deepseek-kubernetes-sandbox/docs

Repository documentation

Repository-wide documentation lives here. Example-specific material lives with its example under examples/<name>/docs/ — see the agents-as-a-service architecture.

If you are new, read the root README first: it is image-first and gets a DSH Web container running before anything else.

Index

Document	Read it for
main-image.md	The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests.
examples.md	The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example.
gitflow.md	Branches, protected main, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist.
versioning.md	Release identity (DSH ref + optional -rN), the current identity dsh-v0.2.1-rc.5, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning.
workflow-security.md	GitHub Actions security posture: least-privilege tokens, pinned actions, untrusted-input handling, download integrity checks, artifact hygiene, the latest audit record and residual repository-setting recommendations.

Project skills

DSH discovers project skills from <git root>/.dsh/skills/<name>/SKILL.md (the nearest .git ancestor). This repository ships one:

Skill	Read it for
dsh-agent-sandbox-platform	Operating and extending the agents-as-a-service platform, agent-sandbox MCP limits and deployment, and a read-only preflight.

Example documentation

Document	Read it for
examples/README.md	The index of implementations in this repository.
dsh-agents-as-a-service README	The multi-tenant platform walkthrough: warm pool, claims, suspend/resume, gateway, exposure and troubleshooting.
dsh-agents-as-a-service architecture	Container/sequence diagrams, ADRs, security and RBAC, failure modes and the evolution path.
gateway README	The gateway's HTTP/WebSocket API, configuration, auth (including SSO), and limitations.
optional hardening	Opt-in gVisor, nodeSelector, NetworkPolicy, provider keys and failed-Pod recovery.
exposure variants	The mutually exclusive Ingress and Gateway API + SSO exposure paths.

Project policies

Document	Read it for
AGENTS.md	Repository conventions for AI agents and humans, and the commands the CI runs.
CONTRIBUTING.md	Local setup, the change workflow and what a pull request needs.
SECURITY.md	Vulnerability reporting and project-specific threat notes (pod logs, SSO header trust, shared provider key, TLS).
CODE_OF_CONDUCT.md	Community standards.
CHANGELOG.md	Generated release history (do not edit by hand).
LICENSE	MIT.