> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/NVIDIA/OpenShell/llms.txt
> Use this file to discover all available pages before exploring further.

# Default Policy Reference

> Breakdown of the built-in default policy applied when you create an OpenShell sandbox without a custom policy.

# Default policy reference

The default policy is applied when you create an OpenShell sandbox without `--policy`. It is baked into the community base image ([`ghcr.io/nvidia/openshell-community/sandboxes/base`](https://github.com/nvidia/openshell-community)) and defined in the community repo's `dev-sandbox-policy.yaml`.

## Agent compatibility

The default policy is authored for Claude Code. Other agents require additional policy configuration.

| Agent       | Coverage | Action required                                                                |
| ----------- | -------- | ------------------------------------------------------------------------------ |
| Claude Code | Full     | None. Works out of the box.                                                    |
| OpenCode    | Partial  | Add `opencode.ai` endpoint and OpenCode binary paths.                          |
| Codex       | None     | Provide a complete custom policy with OpenAI endpoints and Codex binary paths. |

<Warning>
  If you run a non-Claude agent without a custom policy, the agent's API calls are denied by the network proxy. You must provide a policy that declares the agent's endpoints and binaries.
</Warning>

## Default filesystem access

The default policy grants the following filesystem access inside the sandbox:

| Path           | Access     | Purpose                        |
| -------------- | ---------- | ------------------------------ |
| `/usr`         | Read-only  | System binaries and libraries  |
| `/lib`         | Read-only  | Shared libraries               |
| `/lib64`       | Read-only  | 64-bit shared libraries        |
| `/proc`        | Read-only  | Process information filesystem |
| `/dev/urandom` | Read-only  | Entropy source                 |
| `/etc`         | Read-only  | System configuration           |
| `/sandbox`     | Read-write | Agent working directory        |
| `/tmp`         | Read-write | Temporary files                |
| `/dev/null`    | Read-write | Null device                    |

The `include_workdir: true` flag is set by default, so the agent's current working directory is always included in read-write access.

## Default network access

The default policy's network rules are defined in `dev-sandbox-policy.yaml` in the community repository. The policy covers the endpoints and binaries required by Claude Code, including the Anthropic API and common development tooling.

<Note>
  The full `dev-sandbox-policy.yaml` source is maintained in the [openshell-community repository](https://github.com/nvidia/openshell-community). Refer to that repository for the current list of permitted hosts, ports, and binaries.
</Note>

## Viewing the active policy

To inspect the policy currently applied to a sandbox:

```bash theme={null}
openshell policy get <sandbox-name>
```

This returns the full policy YAML, including both the default blocks and any custom extensions you have applied.

## Extending the default policy

Use `openshell policy set` to apply a policy file to a running sandbox. Because `network_policies` is a dynamic section, changes take effect immediately without restarting the sandbox.

```bash theme={null}
openshell policy set <sandbox-name> --policy ./my-policy.yaml
```

Your policy file is merged with the default policy blocks. You do not need to redeclare the default filesystem or process settings unless you want to override them.

<Tip>
  Start from the community `dev-sandbox-policy.yaml` and add your agent's endpoints and binary paths. This preserves the default Claude Code coverage while adding support for your agent.
</Tip>

<CardGroup cols={2}>
  <Card title="Policy schema" icon="file-code" href="/reference/policy-schema">
    Complete field reference for all policy YAML fields.
  </Card>

  <Card title="Support matrix" icon="table" href="/reference/support-matrix">
    Supported platforms, prerequisites, and kernel requirements.
  </Card>
</CardGroup>