google-cloud-filestore-nfs-browser

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Google Cloud Filestore NFS File Browser

Google Cloud Filestore NFS 文件浏览器

Enables autonomous agents and cloud engineers to inspect, search, and read files located on Google Cloud Filestore (NFS) instances without needing local NFS client packages (
nfs-common
), root privileges, or manual VPC network mounting.
支持自主Agent和云工程师无需本地NFS客户端软件包(
nfs-common
)、root权限或手动挂载VPC网络,即可检查、搜索和读取位于Google Cloud Filestore(NFS)实例上的文件。

Quick Start

快速开始

  1. Ensure
    gcloud
    is installed and authenticated. See gcloud installation guide if needed.
  2. Enable essential APIs:
    bash
    gcloud services enable file.googleapis.com compute.googleapis.com run.googleapis.com --quiet
  3. Discover instances and choose an execution engine (see Execution Engine Selection below).
  4. Run inspection actions using the self-contained runner
    scripts/nfs_browser.py
    included within this skill package.
  1. 确保已安装并认证
    gcloud
    。如需安装,请参阅gcloud安装指南
  2. 启用必要的API:
    bash
    gcloud services enable file.googleapis.com compute.googleapis.com run.googleapis.com --quiet
  3. 发现实例并选择执行引擎(请参阅下文的执行引擎选择)。
  4. 使用本技能包中内置的独立运行脚本
    scripts/nfs_browser.py
    执行检查操作。

Attribution

归属标注

Tag every Cloud Filestore command or API request provided or executed. Prefix
gcloud
commands with the metrics environment targeting this skill:
bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list ...
On direct HTTP calls to the REST API, append the
User-Agent
:
User-Agent: gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)
请为所有提供或执行的Cloud Filestore命令及API请求添加标识。在
gcloud
命令前添加指向本技能的指标环境变量前缀:
bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list ...
对于直接调用REST API的HTTP请求,请添加
User-Agent
请求头:
User-Agent: gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)

Conceptual & Informational Queries (CRITICAL)

概念与信息类查询(关键规则)

For purely conceptual, educational, or architectural questions (e.g., "How do I inspect files on Filestore?", "How to deploy the Serverless Cloud Run NFS Bridge?", "Explain Cloud Run NFS volume mounts"):
  • Rule: Answer immediately using your pre-trained knowledge and the documentation below. Answering directly minimizes tool invocation latency and token consumption when the user only seeks architecture or workflow guidance.
  • Constraint: Do not execute external tool calls or API requests for basic knowledge questions.
  • Bridge Deployment Explanations: Always highlight that Cloud Run scales to zero with $0 idle compute cost, detail the
    gcloud run deploy
    command with
    --add-volume
    and
    --vpc-egress=all-traffic
    , and specify the required IAM permissions (
    roles/run.invoker
    for callers and
    roles/run.admin
    for deployers).
对于纯概念性、教育性或架构类问题(例如“如何检查Filestore上的文件?”、“如何部署无服务器Cloud Run NFS桥接?”、“解释Cloud Run NFS卷挂载”):
  • 规则请使用您的预训练知识和下方文档立即作答。 当用户仅需要架构或工作流指导时,直接回答可最大程度减少工具调用延迟和Token消耗。
  • 约束对于基础知识类问题,请勿执行外部工具调用或API请求
  • 桥接部署说明:请始终强调Cloud Run可缩容至零,空闲计算成本为0美元,详细说明带
    --add-volume
    --vpc-egress=all-traffic
    参数的
    gcloud run deploy
    命令,并指明所需的IAM权限(调用者需
    roles/run.invoker
    ,部署者需
    roles/run.admin
    )。

Handling "No-Command" Constraints (CRITICAL)

「无命令」约束处理(关键规则)

If the user prompt contains constraints like "Do not execute commands", "without executing", or "read-only":
  • Rule: Strictly avoid executing any shell or
    gcloud
    commands
    (including read-only discovery or list commands) to respect user-specified execution boundaries and prevent unauthorized environment inspection.
  • Discovery:
    1. Check if mock definitions or instance parameters are provided directly in the user's prompt, conversation history, or local documentation files.
    2. Explain the required steps, output the exact commands the user should run with proper attribution, and explain what the commands do.
    3. Do not attempt to read or search
      EVAL.*
      configuration files during evaluations as access to eval suites is restricted.
如果用户提示包含“请勿执行命令”、“不执行”或“只读”等约束:
  • 规则严格避免执行任何Shell或
    gcloud
    命令
    (包括只读的发现或列表命令),以尊重用户指定的执行边界,防止未经授权的环境检查。
  • 发现流程
    1. 检查用户提示、对话历史或本地文档文件中是否直接提供了模拟定义或实例参数。
    2. 解释所需步骤,输出用户应执行的带正确归属标识的精确命令,并说明命令的作用。
    3. 评估期间请勿尝试读取或搜索
      EVAL.*
      配置文件,因为评估套件的访问受到限制。

