OpenShell v0.1.8

OpenShell v0.1.8

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.8 sh

Upgrade notes

• Static provider credentials without placement metadata now resolve only in the Authorization header or through explicitly enabled body/WebSocket rewrite policies, so custom headers such as x-api-key, query parameters, and path slots need an explicit placement declaration. Upgrade the gateway before the supervisor, and update existing imported profiles as needed, since editing reference YAML alone does not update the gateway catalog. auth_style selects the active placement, and fields for other styles are ignored. #4886
• REST endpoints now return 403 for HTTP upgrade requests in both enforce and audit modes. Configure WebSocket traffic with protocol: websocket and explicit handshake and message rules; websocket_credential_rewrite: true now requires a WebSocket endpoint. #5336
• OCSF sandbox attribution moved: supervisor events use device.container.uid and device.container.name, gateway API Activity and Detection Finding events use resources entries with type: "sandbox", and other gateway classes use unmapped.sandbox_id and unmapped.sandbox_name. SIEM parsers that read top-level container.uid or container.name must update their mappings. #5048
• Sandboxes now fail to launch when a filesystem policy path goes through a symlink inside a writable workspace, including in best-effort mode. Use the symlink's target path in the policy instead. #5278
• Transparent TCP connections now evaluate IPv4-mapped IPv6 destinations as IPv4. Change endpoint rules such as host: "::ffff:203.0.113.7" to host: "203.0.113.7". #5101
• The openshell Python SDK is now published from ai-openshell/sdk-python starting with 0.1.8, and core GitHub Releases no longer attach its wheel or checksum. Keep installing it with pip install openshell from PyPI. #5350
• The Go SDK module github.com/NVIDIA/OpenShell/sdk/go is deprecated. Switch to github.com/ai-openshell/sdk-go, now developed in ai-openshell/sdk-go. #5245
• The Go SDK now shares oidc_token.json with the CLI, and v1.RefreshableToken no longer returns an expired cached token after a failed refresh for any token source. Run openshell gateway login once to replace token files written by earlier Go SDK releases. #4830
• Gateway interceptors can now intercept sandbox start, stop, suspend, and resume RPCs. After you upgrade and restart the gateway, dynamic interceptor registrations that advertise these RPCs can start intercepting them, while strict allowlist or exact registrations need matching operator configuration. #5173

Bug fixes

• Deleted sandboxes no longer leave memory behind on the gateway, so repeated create/delete cycles no longer grow gateway memory until it is OOM-killed. #5428
• The gateway no longer pre-allocates about 3.4 MiB of stream buffers for every sandbox. #5408
• When PostgreSQL is unreachable, gateway requests now fail within about 5 seconds with a retryable UNAVAILABLE error, and a gateway started during the outage becomes ready once the database returns instead of crash-looping. #5244
• Deleting a sandbox on Kubernetes no longer waits out the pod's 30-second termination grace period. #5279
• A sandbox no longer exits when its control listener hits a transient accept error such as EMFILE, and DNS over TCP keeps working after a client resets a connection before it is accepted. #5211
• On Kubernetes, a late status update during a stop no longer flips a stopped sandbox back to Provisioning and blocks the next stop. #5196
• AWS SigV4 signing diagnostics no longer appear in supervisor TRACE logs, where they could expose the temporary session token. #4558
• Provider attachment now checks credential inspection against the sandbox's latest saved policy instead of its creation policy. #5310
• SSH relays and service forwards now have separate per-sandbox connection limits, set with max_ssh_connections_per_sandbox and max_service_connections_per_sandbox in the gateway config (default 20). #5063
• The CLI now renews expired OIDC client credentials tokens by repeating the grant instead of failing with no refresh token available. Renewal needs OPENSHELL_OIDC_CLIENT_SECRET to be set. #4389
• openshell sandbox download now works on busybox-based images. #5420
• openshell policy update --add-endpoint now accepts the allow-encoded-slash option. #4968
• openshell status --gateway <name> now exits non-zero when the named gateway is not registered. #5379
• Podman sandbox deletion and create rollback now remove only volumes labeled as owned by that sandbox, and keep any others with a warning. #4714
• Binary identity resolution now bounds its procfs work per mediated connection, so long command lines and digest-cache churn no longer slow connects without limit. Hashing a large, uncached executable can still delay a connect. #5213
• Isolation descriptors with an invalid workload identity, such as UID or GID 0 or an empty source or resource digest, now fail to deserialize instead of being accepted. #5192
• Sandbox signal masks are now built from zero-initialized memory, which fixes reads of uninitialized bytes on 64-bit musl. #5194
• openshell-gateway config preflight now warns when allow_unauthenticated_users is enabled. #5105
• The Docker driver now warns at startup when Docker Engine is older than the documented 28.0 minimum. #5369
• The TUI policy viewer now shows each allowed or denied MCP tool name or pattern instead of tools/call *. #5345
• The TypeScript SDK now revokes SSH forward tokens when you call forward().close(). #5079
• The Go SDK now falls back to the system active_gateway when the user one is missing or invalid, matching the CLI. #4917
• The Go SDK now sets up Listen tunnels in parallel, so one slow setup no longer blocks other clients. #4995
• The Python SDK adds an opt-in delete_timeout_seconds on Sandbox and a timeout_seconds argument on delete, for Kubernetes pods that take longer than 30 seconds to terminate. #4697
• The installer no longer prints awk escape warnings while looking up RPM assets. #4845
• VM runtime tarballs now record the libkrunfw commit, kernel version, and kernel config hash, including on macOS. #4650

