deploy/secrets/providers.yamlfile on the host · not in git
The compose providers service (deploy/provision.py) reads it and passes each value to the gateway as --credential KEY through the subprocess's environment. No value appears on a command line.
real tokenson every docker compose up
OpenShell gatewaycontrol plane
Stores the real tokens.
has real tokenswhen a sandbox is created
myorch workeralso the console and CLI
Passes only provider names, e.g. claude, github-mdm.
names only
workload containeragent process
Env vars hold only placeholders. The container has no network. seccomp intercepts requests and hands them to the supervisor over a Unix socket.
placeholders onlyUnix socket
supervisor containertrusted side
Checks that policy allows this host and path → replaces placeholders with real tokens → opens the connection and forwards.
has real tokenspolicy-allowed egress
Request targetpolicy-allowed hosts