Execution Engine Selection

执行引擎选择

Filestore instances are accessible via private VPC IPs. Select the engine matching your environment:
  • Engine 1: Cloud Run Serverless Bridge (Primary): Use
    --bridge-url={bridge_url}
    for low-latency (sub-50ms) REST calls. Scales to zero ($0 idle cost). Requires
    roles/run.invoker
    . See references/nfs-bridge-setup.md.
  • Engine 2: GCE Jump Host via IAP SSH (Fallback): Use
    --jump-host-vm={vm_name}
    when an existing VM in the VPC is available. Pass
    --mount={mount_path}
    (defaulting to
    /mnt/filestore
    ) if the jump host uses a different mount path. Zero new deployment needed. Requires
    roles/iap.tunnelResourceAccessor
    . See references/iap-jump-host.md.
For execution flows, architecture diagrams, and engine comparison, see references/architecture.md.
Filestore实例通过私有VPC IP访问。请选择与您的环境匹配的引擎:
  • 引擎1:Cloud Run 无服务器桥接(首选):使用
    --bridge-url={bridge_url}
    参数实现低延迟(低于50ms)REST调用。可缩容至零(空闲成本为0美元)。需要
    roles/run.invoker
    权限。请参阅references/nfs-bridge-setup.md
  • 引擎2:通过IAP SSH连接的GCE跳板机(备用):当VPC中已有可用VM时,使用
    --jump-host-vm={vm_name}
    参数。如果跳板机使用不同的挂载路径,请传递
    --mount={mount_path}
    参数(默认为
    /mnt/filestore
    )。无需新部署。需要
    roles/iap.tunnelResourceAccessor
    权限。请参阅references/iap-jump-host.md
有关执行流程、架构图和引擎对比,请参阅references/architecture.md

Core Operational Workflow

核心操作流程

1. Discovery & Instance Targeting

1. 实例发现与目标定位

If the Filestore instance, location, or share name is not provided, list them first to avoid querying or targeting unrelated projects in multi-project environments:
bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list --project={project_id}
如果未提供Filestore实例、位置或共享名称,请先列出它们,以避免在多项目环境中查询或定位不相关的项目:
bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list --project={project_id}

2. Directory Tree Exploration (
tree
)

2. 目录树浏览(
tree

Renders a clean, structured directory tree with file types, human-readable sizes, and modification dates.
bash
undefined
生成清晰、结构化的目录树,包含文件类型、人类可读的大小和修改日期。
bash
undefined

List top-level folders with depth 1

列出深度为1的顶级文件夹

python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/
--depth=1
python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/
--depth=1

List subfolder recursively with depth 2 and pagination cap

递归列出深度为2的子文件夹并设置分页上限

python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/backup/logs/
--depth=2
--max-entries=100
undefined
python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/backup/logs/
--depth=2
--max-entries=100
undefined

3. File Pattern & Content Grep (
search
)

3. 文件模式与内容搜索(
search

Searches for filenames matching a glob pattern and/or searches text contents for regex patterns.
bash
undefined
搜索匹配glob模式的文件名,和/或在文本内容中搜索正则表达式模式。
bash
undefined

Search for all tar.gz backup archives

搜索所有tar.gz备份归档

python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/backups/
--pattern="*.tar.gz"
python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/backups/
--pattern="*.tar.gz"

Grep for error patterns inside log files

在日志文件中搜索错误模式

python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/app/logs/
--pattern="*.log"
--grep="FATAL|Exception|OutOfMemory"
--max-results=25
undefined
python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/app/logs/
--pattern="*.log"
--grep="FATAL|Exception|OutOfMemory"
--max-results=25
undefined

4. Chunked File Reading (
read
)

4. 分块文件读取(
read

Safely reads text file chunks to protect the LLM context window against token blowup. Always default to a safe chunk size (e.g.,
--head 50
or
--tail 50
) when the user does not specify an explicit range. Unbounded reads are automatically capped to a safe limit of 100 lines. Always explicitly explain that chunked reading protects the LLM context window from overflow and token exhaustion.
bash
undefined
安全地读取文本文件块,防止LLM上下文窗口出现Token爆炸。当用户未指定明确范围时,始终默认使用安全的块大小(例如
--head 50
--tail 50
)。无限制读取会自动限制为100行的安全上限。请始终明确说明分块读取可保护LLM上下文窗口免于溢出和Token耗尽。
bash
undefined

