OpenShell

mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-16 05:20:22 +08:00

Files

T

Alexander Watson 158c925342 docs(examples): add sandbox policy quickstart walkthrough (#266 )

* docs(examples): add sandbox policy quickstart walkthrough

Add an interactive getting-started example that demonstrates OpenShell's
network policy system end-to-end: default-deny, L7 read-only access,
and audit logging — all with a single YAML policy file.

- examples/sandbox-policy-quickstart/policy.yaml: policy with default
  static fields (filesystem, landlock, process) so it works out of the
  box with `openshell policy set`
- examples/sandbox-policy-quickstart/demo.sh: automated demo script
  using printf (portable) and openshell ssh-proxy for sandbox exec
- examples/sandbox-policy-quickstart/README.md: step-by-step manual
  walkthrough
- README.md: add "See network policy in action" section linking to the
  quickstart

Signed-off-by: Alexander Watson <zredlined@gmail.com>
Made-with: Cursor
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Made-with: Cursor

* docs: soften default-deny wording to minimal outbound access

Sandbox defaults vary by type and community configs, so
"all outbound traffic is blocked" is too absolute.

Made-with: Cursor

* docs: use curl -sS so L4 deny errors are visible

curl -s suppresses stderr, hiding the 403 from the CONNECT
proxy. Adding -S ensures the error message is always shown.

Made-with: Cursor

---------

Signed-off-by: Alexander Watson <zredlined@gmail.com>

2026-03-13 11:32:32 -07:00

bring-your-own-container

ci: remove sandbox docker build from publish and e2e workflows (#275 )

2026-03-13 00:56:07 -07:00

local-inference

refactor: rename navigator- crate prefix to openshell- (#277 )

2026-03-13 02:02:18 -07:00

policy-advisor

feat(policy): add policy recommendation plumbing (#204 ) (#222 )

2026-03-12 08:28:26 -07:00

private-ip-routing

ci: remove sandbox docker build from publish and e2e workflows (#275 )