Skip to content

OpenShell v0.1.6

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 17:56
· 4 commits to main since this release
v0.1.6
ac7f615
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenShell v0.1.6

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.6 sh

Upgrade notes

  • Gateways now refuse to start unless OIDC, mTLS user or operator authentication, or gateway JWTs are configured. For trusted local development only, set allow_unauthenticated_users = true under [openshell.gateway.auth]. #4821
  • New sandboxes on Kubernetes, Docker, Podman, and VM now open the control connection from the sandbox to its supervisor, while running sandboxes keep their existing connection direction. Upgrade the supervisor and sandbox runtime binaries together, because older binaries reject the new sandboxes. #4656
  • You can now suspend and resume sandboxes with openshell sandbox suspend and openshell sandbox resume or through the SDKs, on compute drivers that support it; other drivers return an unimplemented error. External isolation backends need to know that ResumeBoundaryRequest field 3 is renamed from allow_cold_start_fallback to restart_if_restore_fails. #4765

Bug fixes

  • The Python SDK now ships the credential driver and extension protocol bindings, so you can write credential drivers in Python. #4760
  • The Go SDK now accepts gateway names derived from FQDNs and IPv4 addresses, as the CLI creates them, and still rejects names that aren't safe as Windows filenames. #4767
  • A busy sandbox no longer stalls lifecycle operations on unrelated sandboxes while the gateway checks provisioning deadlines. #4549
  • VM sandboxes boot digest-pinned images straight from the local cache without contacting the registry, so they start faster and still boot when the registry is unreachable. #4582
  • VM sandboxes built from images with a missing or empty /etc/hosts now resolve localhost. #4182
  • The Podman driver now waits up to 60 seconds instead of 30 for API calls, which reduces timeouts during sandbox creation. #4820
  • install.sh now finds the gateway config directory under XDG_CONFIG_HOME the same way the CLI does, so local gateway setup no longer times out when that variable is set. #4063
  • The snap now provides the openshell-prover command like other packages, replacing openshell.prover. #4835
  • Updated webpki to stop trusting the compromised emSign certificate authorities (CVE-2026-111943). #4794
  • Updated russh to 0.64.1 to fix GHSA-4wc5-f2rc-q74m (CVE-2026-111061). #4742
  • Updated Tokio and crypto-bigint to fix RUSTSEC-2026-0386 and RUSTSEC-2026-0387. #4924
  • Updated ctutils to fix the RUSTSEC-2026-0385 timing advisory. #4867
  • The multi-agent shared-notepad example now launches on the current CLI. #4807

Features

  • Kubernetes gateways can run an experimental shared supervisor that hosts many sandboxes in one process. Enable it with supervisor_topology = "gateway" under [openshell.drivers.kubernetes] (gateway TLS is required), and on OpenShift use supervisor.podSecurityContext so restricted-v2 can assign the IDs. #4695, #4701, #4702, #4785
  • Experimental shared supervisors always run as a pool that can take over a failed supervisor's sandboxes; set supervisor.replicas to change capacity, and note that one replica has no spare for immediate failover. During takeover, workloads can briefly freeze, existing proxied connections and interactive sessions must reconnect, and workloads terminate if supervision isn't restored within the recovery deadline. #4864
  • The gateway now writes OCSF audit events for authorization denials, accepted credentials, SSH session tokens, and sandbox token checks, and raises a High-severity finding when a sandbox credential looks misused. Callers see the same errors as before. #4728, #4761, #4762
  • Operators can require a middleware service to provide specific bindings, such as request inspection, by setting binding_policy to allowlist or exact. Upgrade supervisors before you rely on it, because older supervisors don't enforce it. #4678
  • Prerelease builds now publish to the snap's latest/beta channel, and OPENSHELL_VERSION=pre install.sh installs the snap from there. #4870
  • The Helm chart adds server.extraEnv for passing extra environment variables, including Secret references, to the gateway container. #4876
  • The Helm chart adds pkiInitJob.podLabels and pkiInitJob.podAnnotations for the certificate hook pods. #4895
  • Stable releases now tag the Go SDK module as sdk/go/vX.Y.Z, so Go tooling and pkg.go.dev show real versions. #4262

Other

  • The Docker supervisor healthcheck now runs every 30 seconds once the sandbox is ready, rather than every 250 ms. #4802
  • The CLI now connects to gateways through the shared Rust SDK transport. #4817
  • Native Windows documentation now identifies windows as its implementation and release branch and explains the current build and runtime limitations. #4758
  • Added a guide for connecting an external compute driver to a gateway. #4826
  • Added a security policy that uses GitHub private vulnerability reporting, with a report template and advisory authoring workflows. #4832, #4872
  • sandbox create --upload help and docs now say it can't take a trailing command; use sandbox exec instead. #4502
  • Updated workload image docs: images no longer need iproute2 or nftables, and images without USER run as UID/GID 1000 on Docker and Podman. #3967
  • Fixed the OpenRouter provider smoke test so it prints a result. #3907
  • Added RFC 0018 on multi-sandbox and highly available supervisors. #4377
  • Removed the obsolete privileged SCC grant from the OpenShift e2e setup. #4823
  • Native gateway builds on macOS raise the open-file limit to avoid "Too many open files" errors. #3122
  • Added the testkit library for SDK-driven end-to-end tests. #4724
  • Moved tmachine support files under tests/tmachine. #4726
  • Consolidated gateway audit helpers and test fixtures. #4777, #4778
  • Repaired the Windows MSVC test suite. #4862
  • Fixed a flaky CLI port-forward test. #4799
  • Removed the unused openshell-server-macros crate. #4818
  • Added a release-captain skill for the weekly release cadence. #4435
  • Release and Pre-release workflows can now infer their tags from the branch. #4707
  • Stable releases reuse the release notes previewed on the promoted prerelease. #4754
  • Allowed the accepted protobuf compatibility breaks for v0.1.6 prerelease qualification. #4976
  • The compatibility review now checks executable flags that external compute drivers use. #4644
  • Switched the compatibility review to GPT-6.1 Sol. #4796
  • Kept Rust CI caches warm on main and stopped saving binary caches from branches. #4881
  • Updated the rust-cache action. #4748
  • Updated the setup-buildx action to v4.4.1. #4741
  • Added cargo-deny exceptions for zstd advisories that don't affect current usage. #4973
  • Updated setuptools and Vitest to patched releases. #4969
  • Updated Vite in the TypeScript SDK to 8.1.6. #4792
  • Updated certifi to 2026.10.19. #4764
  • Updated Mermaid lint dependencies. #4743
  • Exempted Dependabot PRs from the issue acceptance check. #4928
  • Exempted build and flaky-test fixes by write-access authors from the issue requirement. #4875
  • Extended the issue stale window to 28 days and exempted roadmap issues. #4962
  • Documented local Nix setup with the OpenShell binary cache. #4931
  • Extended the AI attribution ban to PR descriptions and issues. #4890
  • Allowed the gator agent to reach GitHub security advisory private forks. #4893
Assets 35
Loading