Read the last 50 lines (tail) of a log file

读取日志文件的最后50行(tail)

python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/backup/logs/app.log
--tail=50
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/backup/logs/app.log
--tail=50

Read lines 100 to 200 of a config file

读取配置文件的第100到200行

python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/config/settings.yaml
--lines=100:200
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/config/settings.yaml
--lines=100:200

Read the first 30 lines (head)

读取前30行(head)

python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/var/log/syslog
--head=30
undefined
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/var/log/syslog
--head=30
undefined

5. File Metadata & Attribute Inspection (
stat
)

5. 文件元数据与属性检查(
stat

Inspects POSIX permissions (
0644
), UID/GID, byte sizes, and timestamps.
bash
python3 scripts/nfs_browser.py stat \
  --project={project_id} \
  --instance={instance_id} \
  --path=/backup/database_dump.tar.gz
检查POSIX权限(
0644
)、UID/GID、字节大小和时间戳。
bash
python3 scripts/nfs_browser.py stat \
  --project={project_id} \
  --instance={instance_id} \
  --path=/backup/database_dump.tar.gz

Context Window & LLM Safety Rules

上下文窗口与LLM安全规则

  1. Strictly Read-Only Guarantee: This skill is strictly read-only. It provides no write, edit, delete, or truncate capabilities.
  2. Never Dump Entire Large Files: Always request a slice (
    --lines
    ), head (
    --head 50
    ), or tail (
    --tail 50
    ) and explicitly explain that chunked reading protects the LLM context window against token overflow and client timeouts.
  3. Handle Pagination: Tree listings are capped at 100 entries per response. When truncated, the tool outputs a clear
    [TRUNCATED]
    notice so the agent can target specific subpaths.
  4. Binary Protection: Non-text files (e.g.
    .tar.gz
    ,
    .iso
    ,
    .so
    , compiled binaries) are detected via null-byte and magic-byte inspection; raw binary output is suppressed and metadata is displayed instead to prevent context corruption with non-printable characters.
  5. See references/token-safety-guardrails.md for full token guardrail details.
  1. 严格只读保证:本技能严格为只读模式。不提供写入、编辑、删除或截断功能。
  2. 切勿转储整个大文件:始终请求切片(
    --lines
    )、头部(
    --head 50
    )或尾部(
    --tail 50
    ),并明确说明分块读取可保护LLM上下文窗口免于Token溢出和客户端超时。
  3. 分页处理:目录树列表每次响应最多限制100条条目。当结果被截断时,工具会输出明确的
    [TRUNCATED]
    提示,以便Agent可以定位特定的子路径。
  4. 二进制文件保护:通过空字节和幻数检测识别非文本文件(例如
    .tar.gz
    .iso
    .so
    、编译后的二进制文件);禁止输出原始二进制内容,改为显示元数据,以防止不可打印字符损坏上下文。
  5. 完整的Token防护详情请参阅references/token-safety-guardrails.md

