### Start OpenShift Container Gateway

Source: https://docs.nvidia.com/openshell/about/container-gateway

Run the gateway container with necessary volume mounts and environment variables. This example disables TLS for simplicity and binds to localhost.

```shell
docker run -d \
  --name openshell-gateway \
  --restart unless-stopped \
  --group-add docker \
  -p 127.0.0.1:8080:8080 \
  -v openshell-state:/var/openshell \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/openshell/supervisor/openshell-sandbox:~/openshell/supervisor/openshell-sandbox:ro \
  -e OPENSHELL_DRIVERS=docker \
  -e OPENSHELL_GRPC_ENDPOINT=http://host.openshell.internal:8080 \
  -e OPENSHELL_DOCKER_SUPERVISOR_BIN=~/openshell/supervisor/openshell-sandbox \
  -e OPENSHELL_DB_URL=sqlite:/var/openshell/openshell.db \
  -e OPENSHELL_DISABLE_TLS=true \
  ghcr.io/nvidia/openshell/gateway:latest
```

--------------------------------

### Install OpenShell and Create Sandbox

Source: https://docs.nvidia.com/openshell/llms.txt

Installs OpenShell using a script and then creates a new sandbox environment. Ensure you have `curl` installed.

```shell
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
```

```shell
openshell sandbox create -- claude
```

--------------------------------

### Start OpenShell Sandbox

Source: https://docs.nvidia.com/openshell/latest/get-started/quickstart

This command starts the OpenShell sandbox development server, allowing you to preview your project.

```bash
openshell sandbox dev
```

--------------------------------

### Start llmster Daemon

Source: https://docs.nvidia.com/openshell/get-started/tutorials/local-inference-lmstudio

After installing llmster, use this command to start the daemon in the background. This allows LM Studio to run without the GUI.

```shell
lms daemon up
```

--------------------------------

### OpenShell CLI Installation

Source: https://docs.nvidia.com/openshell/latest/get-started/quickstart

This snippet shows the command to install the OpenShell CLI. Ensure you have Node.js and npm installed.

```bash
npm install -g @openshell/cli
```

--------------------------------

### OCSF Process Launch Log Example

Source: https://docs.nvidia.com/openshell/observability/logging

Example of a log entry indicating a process has been launched within the sandbox.

```text
OCSF PROC:LAUNCH [INFO] sleep(49)
```

--------------------------------

### Install OpenShell CLI and Gateway

Source: https://docs.nvidia.com/openshell/about/installation

Run this command to install OpenShell. It automatically detects your OS and sets up the CLI and local gateway.

```shell
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
```

--------------------------------

### Install OpenShell CLI using uv

Source: https://docs.nvidia.com/openshell/latest/get-started/quickstart

Use this command to install the OpenShell CLI if you prefer using the 'uv' package installer. This ensures the CLI is available on your system.

```shell
uv tool install -U openshell

```

--------------------------------

### Install OpenShell CLI using PyPI

Source: https://docs.nvidia.com/openshell/get-started/tutorials/docker-compose

Installs the OpenShell CLI using the 'uv' package manager from PyPI. This method is suitable for any platform with 'uv' installed.

```shell
uv tool install -U openshell
```

--------------------------------

### Install OpenShell Snap

Source: https://docs.nvidia.com/openshell/about/installation

Installs the OpenShell snap package from the Snap Store. This command requires sudo privileges.

```shell
sudo snap install openshell
```

--------------------------------

### Install OpenShell CLI

Source: https://docs.nvidia.com/openshell/get-started/quickstart

Run this command to install the OpenShell CLI on your workstation. Ensure you have a stable internet connection.

```shell
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

```

--------------------------------

### Install OpenShell using uv

Source: https://docs.nvidia.com/openshell/get-started/quickstart

Use this command to install OpenShell with uv. The -U flag ensures the latest version is installed.

```shell
uv tool install -U
```

--------------------------------

### Create OpenCode Sandbox

Source: https://docs.nvidia.com/openshell/get-started/quickstart

Execute this command to initialize a sandbox environment for OpenCode. Similar to Claude Code, it will guide you through credential setup and environment variable detection for API keys.

```shell
openshell sandbox create -- opencode

