> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/openshell/v0.1.3/how-it-works/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/openshell/_mcp/server.

# How It Works

## Docs

- [Manage Gateways](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/gateways/overview.md): Register OpenShell gateways, switch between environments, inspect gateway status, and troubleshoot gateway access.
- [Gateway Authentication](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/gateways/authentication.md): Gateway resolution, authentication modes, connection flow, OIDC support, and credential file layout.
- [Gateway Configuration File](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/gateways/configuration.md): Reference for the OpenShell gateway TOML configuration file (RFC 0003).
- [Running the Gateway as a Container](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/gateways/container-deployment.md): Run the OpenShell gateway using docker run or docker-compose without the installer.
- [Workspaces](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/workspaces.md): Create OpenShell workspaces, assign members, and understand platform and workspace roles.
- [Manage Sandboxes](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/sandboxes/overview.md): Create sandboxes, understand sandbox isolation, and manage the full sandbox lifecycle.
- [Sandbox Templates](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/sandboxes/templates.md): Define reusable sandbox workload settings and create sandboxes from templates.
- [Sandbox Runtimes](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/sandboxes/runtimes.md): Configure the Docker, Podman, MicroVM, or Kubernetes runtime that runs OpenShell sandboxes.
- [Providers](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/providers/overview.md): Create and manage credential providers that inject API keys and tokens into OpenShell sandboxes.
- [Profiles](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/providers/profiles.md): Use provider profiles to attach credentials, network policy, and refresh metadata to OpenShell sandboxes.
- [AWS SigV4 Credential Signing](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/providers/aws.md): Configure proxy-side AWS SigV4 request signing so sandbox agents can reach AWS services through CONNECT tunnels without holding real credentials.
- [Google](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/providers/google.md): Authenticate with Google Cloud APIs and Vertex AI inside OpenShell sandboxes.
- [Sandbox Policies](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/overview.md): Understand what sandbox policies control and where a sandbox's policy comes from.
- [Network Rules](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/network-rules.md): Understand how OpenShell evaluates network rules, and adapt examples for REST APIs, package registries, internal services, WebSocket, GraphQL, MCP, and native TCP.
- [Manage Sandbox Policies](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/manage-policies.md): Use the OpenShell CLI to set, inspect, change, verify, and roll back sandbox policies, apply a global policy, and troubleshoot policy problems.
- [Policy Prover](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/prover.md): Understand how OpenShell uses the policy prover, and check that a policy grants no more access than a boundary policy you define.
- [Policy Advisor](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/advisor.md): Let an agent in a sandbox propose the network rule it needs when OpenShell blocks a request, and control which proposals take effect.
- [Default Policy and Baseline Paths](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/default-policy.md): The restrictive fallback policy used when a sandbox has no explicit or embedded policy, and the baseline paths OpenShell adds to sandbox policies.
- [Policy Schema Reference](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/policies/schema.md): Fields, defaults, and constraints for the sandbox policy schema.
- [Inference](https://docs.nvidia.com/openshell/v0.1.3/how-it-works/inference.md): Grant a sandbox access to model providers through provider profiles, attachments, and native endpoints.