Skip to content
xcsh

Containers

The published container packages xcsh for process isolation and repeatable deployment. It does not grant cloud credentials or filesystem access by itself.

How do I verify an image?

Section titled “How do I verify an image?”
Terminal window
docker pull ghcr.io/f5-sales-demo/xcsh:latest
docker run --rm ghcr.io/f5-sales-demo/xcsh:latest --version

Pin a version tag or digest for automation. Mount only the task directory and inject credentials through the runtime’s secret mechanism.

What must remain outside the image?

Section titled “What must remain outside the image?”

Keep user contexts, provider tokens, and writable session data in explicit mounts or secret stores. Do not bake them into a derived layer.

Pull a versioned image, resolve its immutable digest, and run xcsh --version from that digest before mounting a workspace. The container image supplies the executable, not model or tenant authority. Mount only required paths read-only where possible and inject credentials at runtime through the platform’s secret mechanism. Remove the test container after exit; delete the pinned image only when no deployment still references its digest.