mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
367294b230
/workspace - the DSH image's WORKDIR, where agents keep files - was plain container storage, so every suspend/resume or pod replacement silently threw agent work away while DSH state survived on the PVC. Mount the same per-sandbox `dsh-home` PVC a second time at /workspace with `subPath: workspace`. One PVC, no extra provisioning, and the subPath keeps DSH state (sessions, config and .credentials.yaml at the volume root) out of the agent-visible tree; mounting the volume root at /workspace would have exposed the credential file. The kubelet creates the missing subPath directory itself and chmods it to the volume's fsGroup permissions, and the volume root's setgid bit makes the new directory inherit gid 1000, so UID 1000 can write with no init container and no root. The rare interrupted-kubelet case that leaves 0755 is documented with a recovery procedure (kubernetes#142464) rather than papered over. - e2e-kind: write a /workspace marker alongside the DSH_HOME marker, assert the mount is the dsh-home subPath, and verify both survive suspend/resume. - Docs: README (overview, steps 4-6, troubleshooting row), architecture (PVC diagram, persistence, component table), main-image working-directory row, platform runbook PVC row. Verified: make check (14 manifests), make lint, plus YAML assertions on the two mounts and the unchanged volumeClaimTemplates. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
Repository documentation
Repository-wide documentation lives here. Example-specific material lives with
its example under examples/<name>/docs/ — see the
agents-as-a-service architecture
for the deep-dive that used to live in this directory.
If you are new, read the root README first: it is image-first and gets a DSH Web container running before anything else.
Index
| Document | Read it for |
|---|---|
| main-image.md | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. |
| examples.md | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. |
| gitflow.md | Branches, protected main, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. |
| versioning.md | Release identity (DSH ref + optional -rN), the current identity dsh-v0.2.1-rc.5, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. |
Project skills
DSH discovers project skills from <git root>/.dsh/skills/<name>/SKILL.md
(the nearest .git ancestor). This repository ships one:
| Skill | Read it for |
|---|---|
| dsh-agent-sandbox-platform | Operating and extending the agents-as-a-service platform, agent-sandbox MCP limits and deployment, and a read-only preflight. |
Example documentation
| Document | Read it for |
|---|---|
| examples/README.md | The index of implementations in this repository. |
| dsh-agents-as-a-service README | The multi-tenant platform walkthrough: warm pool, claims, suspend/resume, gateway, exposure and troubleshooting. |
| dsh-agents-as-a-service architecture | Container/sequence diagrams, ADRs, security and RBAC, failure modes and the evolution path. |
| gateway README | The gateway's HTTP/WebSocket API, configuration, auth (including SSO), and limitations. |
Project policies
| Document | Read it for |
|---|---|
| AGENTS.md | Repository conventions for AI agents and humans, and the commands the CI runs. |
| CONTRIBUTING.md | Local setup, the change workflow and what a pull request needs. |
| SECURITY.md | Vulnerability reporting and project-specific threat notes (pod logs, SSO header trust, shared provider key, TLS). |
| CODE_OF_CONDUCT.md | Community standards. |
| CHANGELOG.md | Generated release history (do not edit by hand). |
| LICENSE | MIT. |