google-cloud-filestore-nfs-browser
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseGoogle Cloud Filestore NFS File Browser
Google Cloud Filestore NFS 文件浏览器
Enables autonomous agents and cloud engineers to inspect, search, and read files
located on Google Cloud Filestore (NFS) instances without needing local NFS
client packages (), root privileges, or manual VPC network mounting.
nfs-common支持自主Agent和云工程师无需本地NFS客户端软件包()、root权限或手动挂载VPC网络,即可检查、搜索和读取位于Google Cloud Filestore(NFS)实例上的文件。
nfs-commonQuick Start
快速开始
-
Ensureis installed and authenticated. See gcloud installation guide if needed.
gcloud -
Enable essential APIs:bash
gcloud services enable file.googleapis.com compute.googleapis.com run.googleapis.com --quiet -
Discover instances and choose an execution engine (see Execution Engine Selection below).
-
Run inspection actions using the self-contained runnerincluded within this skill package.
scripts/nfs_browser.py
-
确保已安装并认证。如需安装,请参阅gcloud安装指南。
gcloud -
启用必要的API:bash
gcloud services enable file.googleapis.com compute.googleapis.com run.googleapis.com --quiet -
发现实例并选择执行引擎(请参阅下文的执行引擎选择)。
-
使用本技能包中内置的独立运行脚本执行检查操作。
scripts/nfs_browser.py
Attribution
归属标注
Tag every Cloud Filestore command or API request provided or executed. Prefix
commands with the metrics environment targeting this skill:
gcloudbash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list ...On direct HTTP calls to the REST API, append the :
User-AgentUser-Agent: gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)请为所有提供或执行的Cloud Filestore命令及API请求添加标识。在命令前添加指向本技能的指标环境变量前缀:
gcloudbash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list ...对于直接调用REST API的HTTP请求,请添加请求头:
User-AgentUser-Agent: gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)Conceptual & Informational Queries (CRITICAL)
概念与信息类查询(关键规则)
For purely conceptual, educational, or architectural questions (e.g., "How do I
inspect files on Filestore?", "How to deploy the Serverless Cloud Run NFS
Bridge?", "Explain Cloud Run NFS volume mounts"):
- Rule: Answer immediately using your pre-trained knowledge and the documentation below. Answering directly minimizes tool invocation latency and token consumption when the user only seeks architecture or workflow guidance.
- Constraint: Do not execute external tool calls or API requests for basic knowledge questions.
- Bridge Deployment Explanations: Always highlight that Cloud Run scales
to zero with $0 idle compute cost, detail the command with
gcloud run deployand--add-volume, and specify the required IAM permissions (--vpc-egress=all-trafficfor callers androles/run.invokerfor deployers).roles/run.admin
对于纯概念性、教育性或架构类问题(例如“如何检查Filestore上的文件?”、“如何部署无服务器Cloud Run NFS桥接?”、“解释Cloud Run NFS卷挂载”):
- 规则:请使用您的预训练知识和下方文档立即作答。 当用户仅需要架构或工作流指导时,直接回答可最大程度减少工具调用延迟和Token消耗。
- 约束:对于基础知识类问题,请勿执行外部工具调用或API请求。
- 桥接部署说明:请始终强调Cloud Run可缩容至零,空闲计算成本为0美元,详细说明带和
--add-volume参数的--vpc-egress=all-traffic命令,并指明所需的IAM权限(调用者需gcloud run deploy,部署者需roles/run.invoker)。roles/run.admin
Handling "No-Command" Constraints (CRITICAL)
「无命令」约束处理(关键规则)
If the user prompt contains constraints like "Do not execute commands", "without
executing", or "read-only":
- Rule: Strictly avoid executing any shell or commands (including read-only discovery or list commands) to respect user-specified execution boundaries and prevent unauthorized environment inspection.
gcloud - Discovery:
- Check if mock definitions or instance parameters are provided directly in the user's prompt, conversation history, or local documentation files.
- Explain the required steps, output the exact commands the user should run with proper attribution, and explain what the commands do.
- Do not attempt to read or search configuration files during evaluations as access to eval suites is restricted.
