docs: add example - #229
Open
JimBugwadia wants to merge 1 commit into
Open
Conversation
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new “shadow AI” example that demonstrates running Claude Code inside a Kubernetes pod and using a single monitor-mode RuntimePolicy to inventory observable runtime activity (exec/open/network/protocol/dns), and wires that example into the user-facing example indexes.
Changes:
- Add a new
examples/shadow-ai/monitor-claude-code/runnable example (Dockerfile, manifests, and demo script). - Document the workflow and expectations for the example in a new README.
- Link the new example from the Shadow AI index and the user docs examples list.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| examples/shadow-ai/README.md | Adds the new example to the Shadow AI example index table. |
| examples/shadow-ai/monitor-claude-code/README.md | Documents how to run and verify the new Claude Code monitoring example. |
| examples/shadow-ai/monitor-claude-code/policy.yaml | Monitor-mode RuntimePolicy to observe exec/open/network/protocol/dns broadly. |
| examples/shadow-ai/monitor-claude-code/pod.yaml | Pod manifest for the Claude Code demo workload. |
| examples/shadow-ai/monitor-claude-code/Dockerfile | Builds an image with the Claude Code CLI installed and a writable workspace. |
| examples/shadow-ai/monitor-claude-code/demo.sh | Automates build/load/apply/run/print-findings/cleanup for the example. |
| docs/users/examples.md | Links the new example from the user documentation examples table. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| | [trusted-and-untrusted-agents](trusted-and-untrusted-agents/) | name | Give a declared agent a hard TLS-to-one-Service boundary, and report which LLM providers an undeclared one resolves | enforce and monitor | cgroup v2 | | ||
| | [detect-ai-sdks](detect-ai-sdks/) | file | Report the AI SDKs, model files, model caches, and agent credentials a workload reads | monitor | BPF-LSM | | ||
| | [detect-agent-cli](detect-agent-cli/) | process | Report the coding-agent CLIs and self-hosted inference servers a workload launches | monitor | BPF-LSM | | ||
| | [monitor-claude-code](monitor-claude-code/) | process, file, name, destination | Run Claude Code in a container and inventory its observable runtime activity | monitor | BPF-LSM for `open` and `exec`; cgroup v2 for network-side findings | |
| current release. Pin the package version for a reproducible run: | ||
|
|
||
| ```bash | ||
| CLAUDE_CODE_VERSION=2.x.y ./demo.sh |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request
What this changes and why
Add an example to monitor a coding assistant
How it was validated
make buildandmake testpassa kind cluster (
make kind-install, plus a targeted check such asmake smoke-quickstart,make test-e2e-egress, ormake test-e2e-protocol)pkg/bpf/lsm,pkg/lsmmgr, oropen/execbehavior:ran
make test-e2e-lsm(ormake test-e2e) on a host with BPF-LSM active(Docker Desktop or a
lsm=...,bpfLinux VM) — CI cannot exercise this, seeCONTRIBUTING.md
make lint-docspasses, for any markdown changeGenerated artifacts
make verify-crdspasses, or this PR does not touchapi/v1alpha1make verify-bpfpasses, or this PR does not touchpkg/bpf/*/_cprogtest/e2e/bpfverify_test.go, or this PRdoes not add one
Documentation
docs/dev/DESIGN.mdupdated, or this PR does not change the architecturedocs/users/page updated, or this PR does not changeuser-visible behavior
Commits
git commit -s), per CONTRIBUTING.md