```

--------------------------------

### View OpenShell CLI Help

Source: https://docs.nvidia.com/openshell/get-started/quickstart

After installing the CLI, run this command to view the full CLI reference and available options.

```shell
openshell --help
```

--------------------------------

### Install OpenShell with Gateway API

Source: https://docs.nvidia.com/openshell/kubernetes/ingress

Upgrades or installs OpenShell, enabling GRPCRoute and Gateway creation.

```shell
helm upgrade --install openshell \
  oci://ghcr.io/nvidia/openshell/helm-chart \
  --version <version> \
  --namespace openshell \
  --set grpcRoute.enabled=true \
  --set grpcRoute.gateway.create=true \
  --set grpcRoute.gateway.className=eg
```

--------------------------------

### Start LM Studio Server (Headless)

Source: https://docs.nvidia.com/openshell/get-started/tutorials/local-inference-lmstudio

When using llmster in headless mode, start the local inference server using this command. Configure it to bind to all interfaces to be accessible by OpenShell.

```shell
lms server start --bind 0.0.0.0
```

--------------------------------

### Install Ollama

Source: https://docs.nvidia.com/openshell/get-started/tutorials/inference-ollama

Installs Ollama on the gateway host using the official installation script.

```shell
curl -fsSL https://ollama.com/install.sh | sh
```

--------------------------------

### Example Method/Path Rule

Source: https://docs.nvidia.com/openshell/sandboxes/policies

An example rule matching a POST request to any repository's issues endpoint on api.github.com. The '*' in the path glob matches a single path segment.

```text
api.github.com:443:POST:/repos/*/issues
```

--------------------------------

### Install Locally Built OpenShell Snap Package

Source: https://docs.nvidia.com/openshell/about/installation

Installs a locally built OpenShell snap package using the --dangerous flag, followed by commands to connect essential plugs.

```shell
sudo snap install ./openshell_*.snap --dangerous
```

```shell
sudo snap connect openshell:home
```

```shell
sudo snap connect openshell:network
```

```shell
sudo snap connect openshell:network-bind
```

```shell
sudo snap connect openshell:ssh-keys
```

```shell
sudo snap connect openshell:docker docker:docker-daemon
```

```shell
sudo snap connect openshell:log-observe
```

```shell
sudo snap connect openshell:system-observe
```

--------------------------------

### Start Ollama Server

Source: https://docs.nvidia.com/openshell/get-started/tutorials/inference-ollama

Starts the Ollama server, making it accessible from sandboxes by binding to all interfaces (0.0.0.0) on port 11434.

```shell
OLLAMA_HOST=0.0.0.0:11434 ollama serve
```

--------------------------------

### Example Endpoint Summary for L7 Proposals

Source: https://docs.nvidia.com/openshell/sandboxes/policy-advisor

An example of the endpoint summary format for L7 proposals, showing protocol, method, and path.

```text
Endpoints: api.github.com:443 [L7 rest, allow PUT /repos/NVIDIA/OpenShell/contents/docs/**]
```

--------------------------------

### Install llmster (Headless LM Studio)

Source: https://docs.nvidia.com/openshell/get-started/tutorials/local-inference-lmstudio

Use this command to download and install the llmster utility for running LM Studio in headless mode. This is an alternative to the GUI application.

```shell
curl -fsSL https://lmstudio.ai/install.sh | bash
```

--------------------------------

### Create OpenShell Sandbox with OpenCode

Source: https://docs.nvidia.com/openshell/get-started/tutorials/docker-compose

Start the creation process for a sandbox environment tailored for OpenCode. This command provisions a new sandbox instance.

```shell
openshell sandbox create -- opencode
```

--------------------------------

### OCSF Configuration Change Log Examples

Source: https://docs.nvidia.com/openshell/observability/logging

Examples of log entries indicating detected configuration changes and successful policy reloads.

```text
OCSF CONFIG:DETECTED [INFO] Settings poll: config change detected [old_revision:2915564174587774909 new_revision:11008534403127604466 policy_changed:true]
```

```text
OCSF CONFIG:LOADED [INFO] Policy reloaded successfully [policy_hash:0cc0c2b525573c07]
```

