> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/openshell/_mcp/server.

# Tutorials

> Step-by-step walkthroughs for OpenShell, from first sandbox to production-ready policies.

Hands-on walkthroughs that teach OpenShell concepts by building real configurations. Each tutorial builds on the previous one, starting with core sandbox mechanics and progressing to production workflows.

#### [First Network Policy](/get-started/tutorials/first-network-policy)

Create a sandbox, observe default-deny networking, apply a read-only L7 policy, and inspect audit logs. No AI agent required.

#### [GitHub Push Access](/get-started/tutorials/github-sandbox)

Launch Claude Code in a sandbox, diagnose a policy denial, and iterate on a custom GitHub policy from outside the sandbox.

#### [Microsoft Graph Provider Refresh](/get-started/tutorials/microsoft-graph-provider-refresh)

Configure a Providers v2 Microsoft Graph provider with gateway-managed OAuth2 refresh-token rotation.

#### [Inference with Ollama](/get-started/tutorials/inference-ollama)

Route inference through Ollama using cloud-hosted or local models, and verify it from a sandbox.

#### [Local Inference with LM Studio](/get-started/tutorials/local-inference-lmstudio)

Route inference to a local LM Studio server using the OpenAI-compatible or Anthropic-compatible APIs.

#### [Docker Compose Setup](/get-started/tutorials/docker-compose)

Run the OpenShell gateway as a Docker Compose service and create agent sandboxes including OpenClaw.

> Step-by-step walkthroughs for OpenShell, from first sandbox to production-ready policies.

## Docs

- [Run the Gateway with Docker Compose](https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/docker-compose.md): Run the OpenShell gateway as a Docker Compose service and create agent sandboxes.
- [Write Your First Sandbox Network Policy](https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/first-network-policy.md): Learn how OpenShell network policies work by creating a sandbox, observing default-deny in action, and applying a fine-grained L7 read-only rule.
- [Grant GitHub Push Access to a Sandboxed Agent](https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/github-sandbox.md): Learn the iterative policy workflow by launching a sandbox, diagnosing a GitHub access denial, and applying a custom policy to fix it.
- [Run Local Inference with Ollama](https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/inference-ollama.md): Run local and cloud models inside an OpenShell sandbox using the Ollama community sandbox, or route sandbox requests to a host-level Ollama server.
- [Route Local Inference Requests to LM Studio](https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/local-inference-lmstudio.md): Configure inference.local to route sandbox requests to a local LM Studio server running on the gateway host.
- [Refresh Microsoft Graph Credentials with Providers v2](https://docs.nvidia.com/openshell/v0.0.116/get-started/tutorials/microsoft-graph-provider-refresh.md): Configure a Providers v2 Microsoft Graph profile with gateway-managed OAuth2 refresh-token rotation.