docs: say how credentials reach the sandbox - #1
Open
ananos wants to merge 1 commit into
Open
Conversation
The profile described the boundary and then skipped the part a reader most wants: what happens to their login. It also said credentials are "forwarded per exec", which is now only half true -- the Claude profiles deliver a file into a memory-only mount, and the environment is the other channel rather than the only one. Adds a Credentials section: a sandbox with no credential still boots, `brig secret import` carries the host login in once, and after that a run reads only brig's own store. Signed-off-by: Anastassios Nanos <ananos@nofire.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The org profile described the boundary and then stopped short of what a reader most wants to know: what happens to their login.
It also said credentials are "forwarded per exec". That is now only half the story -- the Claude profiles deliver a file into a memory-only mount, and the environment is the other channel rather than the only one.
Adds a short Credentials section covering the three things someone landing on the org page needs: a sandbox with no credential still boots,
brig secret importcarries the host login in once, and every run after that reads only brig's own store -- no other application's keychain item, no approval dialog.Everything else on the page was checked and is accurate:
install.shresolves,brew trustis a real command, and all four referenced assets return 200.