--------------------------------

### Start Docker Compose Gateway

Source: https://docs.nvidia.com/openshell/about/container-gateway

Use this command to start the gateway service, volumes, and environment variables defined in the docker-compose.yml file.

```shell
docker compose -f deploy/docker/docker-compose.yml up -d
```

--------------------------------

### Install llmster (PowerShell)

Source: https://docs.nvidia.com/openshell/get-started/tutorials/local-inference-lmstudio

Use this PowerShell command to download and install the llmster utility for running LM Studio in headless mode. This is an alternative to the GUI application.

```powershell
irm https://lmstudio.ai/install.ps1 | iex
```

--------------------------------

### REST Allow Rule Examples

Source: https://docs.nvidia.com/openshell/reference/policy-schema

These examples demonstrate how to configure REST allow rules to match HTTP requests based on method, path, and query parameters. Use these rules to specify granular access control for different API endpoints.

```yaml
rules:
  - allow:
      method: GET
      path: "/**/info/refs*"
      query:
        service: "git-*"
  - allow:
      method: POST
      path: "/**/git-upload-pack"
      query:
        tag:
          any: ["v1.*", "v2.*"]
```

--------------------------------

### Create Sandbox from Base Container

Source: https://docs.nvidia.com/openshell/get-started/quickstart

Use the `--from` flag to create a new sandbox initialized from the base container. This is useful for starting with a clean, pre-configured environment.

```shell
openshell sandbox create --from base

```

--------------------------------

### Example Sandbox Log Output

Source: https://docs.nvidia.com/openshell/observability/accessing-logs

This is an example of the log output format received from the CLI, including timestamps, source, level, and message. OCSF structured events are indicated by 'OCSF' as the level.

```text
[1775014132.118] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/curl(58) -> api.github.com:443 [policy:github_api engine:opa]
[1775014132.190] [sandbox] [OCSF ] [ocsf] HTTP:GET [INFO] ALLOWED GET http://api.github.com/zen [policy:github_api]
[1775014132.690] [sandbox] [OCSF ] [ocsf] NET:OPEN [MED] DENIED /usr/bin/curl(64) -> httpbin.org:443 [policy:- engine:opa]
[1775014113.058] [sandbox] [INFO ] [openshell_sandbox] Starting sandbox
```

--------------------------------

### Start Podman Socket on Linux

Source: https://docs.nvidia.com/openshell/reference/sandbox-compute-drivers

On Linux systems using Podman, enable the Docker-compatible API socket by starting `podman.socket` as a user service. This allows the VM driver to find local container images.

```shell
systemctl --user start podman.socket
```

--------------------------------

### Install OpenShell Helm Chart (Stable Release)

Source: https://docs.nvidia.com/openshell/kubernetes/setup

Install the OpenShell Helm chart from the OCI registry on GHCR. Replace `<version>` with the desired chart version. This command deploys OpenShell and automatically generates PKI secrets.

```shell
helm upgrade --install openshell \
  oci://ghcr.io/nvidia/openshell/helm-chart \
  --version <version> \
  --namespace openshell
```

--------------------------------

### Create Ollama Community Sandbox

Source: https://docs.nvidia.com/openshell/get-started/tutorials/inference-ollama

Use this command to pull the community sandbox image, apply the bundled policy, and start Ollama within the sandbox.

```shell
openshell sandbox create --from ollama
```

--------------------------------

### OCSF HTTP GET Log Example (Non-Default Port)

Source: https://docs.nvidia.com/openshell/observability/logging

Example of an HTTP GET request log entry to a non-default port.

```text
OCSF HTTP:GET [INFO] ALLOWED GET http://api.internal.corp:8080/v1/status [policy:internal_api engine:opa]
```

--------------------------------

### Run Automated Demo Script

Source: https://docs.nvidia.com/openshell/get-started/tutorials/first-network-policy

Execute the provided shell script to run the full walkthrough of the sandbox policy quickstart. This script automates all steps of the tutorial for a quick demonstration.

```shell
bash examples/sandbox-policy-quickstart/demo.sh
```

--------------------------------

### Navigate to Sandbox Directory

Source: https://docs.nvidia.com/openshell/latest/get-started/quickstart

Change into the newly created sandbox directory to begin working on your project.

```bash
cd my-first-sandbox
```

