nicolas-georger/deepseek-kubernetes-sandbox

mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00

Files

SREDevOps.org Agent 82ee0d0cdb feat(example): start DSH's folder picker on the persisted workspace (#36 )

The directory picker has no start-path setting: it lists $HOME whenever it
opens. With the image default HOME=/home/node the folder explorer started on
a throwaway directory, so point HOME at the PVC-backed /workspace in both
sandbox templates. `~` and $HOME-relative tool caches/config follow; DSH_HOME
stays /home/node/.dsh, so sessions, config and credentials are unaffected.

Document the trade-off in the image contract and both examples, add
troubleshooting for sandboxes whose pod env was stamped before the change,
and assert HOME/~ in the e2e walkthrough.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

2026-10-30 11:19:03 -03:00

dsh-agents-as-a-service

feat(example): start DSH's folder picker on the persisted workspace (#36 )

2026-10-30 11:19:03 -03:00

minimal-single-tenant

feat(example): start DSH's folder picker on the persisted workspace (#36 )

2026-10-30 11:19:03 -03:00

README.md

feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21 )

2026-10-26 10:03:30 -03:00

README.md

Examples

Every implementation in this repository is a self-contained example: one directory, plain kubectl, an end-to-end README, and a cleanup command. Examples consume the main DSH Web image; they are reference material, not libraries.

Example	What it demonstrates	Needs
`examples/dsh-agents-as-a-service/`	The full multi-tenant platform pattern: one `SandboxTemplate` with per-user PVCs, a warm pool, one ~10-line `SandboxClaim` per user, suspend-when-idle / wake-on-return, and a browser gateway with signup, `HttpOnly` sessions, an HTTP + WebSocket proxy and two exposure variants (Ingress, or Gateway API + GitHub SSO).	agent-sandbox with extensions; kind for the e2e script.
`examples/minimal-single-tenant/`	The smallest useful setup: a single `SandboxTemplate` and one `SandboxClaim`, no gateway — reach DSH Web with a launch-token URL through `kubectl port-forward`.	agent-sandbox with extensions.

The multi-tenant example also documents opt-in gVisor, nodeSelector, NetworkPolicy and extra provider-key hardening in optional hardening.

The example contract (short version)

Full rules: docs/examples.md. scripts/check-examples.sh enforces the layout, and make check runs it.

examples/<name>/
+-- README.md                  # walkthrough: prerequisites, steps, troubleshooting, cleanup
+-- manifests/                 # NN-*.yaml, applied with plain kubectl
|   +-- optional/<feature>/    # optional opt-in manifests...
|   +-- optional/README.md     # ...required whenever optional/ exists
|   +-- exposure/<variant>/    # optional per-variant manifests...
|   +-- exposure/README.md     # ...required whenever exposure/ exists
+-- scripts/                   # optional executable, idempotent, self-cleaning *.sh
+-- docs/                      # optional architecture/ADR material
+-- <component>/               # optional component with Dockerfile + README + tests

Secrets never ship populated: use *.yaml.example files with placeholders.
Manifests are numbered (00-, 10-, ...) and read as an ordered walkthrough.
Component images are published nested below the main image: <registry>/<owner>/<repo>/<example>/<component>.
Every example must be listed above with its literal examples/<name>/ path.
Scripts under scripts/ must be executable, idempotent and clean up after themselves.

Running an example

# e.g. the multi-tenant platform example
kubectl apply -f examples/dsh-agents-as-a-service/manifests/

# or run the whole walkthrough (kind + agent-sandbox required) and let it clean up
examples/dsh-agents-as-a-service/scripts/e2e-kind.sh

kubectl apply -f manifests/ is non-recursive: optional/ and exposure/ subdirectories are applied explicitly. Each example README has the exact prerequisites, optional hardening, exposure options and teardown.