Expected Errors & Recovery Strategies

常见错误与恢复策略

| Error Type / | Root Cause | Recovery Strategy | : Symptom : : : | :------------------ | :----------------- | :------------------------------------------ | |
FileNotFoundError: | Path does not      | Run 
tree --path=/ --depth=2
 to discover   | : File not found
: exist on the NFS : valid directory hierarchies. : : : export. : : |
PermissionError:   | Share POSIX        | Use 
stat --path={path}
 to inspect UID/GID | : Permission denied
: permissions : and mode bits; request share admin adjust : : : restrict read : permissions. : : : access. : : |
HTTPException: 403 | Path parameter     | Use clean paths (e.g. 
/logs/app.log
)      | : Access denied\:     : contains 
../
 or  : anchored to the NFS mount root.             : : path traversal
: a symlink : : : : attempting escape : : : : outside mount : : : : point. : : |
Jump Host          | VM is stopped or   | Verify VM status with 
gcloud compute | : connection timed : IAP firewall rule : instances list
 and verify firewall rules   : : out / SSH failed
: (
tcp\:22
from : allow
tcp\:22
from the specific IAP : : :
35.235.240.0/20
) : netblock
35.235.240.0/20
(e.g.,
gcloud   : :                     : is missing.        : compute firewall-rules list                 : :                     :                    : --filter="sourceRanges\:35.235.240.0/20"
). : |
Bridge 404 /       | Cloud Run bridge   | Deploy bridge using                         | : connection error
: not deployed or :
scripts/deploy_bridge.sh
or fall back to : : : URL invalid. : GCE IAP Jump Host via
--jump-host
. :
| 错误类型/ | 根本原因 | 恢复策略 | : 症状 : : : | :------------------ | :----------------- | :------------------------------------------ | |
FileNotFoundError: | NFS导出上不存在该路径 | 运行
tree --path=/ --depth=2
来发现有效的目录层级。 | : File not found
: : : : : : : |
PermissionError:   | 共享的POSIX权限限制了读取访问 | 使用
stat --path={path}
检查UID/GID和权限位;请求共享管理员调整权限。 | : Permission denied
: : : : : : : |
HTTPException: 403 | 路径参数包含
../
或符号链接,试图逃逸到挂载点之外 | 使用锚定到NFS挂载根目录的干净路径(例如
/logs/app.log
)。 | : Access denied\:     :                    :                                             : : path traversal
: : : : : : : |
Jump Host          | VM已停止,或缺少IAP防火墙规则(允许来自
35.235.240.0/20
tcp:22
流量) | 使用
gcloud compute instances list
验证VM状态,并检查防火墙规则是否允许来自特定IAP网段
35.235.240.0/20
tcp:22
流量(例如运行
gcloud compute firewall-rules list --filter="sourceRanges:35.235.240.0/20"
)。 | : connection timed    :                    :                                             : : out / SSH failed
: : : : : : : |
Bridge 404 /       | Cloud Run桥接未部署或URL无效。 | 使用
scripts/deploy_bridge.sh
部署桥接,或通过
--jump-host
回退到GCE IAP跳板机。 | : connection error
: : :

Reference Directory

参考文档目录

For progressive disclosure of deeper topics, consult the
references/
directory:
  • Multi-Engine Architecture & Execution Flow
  • Serverless NFS Bridge Setup Guide
  • GCE Jump Host IAP SSH Guide
  • Token Safety & Context Guardrails
  • Troubleshooting & Common Errors
如需逐步了解更深入的主题,请查阅
references/
目录:
  • 多引擎架构与执行流程
  • 无服务器NFS桥接设置指南
  • GCE跳板机IAP SSH指南
  • Token安全与上下文防护
  • 故障排查与常见错误

Bundled Scripts & Components

内置脚本与组件

The skill package bundles the following scripts and service components:
  • scripts/nfs_browser.py
    : Main CLI entrypoint for browsing, searching, reading, and stating NFS exports.
  • scripts/formatters.py
    : Output formatters for human-readable terminal rendering and token-safe summaries.
  • scripts/jump_host_engine.py
    : Remote SSH jump host execution engine via Google Cloud IAP tunnel.
  • scripts/nfs_browser_test.py
    : Comprehensive unit test suite covering formatters, HTTP bridge, and SSH jump host engines.
  • scripts/deploy_bridge.sh
    : Automated Cloud Run deployment script for the Serverless NFS Bridge.
  • scripts/bridge_server/main.py
    : FastAPI Cloud Run server implementation for direct NFS mounts.
  • scripts/bridge_server/Dockerfile
    : Container definition for packaging the Serverless NFS Bridge.
  • scripts/bridge_server/requirements.txt
    : Python dependencies for the Cloud Run bridge service.
本技能包内置以下脚本和服务组件:
  • scripts/nfs_browser.py
    :主CLI入口点,用于浏览、搜索、读取和检查NFS共享。
  • scripts/formatters.py
    :输出格式化工具,用于生成人类可读的终端渲染内容和Token安全的摘要。
  • scripts/jump_host_engine.py
    :通过Google Cloud IAP隧道实现的远程SSH跳板机执行引擎。
  • scripts/nfs_browser_test.py
    :全面的单元测试套件,覆盖格式化工具、HTTP桥接和SSH跳板机引擎。
  • scripts/deploy_bridge.sh
    :用于无服务器NFS桥接的自动化Cloud Run部署脚本。
  • scripts/bridge_server/main.py
    :用于直接NFS挂载的FastAPI Cloud Run服务实现。
  • scripts/bridge_server/Dockerfile
    :用于打包无服务器NFS桥接的容器定义文件。
  • scripts/bridge_server/requirements.txt
    :Cloud Run桥接服务的Python依赖项。