--------------------------------

### GraphQL-over-WebSocket Allow Rules Example

Source: https://docs.nvidia.com/openshell/reference/policy-schema

Configure rules for GraphQL operations over WebSocket. Includes a GET rule for the upgrade and specific rules for subscription, query, or mutation messages.

```yaml
rules:
  - allow:
      method: GET
      path: /graphql
  - allow:
      operation_type: subscription
      fields: [messageAdded]
  - allow:
      operation_type: query
      fields: [viewer]
```

--------------------------------

### WebSocket Allow Rules Example

Source: https://docs.nvidia.com/openshell/reference/policy-schema

Configure rules to allow WebSocket upgrade handshakes and subsequent client text messages. Use GET for the handshake and WEBSOCKET_TEXT for messages on the specified path.

```yaml
rules:
  - allow:
      method: GET
      path: /v1/realtime/**
  - allow:
      method: WEBSOCKET_TEXT
      path: /v1/realtime/**
```

--------------------------------

### WebSocket Deny Rules Example

Source: https://docs.nvidia.com/openshell/reference/policy-schema

Define WebSocket deny rules to block specific messages or upgrade handshakes. 'WEBSOCKET_TEXT' denies client text messages, while 'GET' denies upgrade handshakes.

```yaml
endpoints:
  - host: realtime.example.com
    port: 443
    protocol: websocket
    enforcement: enforce
    access: read-write
    deny_rules:
      - method: WEBSOCKET_TEXT
        path: "/v1/admin/**"
```

--------------------------------

### Create an OpenShell Sandbox

Source: https://docs.nvidia.com/openshell/get-started/quickstart

Use this command to create a new sandbox environment. The CLI will prompt you to set up a provider from local credentials. Type 'yes' to continue. If OPENAI_API_KEY or OPENROUTER_API_KEY is set, it will be picked up automatically. Otherwise, configure it after the sandbox launches.

```shell
openshell sandbox create -- opencode

```

```shell
openshell sandbox create -- codex

```

--------------------------------

### Create Sandbox from Base Container

Source: https://docs.nvidia.com/openshell/get-started/quickstart

Creates a new OpenShell sandbox using the base container image. This is useful when you want to start with a minimal environment.

```shell
openshell sandbox create --from
```

--------------------------------

### Create Sandbox with CPU and Memory Limits

Source: https://docs.nvidia.com/openshell/sandboxes/manage-sandboxes

Creates a sandbox with specified CPU and memory limits. CPU values use Kubernetes-style quantities, and memory values use byte quantities.

```shell
openshell sandbox create --cpu 2 --memory 4Gi -- claude
```

