README
¶
osg-runtime
MIT · Sandbox lifecycle, Docker driver, CONNECT proxy, env allowlist, osg-init.
go test -C osg-runtime ./...
go build -C osg-cli -o osg ./cmd/osg && ./osg health
Directories
¶
| Path | Synopsis |
|---|---|
|
Package audit emits structured security / lifecycle events in OCSF shorthand (NVIDIA OpenShell–compatible) for agent observation via `osg logs` / `osg term`.
|
Package audit emits structured security / lifecycle events in OCSF shorthand (NVIDIA OpenShell–compatible) for agent observation via `osg logs` / `osg term`. |
|
cmd
|
|
|
osg-agent
command
Command osg-agent dials the gateway relay WebSocket and runs exec requests.
|
Command osg-agent dials the gateway relay WebSocket and runs exec requests. |
|
osg-init
command
Command osg-init runs inside the sandbox: apply harden, then exec the agent.
|
Command osg-init runs inside the sandbox: apply harden, then exec the agent. |
|
osg-sshd
command
Command osg-sshd is a minimal SSH server for sandbox connect --ssh.
|
Command osg-sshd is a minimal SSH server for sandbox connect --ssh. |
|
Package harden applies Landlock, privilege drop, and related guest restrictions.
|
Package harden applies Landlock, privilege drop, and related guest restrictions. |
|
Package idp defines control-plane identity adapters (OIDC / mTLS).
|
Package idp defines control-plane identity adapters (OIDC / mTLS). |
|
Package inference is the product catalog / helpers for LLM egress (P5).
|
Package inference is the product catalog / helpers for LLM egress (P5). |
|
Package refresh defines managed credential refresh backends.
|
Package refresh defines managed credential refresh backends. |
|
Package sandbox orchestrates create → proxy/harden → run → destroy.
|
Package sandbox orchestrates create → proxy/harden → run → destroy. |
|
Package secrets — LocalEncrypted persists provider credential values next to gateway state (OpenShell-like: values never appear in state.json plaintext).
|
Package secrets — LocalEncrypted persists provider credential values next to gateway state (OpenShell-like: values never appear in state.json plaintext). |
Click to show internal directories.
Click to hide internal directories.