EVAL.*
如果用户提示包含“请勿执行命令”、“不执行”或“只读”等约束:
- 规则:严格避免执行任何Shell或命令(包括只读的发现或列表命令),以尊重用户指定的执行边界,防止未经授权的环境检查。
gcloud - 发现流程:
- 检查用户提示、对话历史或本地文档文件中是否直接提供了模拟定义或实例参数。
- 解释所需步骤,输出用户应执行的带正确归属标识的精确命令,并说明命令的作用。
- 评估期间请勿尝试读取或搜索配置文件,因为评估套件的访问受到限制。
EVAL.*
Execution Engine Selection
执行引擎选择
Filestore instances are accessible via private VPC IPs. Select the engine
matching your environment:
- Engine 1: Cloud Run Serverless Bridge (Primary): Use
for low-latency (sub-50ms) REST calls. Scales to zero ($0 idle cost). Requires
--bridge-url={bridge_url}. See references/nfs-bridge-setup.md.roles/run.invoker - Engine 2: GCE Jump Host via IAP SSH (Fallback): Use
when an existing VM in the VPC is available. Pass
--jump-host-vm={vm_name}(defaulting to--mount={mount_path}) if the jump host uses a different mount path. Zero new deployment needed. Requires/mnt/filestore. See references/iap-jump-host.md.roles/iap.tunnelResourceAccessor
For execution flows, architecture diagrams, and engine comparison, see
references/architecture.md.
Filestore实例通过私有VPC IP访问。请选择与您的环境匹配的引擎:
- 引擎1:Cloud Run 无服务器桥接(首选):使用参数实现低延迟(低于50ms)REST调用。可缩容至零(空闲成本为0美元)。需要
--bridge-url={bridge_url}权限。请参阅references/nfs-bridge-setup.md。roles/run.invoker - 引擎2:通过IAP SSH连接的GCE跳板机(备用):当VPC中已有可用VM时,使用参数。如果跳板机使用不同的挂载路径,请传递
--jump-host-vm={vm_name}参数(默认为--mount={mount_path})。无需新部署。需要/mnt/filestore权限。请参阅references/iap-jump-host.md。roles/iap.tunnelResourceAccessor
有关执行流程、架构图和引擎对比,请参阅references/architecture.md。
Core Operational Workflow
核心操作流程
1. Discovery & Instance Targeting
1. 实例发现与目标定位
If the Filestore instance, location, or share name is not provided, list them
first to avoid querying or targeting unrelated projects in multi-project
environments:
bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list --project={project_id}如果未提供Filestore实例、位置或共享名称,请先列出它们,以避免在多项目环境中查询或定位不相关的项目:
bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-nfs-browser)" \
gcloud filestore instances list --project={project_id}2. Directory Tree Exploration (tree
)
tree2. 目录树浏览(tree
)
treeRenders a clean, structured directory tree with file types, human-readable
sizes, and modification dates.
bash
undefined生成清晰、结构化的目录树,包含文件类型、人类可读的大小和修改日期。
bash
undefinedList top-level folders with depth 1
列出深度为1的顶级文件夹
python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/
--depth=1
--project={project_id}
--instance={instance_id}
--path=/
--depth=1
python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/
--depth=1
--project={project_id}
--instance={instance_id}
--path=/
--depth=1
List subfolder recursively with depth 2 and pagination cap
递归列出深度为2的子文件夹并设置分页上限
python3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/backup/logs/
--depth=2
--max-entries=100
--project={project_id}
--instance={instance_id}
--path=/backup/logs/
--depth=2
--max-entries=100
undefinedpython3 scripts/nfs_browser.py tree
--project={project_id}
--instance={instance_id}
--path=/backup/logs/
--depth=2
--max-entries=100
--project={project_id}
--instance={instance_id}
--path=/backup/logs/
--depth=2
--max-entries=100
undefined3. File Pattern & Content Grep (search
)
search3. 文件模式与内容搜索(search
)
searchSearches for filenames matching a glob pattern and/or searches text contents for
regex patterns.
bash
undefined搜索匹配glob模式的文件名,和/或在文本内容中搜索正则表达式模式。
bash
undefinedSearch for all tar.gz backup archives
搜索所有tar.gz备份归档
python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/backups/
--pattern="*.tar.gz"
--project={project_id}
--instance={instance_id}
--path=/backups/
--pattern="*.tar.gz"
python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/backups/
--pattern="*.tar.gz"
--project={project_id}
--instance={instance_id}
--path=/backups/
--pattern="*.tar.gz"
Grep for error patterns inside log files
在日志文件中搜索错误模式
python3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/app/logs/
--pattern="*.log"
--grep="FATAL|Exception|OutOfMemory"
--max-results=25
--project={project_id}
--instance={instance_id}
--path=/app/logs/
--pattern="*.log"
--grep="FATAL|Exception|OutOfMemory"
--max-results=25
undefinedpython3 scripts/nfs_browser.py search
--project={project_id}
--instance={instance_id}
--path=/app/logs/
--pattern="*.log"
--grep="FATAL|Exception|OutOfMemory"
--max-results=25
--project={project_id}
--instance={instance_id}
--path=/app/logs/
--pattern="*.log"
--grep="FATAL|Exception|OutOfMemory"
--max-results=25
undefined4. Chunked File Reading (read
)
read4. 分块文件读取(read
)
readSafely reads text file chunks to protect the LLM context window against token
blowup. Always default to a safe chunk size (e.g., or )
when the user does not specify an explicit range. Unbounded reads are
automatically capped to a safe limit of 100 lines. Always explicitly explain
that chunked reading protects the LLM context window from overflow and token
exhaustion.