--------------------------------

### NVIDIA OpenShell Alpha Status Warning

Source: https://docs.nvidia.com/openshell/latest/get-started/quickstart

This code snippet is part of the MDX content for the NVIDIA OpenShell quickstart. It displays a warning message indicating that the software is in alpha and should not be used in production.

```javascript
var <define:process.env\u003E = __esm({
 "\u003cdefine:process.env\u003e"() {
 }
});

// global-externals:react/jsx-runtime
var require_jsx_runtime = __commonJS({
 "global-externals:react/jsx-runtime"(exports, module) {
 init_define_process_env();
 module.exports = _jsx_runtime;
 }
});

// _mdx_bundler_entry_point-77c4abb4-2020-407d-a7de-50738a7464bb.mdx
var mdx_bundler_entry_point_77c4abb4_2020_407d_a7de_50738a7464bb_exports = {};
__export(mdx_bundler_entry_point_77c4abb4_2020_407d_a7de_50738a7464bb_exports, {
 default: () => MDXContent,
 frontmatter: () => frontmatter
});
init_define_process_env();
var import_jsx_runtime = __toESM(require_jsx_runtime());

// global-externals:@mdx-js/react
init_define_process_env();
var { useMDXComponents } = MdxJsReact;

// _mdx_bundler_entry_point-77c4abb4-2020-407d-a7de-50738a7464bb.mdx
var frontmatter = void 0;
function _createMdxContent(props) {
 const _components = {
 p: "p",
 ...useMDXComponents(),
 ...props.components
 }, { ErrorBoundary, Strong } = _components;
 if (!ErrorBoundary) _missingMdxReference("ErrorBoundary", true);
 if (!Strong) _missingMdxReference("Strong", true);
 return (0, import_jsx_runtime.jsxs)(_components.p, {
 children: ["\u{1F514} NVIDIA OpenShell is ", (0, import_jsx_runtime.jsx)(ErrorBoundary, {
 children: (0, import_jsx_runtime.jsx)(Strong, {
 children: "alpha software"
 })
 }), ". APIs and behavior may change without notice. Do not use in production."]
 });
}

function MDXContent(props = {}) {
 const { wrapper: MDXLayout } = {
 ...useMDXComponents(),
 ...props.components
 };
 return MDXLayout ? (0, import_jsx_runtime.jsx)(MDXLayout, {
 ...props,
 children: (0, import_jsx_runtime.jsx)(_createMdxContent, {
 ...props
 })
 }) : _createMdxContent(props);
}

function _missingMdxReference(id, component) {
 throw new Error("Expected " + (component ? "component" : "object") + " \`" + id + "\` to be defined: you likely forgot to import, pass, or provide it.");
}

return __toCommonJS(mdx_bundler_entry_point_77c4abb4_2020_407d_a7de_50738a7464bb_exports);
})();
;return Component;
```

--------------------------------

### Install cert-manager

Source: https://docs.nvidia.com/openshell/kubernetes/managing-certificates

Add the Jetstack Helm repository and install cert-manager with CRD support enabled. Ensure cert-manager pods are running after installation.

```shell
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm upgrade --install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true \
  --wait
```

```shell
kubectl -n cert-manager get pods
```

--------------------------------

### Create OpenShell Sandbox

Source: https://docs.nvidia.com/openshell/latest/get-started/quickstart

This command initializes a new OpenShell sandbox project. Navigate to your desired directory before running.

```bash
openshell sandbox create my-first-sandbox
```

--------------------------------

### Download and Load Model in LM Studio

Source: https://docs.nvidia.com/openshell/get-started/tutorials/local-inference-lmstudio

Use these commands to download a model (e.g., Qwen3.5 2B) and load it within the LM Studio application.

```shell
lms get qwen/qwen3.5-2b
lms load qwen/qwen3.5-2b
```

--------------------------------

### Full OpenShell Gateway Configuration Example

Source: https://docs.nvidia.com/openshell/reference/gateway-config

A comprehensive TOML configuration for the OpenShell gateway, covering all sections and settings. Trim to the fields you need for your specific deployment.

```toml
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

[openshell]
version = 1

[openshell.gateway]
bind_address          = "0.0.0.0:8080"
health_bind_address   = "0.0.0.0:8081"
metrics_bind_address  = "0.0.0.0:9090"

log_level             = "info"

# When empty, the gateway auto-detects Kubernetes, then Podman, then Docker.
# VM is never auto-detected and requires an explicit entry here.
compute_drivers       = ["kubernetes"]

sandbox_namespace     = "openshell"
ssh_session_ttl_secs  = 3600

# Subject Alternative Names baked into the gateway server certificate.
# Wildcard DNS SANs (e.g. "*.dev.openshell.localhost") also enable sandbox
# service URLs under that domain.
server_sans                  = ["openshell", "*.dev.openshell.localhost"]
# Allow plaintext HTTP routing for loopback sandbox service URLs.
enable_loopback_service_http = true

# Set true only for local plaintext gateways or trusted TLS termination.
disable_tls = false

# Shared driver defaults. These inherit into [openshell.drivers.<name>] tables
# when the driver-specific table does not override them.
default_image           = "ghcr.io/nvidia/openshell/sandbox:latest"
supervisor_image        = "ghcr.io/nvidia/openshell/supervisor:latest"
client_tls_secret_name  = "openshell-client-tls"
service_account_name    = "openshell-sandbox"
host_gateway_ip         = "10.0.0.1"
enable_user_namespaces  = false
sa_token_ttl_secs       = 3600
guest_tls_ca            = "/etc/openshell/certs/ca.pem"
guest_tls_cert          = "/etc/openshell/certs/client.pem"
guest_tls_key           = "/etc/openshell/certs/client-key.pem"

# Optional gRPC rate limit. Both values must be positive to enable the limit.
# Set either value to 0, or omit both, to disable rate limiting.
grpc_rate_limit_requests       = 120
grpc_rate_limit_window_seconds = 60

# Gateway listener TLS (distinct from the per-driver guest_tls_*).
[openshell.gateway.tls]
cert_path             = "/etc/openshell/certs/gateway.pem"
key_path              = "/etc/openshell/certs/gateway-key.pem"
client_ca_path        = "/etc/openshell/certs/client-ca.pem"
require_client_auth   = false

[openshell.gateway.gateway_jwt]
signing_key_path = "/etc/openshell/jwt/signing.pem"
public_key_path  = "/etc/openshell/jwt/public.pem"
kid_path         = "/etc/openshell/jwt/kid"
gateway_id       = "openshell"
# Omit or set to 0 only for local single-player Docker, Podman, or VM gateways.
ttl_secs         = 3600

[openshell.gateway.auth]
allow_unauthenticated_users = false

[openshell.gateway.mtls_auth]
enabled = false

[openshell.gateway.oidc]
issuer        = "https://idp.example.com/realms/openshell"
audience      = "openshell-cli"
jwks_ttl_secs = 3600
roles_claim   = "realm_access.roles"
admin_role    = "openshell-admin"
user_role     = "openshell-user"
scopes_claim  = ""

