nicolas-georger/deepseek-kubernetes-sandbox

mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00

Files

SREDevOps.org Agent 367294b230 feat(example): persist the agent workspace on the PVC via subPath (#34 )

/workspace - the DSH image's WORKDIR, where agents keep files - was plain
container storage, so every suspend/resume or pod replacement silently threw
agent work away while DSH state survived on the PVC.

Mount the same per-sandbox `dsh-home` PVC a second time at /workspace with
`subPath: workspace`. One PVC, no extra provisioning, and the subPath keeps
DSH state (sessions, config and .credentials.yaml at the volume root) out of
the agent-visible tree; mounting the volume root at /workspace would have
exposed the credential file.

The kubelet creates the missing subPath directory itself and chmods it to the
volume's fsGroup permissions, and the volume root's setgid bit makes the new
directory inherit gid 1000, so UID 1000 can write with no init container and
no root. The rare interrupted-kubelet case that leaves 0755 is documented with
a recovery procedure (kubernetes#142464) rather than papered over.

- e2e-kind: write a /workspace marker alongside the DSH_HOME marker, assert
  the mount is the dsh-home subPath, and verify both survive suspend/resume.
- Docs: README (overview, steps 4-6, troubleshooting row), architecture
  (PVC diagram, persistence, component table), main-image working-directory
  row, platform runbook PVC row.

Verified: make check (14 manifests), make lint, plus YAML assertions on the
two mounts and the unchanged volumeClaimTemplates.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

2026-10-30 08:29:39 -03:00

dsh-agents-as-a-service

feat(example): persist the agent workspace on the PVC via subPath (#34 )

2026-10-30 08:29:39 -03:00

minimal-single-tenant

chore(release): dsh-v0.2.1-rc.5 (#29 )

2026-10-30 04:54:37 -03:00

README.md

feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21 )

2026-10-26 10:03:30 -03:00

README.md

Examples

Every implementation in this repository is a self-contained example: one directory, plain kubectl, an end-to-end README, and a cleanup command. Examples consume the main DSH Web image; they are reference material, not libraries.

Example	What it demonstrates	Needs
`examples/dsh-agents-as-a-service/`	The full multi-tenant platform pattern: one `SandboxTemplate` with per-user PVCs, a warm pool, one ~10-line `SandboxClaim` per user, suspend-when-idle / wake-on-return, and a browser gateway with signup, `HttpOnly` sessions, an HTTP + WebSocket proxy and two exposure variants (Ingress, or Gateway API + GitHub SSO).	agent-sandbox with extensions; kind for the e2e script.
`examples/minimal-single-tenant/`	The smallest useful setup: a single `SandboxTemplate` and one `SandboxClaim`, no gateway — reach DSH Web with a launch-token URL through `kubectl port-forward`.	agent-sandbox with extensions.

The multi-tenant example also documents opt-in gVisor, nodeSelector, NetworkPolicy and extra provider-key hardening in optional hardening.

The example contract (short version)

Full rules: docs/examples.md. scripts/check-examples.sh enforces the layout, and make check runs it.

examples/<name>/
+-- README.md                  # walkthrough: prerequisites, steps, troubleshooting, cleanup
+-- manifests/                 # NN-*.yaml, applied with plain kubectl
|   +-- optional/<feature>/    # optional opt-in manifests...
|   +-- optional/README.md     # ...required whenever optional/ exists
|   +-- exposure/<variant>/    # optional per-variant manifests...
|   +-- exposure/README.md     # ...required whenever exposure/ exists
+-- scripts/                   # optional executable, idempotent, self-cleaning *.sh
+-- docs/                      # optional architecture/ADR material
+-- <component>/               # optional component with Dockerfile + README + tests

Secrets never ship populated: use *.yaml.example files with placeholders.
Manifests are numbered (00-, 10-, ...) and read as an ordered walkthrough.
Component images are published nested below the main image: <registry>/<owner>/<repo>/<example>/<component>.
Every example must be listed above with its literal examples/<name>/ path.
Scripts under scripts/ must be executable, idempotent and clean up after themselves.

Running an example

# e.g. the multi-tenant platform example
kubectl apply -f examples/dsh-agents-as-a-service/manifests/

# or run the whole walkthrough (kind + agent-sandbox required) and let it clean up
examples/dsh-agents-as-a-service/scripts/e2e-kind.sh

kubectl apply -f manifests/ is non-recursive: optional/ and exposure/ subdirectories are applied explicitly. Each example README has the exact prerequisites, optional hardening, exposure options and teardown.