Features

• The metrics listener can now serve /metrics over TLS, with optional mutual TLS, configured through gateway TOML, CLI flags, environment variables, or Helm Secrets. Plaintext remains the default. #3877
• In multi-replica gateways, shared-supervisor pool sandbox sessions now stay on the gateway replica that serves their supervisor, including across gateway and supervisor failures. #5052
• Supervisors now advertise the application routes they have installed, so gateways can discover them for both dedicated and shared supervisors. #4940
• OCSF HTTP and API audit events now correlate with sampled OpenTelemetry traces, and OTLP log records carry trace and span context. More refusal findings are now classified as Denied, which can increase denial-query counts. #4789
• The CLI now forwards TRACEPARENT and TRACESTATE from its environment to the gateway, so CI pipeline traces parent gateway spans. #2931
• The Kubernetes driver adds a supervisor_runtime_class_name setting for dedicated supervisor pods. #5349
• The Helm chart now supports priorityClassName and topologySpreadConstraints for the gateway pod. #2832

Other

• Documentation now uses "OpenShell" in place of "NVIDIA OpenShell", and the README announces the project's planned move to the CNCF and the ai-openshell organization. #5441
• Documentation clarifies security boundaries, supervisor recovery, credential rotation, and native inference guidance. #5331
• Observability docs now show where each OTLP signal goes, including relayed agent traces, and document log retention for each driver. #5153, #4901
• Stable releases now publish the public protobuf schemas to buf.build/openshell/core. #5208
• Stable releases now publish Python wheels directly to PyPI through a dispatchable publisher job. #5157, #5222
• Security reports can now be filed through a structured private vulnerability reporting form. #5203
• Moved credential storage and built-in refresh execution into an embedded credential issuer, with no change to commands, configuration, or APIs. #5266, #5283
• Updated h2 in the E2E harness for RUSTSEC-2026-0258 and temporarily acknowledged a SQLite advisory until a compatible SQLx release is available. #5392
• Removed the unused regorus yaml feature. #4882
• Removed unused compute driver registration hooks and an unused Landlock helper. #5382, #5221
• Documented every unsafe block in the sandbox crate and enforced SAFETY comments with clippy. #5232
• Added area and topic reviewer rosters with automatic reviewer routing that does not require write access. #4863, #5257
• Made the Codex Security check advisory and kept SDK error messages in compatibility reviews. #5246, #5292
• Development and CI Kubernetes environments now enable OTLP export only when a collector is requested. #5348
• Added the openshell-conformance test program and ran tmachine conformance rows with the prebuilt binary. #5249, #5332
• Migrated the features and drivers E2E suites to testkit. #5137
• Ported the credential gating E2E tests to conformance and split them into independent parallel tests. #5318, #5264
• Added a conformance test for prompt deletion when a workload is slow to handle TERM, ignored until the supervisor fix lands. #5291, #5338
• Added testkit cleanup hooks that run after pass, failure, or panic, with typed hook keys. #5219, #5240
• Testkit errors now name unsupported gateway auth modes. #5248
• Added a test that keeps relays queued during session setup until SessionAccepted. #4689
• Restored package-installed Podman qualification in tmachine. #4289
• Prepared tmachine runner environments for the E2E migration, ran Ansible with a dumb terminal, and noted that tmachine runs on macOS. #5277, #5307, #5304
• Sped up E2E CI by starting Linux and tmachine jobs without waiting on macOS or package builds and by building tmachine suite bundles once per run. #5270, #5432
• Pinned the k3s installer used in tests to a release. #5223