```

--------------------------------

### Install Envoy Gateway

Source: https://docs.nvidia.com/openshell/kubernetes/ingress

Installs Envoy Gateway using Helm, including CRDs and controller.

```shell
helm install eg \
  oci://docker.io/envoyproxy/gateway-helm \
  --version v1.8.1 \
  --namespace envoy-gateway-system \
  --create-namespace \
  --wait
```

--------------------------------

### Create Sandbox with File Uploads

Source: https://docs.nvidia.com/openshell/sandboxes/manage-sandboxes

Create a new sandbox and upload multiple specified paths into it during creation.

```shell
openshell sandbox create --upload ./src:/workspace/src --upload ./config:/workspace/config -- claude
```

--------------------------------

### OCSF SSH Open Log Example

Source: https://docs.nvidia.com/openshell/observability/logging

Example of a log entry indicating an accepted SSH connection.

```text
OCSF SSH:OPEN [INFO] ALLOWED
```

--------------------------------

### Start or Restart Gateway

Source: https://docs.nvidia.com/openshell/get-started/tutorials/docker-compose

Use this command to start the gateway in detached mode or restart it if it's already running.

```bash
docker compose up -d
```

--------------------------------

### OCSF Network Open Denial Log Example (No Policy)

Source: https://docs.nvidia.com/openshell/observability/logging

Example of a network connection denied because no matching policy was found.

```text
OCSF NET:OPEN [MED] DENIED /usr/bin/curl(64) -> httpbin.org:443 [policy:- engine:opa] [reason:no matching policy]
```

--------------------------------

### Create Sandbox with Port Forwarding

Source: https://docs.nvidia.com/openshell/sandboxes/manage-sandboxes

Create a new sandbox and simultaneously configure a port forward.

```shell
openshell sandbox create --forward 8000 -- claude
```

--------------------------------

### OCSF Network Activity Log Example

Source: https://docs.nvidia.com/openshell/observability/logging

Example of an allowed HTTPS connection log entry in the OCSF shorthand format.

```text
OCSF NET:OPEN [INFO] ALLOWED /usr/bin/curl(58) -> api.github.com:443 [policy:github_api engine:opa]
```

--------------------------------

### Launch Sandbox with Microsoft Graph Provider

Source: https://docs.nvidia.com/openshell/get-started/tutorials/microsoft-graph-provider-refresh

Launches a sandbox environment with the Microsoft Graph provider pre-configured. Use `--keep` to retain the sandbox after exit and `--no-auto-providers` to manually manage providers.

```shell
openshell sandbox create \
  --name microsoft-graph-mail \
  --keep \
  --provider microsoft-mail \
  --no-auto-providers \
  -- /bin/sh
```