--head 50--tail 50bash
undefined安全地读取文本文件块,防止LLM上下文窗口出现Token爆炸。当用户未指定明确范围时,始终默认使用安全的块大小(例如或)。无限制读取会自动限制为100行的安全上限。请始终明确说明分块读取可保护LLM上下文窗口免于溢出和Token耗尽。
--head 50--tail 50bash
undefinedRead the last 50 lines (tail) of a log file
读取日志文件的最后50行(tail)
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/backup/logs/app.log
--tail=50
--project={project_id}
--instance={instance_id}
--path=/backup/logs/app.log
--tail=50
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/backup/logs/app.log
--tail=50
--project={project_id}
--instance={instance_id}
--path=/backup/logs/app.log
--tail=50
Read lines 100 to 200 of a config file
读取配置文件的第100到200行
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/config/settings.yaml
--lines=100:200
--project={project_id}
--instance={instance_id}
--path=/config/settings.yaml
--lines=100:200
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/config/settings.yaml
--lines=100:200
--project={project_id}
--instance={instance_id}
--path=/config/settings.yaml
--lines=100:200
Read the first 30 lines (head)
读取前30行(head)
python3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/var/log/syslog
--head=30
--project={project_id}
--instance={instance_id}
--path=/var/log/syslog
--head=30
undefinedpython3 scripts/nfs_browser.py read
--project={project_id}
--instance={instance_id}
--path=/var/log/syslog
--head=30
--project={project_id}
--instance={instance_id}
--path=/var/log/syslog
--head=30
undefined5. File Metadata & Attribute Inspection (stat
)
stat5. 文件元数据与属性检查(stat
)
statInspects POSIX permissions (), UID/GID, byte sizes, and timestamps.
0644bash
python3 scripts/nfs_browser.py stat \
--project={project_id} \
--instance={instance_id} \
--path=/backup/database_dump.tar.gz检查POSIX权限()、UID/GID、字节大小和时间戳。
0644bash
python3 scripts/nfs_browser.py stat \
--project={project_id} \
--instance={instance_id} \
--path=/backup/database_dump.tar.gzContext Window & LLM Safety Rules
上下文窗口与LLM安全规则
- Strictly Read-Only Guarantee: This skill is strictly read-only. It provides no write, edit, delete, or truncate capabilities.
- Never Dump Entire Large Files: Always request a slice (), head (
--lines), or tail (--head 50) and explicitly explain that chunked reading protects the LLM context window against token overflow and client timeouts.--tail 50 - Handle Pagination: Tree listings are capped at 100 entries per response.
When truncated, the tool outputs a clear notice so the agent can target specific subpaths.
[TRUNCATED] - Binary Protection: Non-text files (e.g. ,
.tar.gz,.iso, compiled binaries) are detected via null-byte and magic-byte inspection; raw binary output is suppressed and metadata is displayed instead to prevent context corruption with non-printable characters..so - See references/token-safety-guardrails.md for full token guardrail details.
- 严格只读保证:本技能严格为只读模式。不提供写入、编辑、删除或截断功能。
- 切勿转储整个大文件:始终请求切片()、头部(
--lines)或尾部(--head 50),并明确说明分块读取可保护LLM上下文窗口免于Token溢出和客户端超时。--tail 50 - 分页处理:目录树列表每次响应最多限制100条条目。当结果被截断时,工具会输出明确的提示,以便Agent可以定位特定的子路径。
[TRUNCATED] - 二进制文件保护:通过空字节和幻数检测识别非文本文件(例如、
.tar.gz、.iso、编译后的二进制文件);禁止输出原始二进制内容,改为显示元数据,以防止不可打印字符损坏上下文。.so - 完整的Token防护详情请参阅references/token-safety-guardrails.md。
Expected Errors & Recovery Strategies
常见错误与恢复策略
| Error Type / | Root Cause | Recovery Strategy |
: Symptom : : :
| :------------------ | :----------------- | :------------------------------------------ |
| tree --path=/ --depth=2 : exist on the NFS : valid directory hierarchies. :
: : export. : :
| stat --path={path} : permissions : and mode bits; request share admin adjust :
: : restrict read : permissions. :
: : access. : :
| /logs/app.log../ : a symlink : :
: : attempting escape : :
: : outside mount : :
