025-2026, NVIDIA Corporation.
|
|
<br/>
|
|
|
|
</p>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
</div>
|
|
|
|
</footer>
|
|
</body>
|
|
</html> |