--------------------------------

### Create Sandbox with Docker Bind Mount

Source: https://docs.nvidia.com/openshell/reference/sandbox-compute-drivers

After enabling bind mounts, use this command to create a sandbox with a host directory mounted. Use with caution due to potential loss of isolation.

```shell
openshell sandbox create \
  --driver-config-json '{"docker":{"mounts":[{"type":"bind","source":"/srv/openshell/work","target":"/sandbox/work","read_only":false}]}}' \
  -- claude
```

--------------------------------

### OCSF HTTP POST Denial Log Example

Source: https://docs.nvidia.com/openshell/observability/logging

Example of an L7 read-only policy denying a POST request log entry.

```text
OCSF HTTP:POST [MED] DENIED POST http://api.github.com/user/repos [policy:github_api engine:opa]
```

--------------------------------

### Create Local OpenAI-Compatible Provider

Source: https://docs.nvidia.com/openshell/sandboxes/inference-routing

Creates a local OpenAI-compatible provider pointing to a host-backed server. Use a dummy API key if not required.

```shell
openshell provider create \
    --name my-local-model \
    --type openai \
    --credential OPENAI_API_KEY=empty-if-not-required \
    --config OPENAI_BASE_URL=http://host.openshell.internal:11434/v1
```

--------------------------------

### Auto-Update Ollama on Sandbox Start

Source: https://docs.nvidia.com/openshell/get-started/tutorials/inference-ollama

Configure the sandbox to automatically update Ollama every time it starts by setting the `OLLAMA_UPDATE` environment variable.

```shell
openshell sandbox create --from ollama -e OLLAMA_UPDATE=1
```

--------------------------------

### OCSF Proxy and SSH Listen Log Examples

Source: https://docs.nvidia.com/openshell/observability/logging

Examples of log entries indicating that proxy and SSH servers are listening on specified addresses and ports.

```text
OCSF NET:LISTEN [INFO] 10.200.0.1:3128
```

```text
OCSF SSH:LISTEN [INFO]
```

--------------------------------

### Wait for Deployment Gateway Readiness

Source: https://docs.nvidia.com/openshell/kubernetes/setup

If your workload is configured as a Deployment, use this command to monitor its rollout status and confirm gateway readiness.

```shell
kubectl -n openshell rollout status deployment/openshell
```

--------------------------------

### Start OpenShell Gateway with Docker Compose

Source: https://docs.nvidia.com/openshell/get-started/tutorials/docker-compose

Starts the OpenShell gateway in detached mode using Docker Compose. Ensure you are in the 'deploy/docker' directory before running.

```shell
cd deploy/docker
docker compose up -d
```

--------------------------------

### Create Sandbox with Vertex AI Provider

Source: https://docs.nvidia.com/openshell/providers/google-vertex-ai

Creates a new OpenShell sandbox and attaches the previously configured Vertex AI provider to it.

```shell
# 4. Create a sandbox with the provider attached
openshell sandbox create --name my-sandbox --provider vertex-local
```

--------------------------------

### Create Google Vertex AI Provider from Existing Environment

Source: https://docs.nvidia.com/openshell/providers/google-vertex-ai

Use this command to create a Google Vertex AI provider by reading credentials and configuration from existing environment variables. Ensure the relevant token, project ID, and region variables are set before execution.

```shell
openshell provider create \
  --name vertex-env \
  --type google-vertex-ai \
  --from-existing
```

--------------------------------

### Connect to an OpenShell Sandbox

Source: https://docs.nvidia.com/openshell/get-started/tutorials/docker-compose

Establish a connection to a specific sandbox instance once it is ready. Replace `<sandbox-name>` with the actual name of your sandbox.

```shell
openshell sandbox connect <sandbox-name>
```

--------------------------------

### OCSF Network Open Denial Log Example (SSRF)

Source: https://docs.nvidia.com/openshell/observability/logging

Example of a network connection denied because the destination resolves to an always-blocked address, indicating a potential SSRF attempt.

```text
OCSF NET:OPEN [MED] DENIED /usr/bin/curl(1618) -> 169.254.169.254:80 [policy:- engine:ssrf] [reason:resolves to always-blocked address]
```