oz0 tenant sandbox-isolation
Tools from OCI images run in a container.
For: Operators and developers looking up a command.
Tools from OCI images run in a container. A node whose rootful Docker or Podman has gVisor's runsc registered reports it, and the edge labels the node isolation.gvisor=ready. A tool asks for gVisor with isolation: gvisor in its plugin's manifest; this setting makes every OCI tool of the tenant's jobs that an outside event (a webhook, a routine's event) starts run under gVisor too.
Those tools run on the job's tier-1 node: one that offers no gVisor fails the call and says so, and never runs it without gVisor, so give the tenant's tier-1 nodes gVisor first. --oci gvisor sets it, --oci none removes it; with no flag the setting is shown.
Usage
oz0 tenant sandbox-isolation <tenant> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--oci | string | the isolation of OCI tools of outside-started jobs: gvisor, or none | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.