24f23e09ae
Remove obsolete layout/migration prose and legacy gateway-alias references, reconcile the required-check policy, fix version-label/RBAC/workspace/channel drift, and de-duplicate the example and gateway docs. Rename the minimal manifest to 10-sandboxtemplate.yaml and mount the dsh-home PVC's workspace subPath at /workspace so the documented persistence is real. Enforce numbered top-level manifests in check-examples.sh. Verified with make check, yamllint, shellcheck, a Markdown link/anchor scan, and git diff --check. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
2.4 KiB
Examples
Every implementation in this repository is a self-contained example: one
directory, plain kubectl, an end-to-end README, and a cleanup command.
Examples consume the main DSH Web image; they are
reference material, not libraries.
| Example | What it demonstrates | Needs |
|---|---|---|
examples/dsh-agents-as-a-service/ |
The full multi-tenant platform pattern: one SandboxTemplate with per-user PVCs, a warm pool, one ~10-line SandboxClaim per user, suspend-when-idle / wake-on-return, and a browser gateway with signup, HttpOnly sessions, an HTTP + WebSocket proxy and two exposure variants (Ingress, or Gateway API + GitHub SSO). |
agent-sandbox with extensions; kind for the e2e script. |
examples/minimal-single-tenant/ |
The smallest useful setup: a single SandboxTemplate and one SandboxClaim, no gateway — reach DSH Web with a launch-token URL through kubectl port-forward. |
agent-sandbox with extensions. |
The multi-tenant example also documents opt-in gVisor, nodeSelector,
NetworkPolicy, extra provider-key hardening and failed-Pod recovery in
optional hardening.
The example contract (short version)
Full rules: docs/examples.md. scripts/check-examples.sh
enforces the layout, and make check runs it.
README.mdis the walkthrough;manifests/NN-*.yamlis applied with plain kubectl and read in order.- Optional
manifests/optional/<feature>/andmanifests/exposure/<variant>/each ship a README; exposure variants are mutually exclusive. - Optional
scripts/must be executable, idempotent and self-cleaning;docs/holds deeper material. - Components with a Dockerfile need a README and tests; images are published
nested below the main image (
<registry>/<owner>/<repo>/<example>/<component>). - Secrets are
*.yaml.examplewith placeholders; every example is listed above with its literalexamples/<name>/path.
Running an example
Each example README has the exact prerequisites, commands, optional hardening, exposure options and teardown. The multi-tenant example also has a full kind walkthrough that cleans up after itself:
examples/dsh-agents-as-a-service/scripts/e2e-kind.sh
kubectl apply -f manifests/ is non-recursive: optional/ and exposure/
subdirectories are applied explicitly.