: : point. : :
| gcloud compute |
: connection timed : IAP firewall rule : instances list : ( from : allow from the specific IAP :
: : ) : netblock (e.g., ). :
| : not deployed or : or fall back to :
: : URL invalid. : GCE IAP Jump Host via . :
FileNotFoundError: | Path does not | Run to discover | : File not foundPermissionError: | Share POSIX | Use to inspect UID/GID | : Permission deniedHTTPException: 403 | Path parameter | Use clean paths (e.g. ) | : Access denied\: : contains or : anchored to the NFS mount root. : : path traversalJump Host | VM is stopped or | Verify VM status with and verify firewall rules : : out / SSH failedtcp\:22tcp\:2235.235.240.0/2035.235.240.0/20gcloud : : : is missing. : compute firewall-rules list : : : : --filter="sourceRanges\:35.235.240.0/20"Bridge 404 / | Cloud Run bridge | Deploy bridge using | : connection errorscripts/deploy_bridge.sh--jump-host| 错误类型/ | 根本原因 | 恢复策略 |
: 症状 : : :
| :------------------ | :----------------- | :------------------------------------------ |
| tree --path=/ --depth=2 : : :
: : : :
| stat --path={path} : : :
: : : :
| ..//logs/app.log : : :
: : : :
| 35.235.240.0/20tcp:22gcloud compute instances list35.235.240.0/20tcp:22gcloud compute firewall-rules list --filter="sourceRanges:35.235.240.0/20" : : :
: : : :
| scripts/deploy_bridge.sh--jump-host : : :
FileNotFoundError: | NFS导出上不存在该路径 | 运行来发现有效的目录层级。 | : File not foundPermissionError: | 共享的POSIX权限限制了读取访问 | 使用检查UID/GID和权限位;请求共享管理员调整权限。 | : Permission deniedHTTPException: 403 | 路径参数包含或符号链接,试图逃逸到挂载点之外 | 使用锚定到NFS挂载根目录的干净路径(例如)。 | : Access denied\: : : : : path traversalJump Host | VM已停止,或缺少IAP防火墙规则(允许来自的流量) | 使用验证VM状态,并检查防火墙规则是否允许来自特定IAP网段的流量(例如运行)。 | : connection timed : : : : out / SSH failedBridge 404 / | Cloud Run桥接未部署或URL无效。 | 使用部署桥接,或通过回退到GCE IAP跳板机。 | : connection errorReference Directory
参考文档目录
For progressive disclosure of deeper topics, consult the
directory:
references/- Multi-Engine Architecture & Execution Flow
- Serverless NFS Bridge Setup Guide
- GCE Jump Host IAP SSH Guide
- Token Safety & Context Guardrails
- Troubleshooting & Common Errors
如需逐步了解更深入的主题,请查阅目录:
references/- 多引擎架构与执行流程
- 无服务器NFS桥接设置指南
- GCE跳板机IAP SSH指南
- Token安全与上下文防护
- 故障排查与常见错误
Bundled Scripts & Components
内置脚本与组件
The skill package bundles the following scripts and service components:
- : Main CLI entrypoint for browsing, searching, reading, and stating NFS exports.
scripts/nfs_browser.py - : Output formatters for human-readable terminal rendering and token-safe summaries.
scripts/formatters.py - : Remote SSH jump host execution engine via Google Cloud IAP tunnel.
scripts/jump_host_engine.py - : Comprehensive unit test suite covering formatters, HTTP bridge, and SSH jump host engines.
scripts/nfs_browser_test.py - : Automated Cloud Run deployment script for the Serverless NFS Bridge.
scripts/deploy_bridge.sh - : FastAPI Cloud Run server implementation for direct NFS mounts.
scripts/bridge_server/main.py - : Container definition for packaging the Serverless NFS Bridge.
scripts/bridge_server/Dockerfile - : Python dependencies for the Cloud Run bridge service.
scripts/bridge_server/requirements.txt
本技能包内置以下脚本和服务组件:
- :主CLI入口点,用于浏览、搜索、读取和检查NFS共享。
scripts/nfs_browser.py - :输出格式化工具,用于生成人类可读的终端渲染内容和Token安全的摘要。
scripts/formatters.py - :通过Google Cloud IAP隧道实现的远程SSH跳板机执行引擎。
scripts/jump_host_engine.py - :全面的单元测试套件,覆盖格式化工具、HTTP桥接和SSH跳板机引擎。
scripts/nfs_browser_test.py - :用于无服务器NFS桥接的自动化Cloud Run部署脚本。
scripts/deploy_bridge.sh - :用于直接NFS挂载的FastAPI Cloud Run服务实现。
scripts/bridge_server/main.py - :用于打包无服务器NFS桥接的容器定义文件。
scripts/bridge_server/Dockerfile - :Cloud Run桥接服务的Python依赖项。
scripts/bridge_server/requirements.txt