Devboxes turns Kubernetes capacity into persistent, SSH-accessible development environments. This documentation covers the supported installation, daily use, operations, security, and contribution paths.
- README, product overview, requirements, and the shortest installation path.
- Golden path, the recommended production-shaped setup and fastest daily workflow.
- Configuration, every supported Helm value and deployment mode.
- Credentials, controller authentication and optional workspace accounts.
- Multi-tenancy, tenant namespaces, roles, Secrets, quotas, policy allowlists, migration, and isolation boundaries.
- CLI reference, commands, global flags, environment variables, output, and SSH forwarding.
- API reference, authentication, endpoints, request and response contracts, and errors.
- GPU acceleration, profile design, cluster prerequisites, images, scheduling, security, and diagnosis.
- Custom image profiles, approved service sidecars, compatible workspace derivatives, security boundaries, and lifecycle behavior.
- Insights, opt-in AI telemetry, aggregate Git activity, privacy boundaries, retention, backup, and purge.
- The authenticated
/docspage in a running controller, an operator-focused guide rendered with installation-specific values.
- Architecture, components, Kubernetes resources, persistence, scheduling, and trust boundaries.
- Operations, health, metrics, capacity, backups, upgrades, recovery, and routine maintenance.
- Troubleshooting, symptom-led diagnosis for scheduling, storage, SSH, authentication, and image failures.
- Security policy, supported versions, private reporting, deployment controls, and supply-chain policy.
- Support, public support channels and a redacted diagnostic bundle.
- Development, toolchains, local workflows, test layers, code layout, and release contract.
- Contributing, review expectations, compatibility rules, and pull request requirements.
- Code of Conduct, community behavior and enforcement.
Devboxes supports a backward-compatible single-operator mode and an opt-in
namespace-per-tenant mode. Each workspace has persistent home storage, each SSH Service uses
either LoadBalancer or NodePort, and GPU devices and custom images remain
operator-approved profiles. Arbitrary hostile container execution, browser terminals,
cluster-wide GPU driver installation, and automatic PVC deletion remain outside the
supported scope.