Skip to content

Getting started

This page takes you from subscribing to running your first sandbox. It takes about fifteen minutes and needs no model-provider key.

You need: an AWS account that can subscribe to AWS Marketplace products and launch EC2 instances, and either an EC2 key pair for SSH or an instance profile for AWS Systems Manager Session Manager.

1. Subscribe and launch

  1. Open the Sushi OpenShell listing and choose View purchase options, then Subscribe.
  2. When the subscription is confirmed, choose Launch your software.
  3. Keep the recommended t4g.medium instance type. The image is ARM64, so it needs a Graviton instance type.
  4. Under Configure storage, set the root volume to at least 32 GiB.
  5. Choose how you will connect:
    • Session Manager (no inbound ports): under Advanced details, choose an IAM instance profile with minimal permissions for Systems Manager, such as the AWS managed policy AmazonSSMManagedInstanceCore.
    • SSH: choose a key pair, and allow TCP 22 only from your administrative address range.
  6. Choose Launch instance.

Replace the recommended SSH rules

The recommended security group allows SSH from a few private 10.x.x.x ranges. Replace them with your own administrative address, for example 203.0.113.10/32, or remove all inbound rules if you use Session Manager.

2. Connect

With Session Manager: in the EC2 console, select the instance, choose Connect, then Session Manager, then Connect. Then switch to the ubuntu user:

sudo -iu ubuntu

With SSH:

ssh -i <your-key.pem> ubuntu@<public-ip>

3. Wait for first boot to finish

On first boot, the instance creates its own TLS identity and starts the gateway. This takes a minute or two after the instance shows Running. To wait for it and check it:

sudo cloud-init status --wait
sudo systemctl status sushi-openshell --no-pager

4. Check the gateway

As ubuntu:

openshell --version
openshell status

openshell status reports Status: Connected when the gateway is ready.

5. Run the walkthrough

bash /opt/sushi/docs/demo.sh

It prints each command and its real output as it creates a small sandbox, runs a command inside it as a non-root user, lists and inspects it, and removes it. Success ends with SUSHI_CUSTOMER_DEMO_PASSED.

6. Try it yourself

openshell sandbox create --name demo --cpu 1 --memory 256Mi --detach -- /bin/sleep 600
openshell sandbox exec -n demo --no-login-shell -- /bin/echo hello-from-sandbox
openshell sandbox delete demo

Next, see Configuration to connect an agent and a model provider.