OpenShell Development Build

This build is automatically published on every commit to main that passes CI.

NOTE: This is a development build, not a tagged release, and may be unstable.

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=dev sh

OpenShell v0.1.3

OpenShell v0.1.3

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.3 sh

What's Changed

• feat(helm): make cluster-scoped RBAC optional by @ansjindal in #3459
• fix(supervisor): keep session retries during startup by @drew in #3765
• fix(e2e): reserve distinct corporate proxy fixture ports by @drew in #3761
• test(cli): migrate gateway-free smoke coverage by @elezar in #3641
• test(conformance): migrate file transfer coverage by @elezar in #3597
• fix(server): retry provider attachment CAS conflicts by @drew in #3501
• test(e2e): run podman suite with tmachine by @elezar in #3637
• fix(network): refuse protocol upgrades on JSON-RPC and MCP endpoints by @shiju-nv in #3753
• feat(cli): detach sandbox sessions with Ctrl-D by @drew in #3744
• fix(cli): prevent orphaned SSH forward muxes by @drew in #3759
• test(install): support Bash 3.2 mock capture by @elezar in #3790
• feat(mcp): inspect requests with Tower-selected protocol profiles by @shiju-nv in #3335
• feat(sandbox): add main restart policy by @drew in #2798
• perf(kubernetes): use a TCP readiness probe for the supervisor by @FrostGod in #3700
• feat(docker): support corporate proxy CA bundles by @feloy in #3549
• fix(e2e): stop sandbox leaks from async Drop cleanup by @ericcurtin in #3750
• fix(cli): keep policy and provider diagnostics readable by @shiju-nv in #3444
• feat(server): write gateway OCSF events to JSONL by @krishicks in #3264
• test(sandbox): bind ephemeral port in accepted loopback stream test by @krishicks in #3872
• fix(network): preserve pipelined requests after chunked inspection by @shiju-nv in #3861
• docs: remove the architecture directory by @krishicks in #3799
• fix(ci): restore repository permission vetters by @pimlock in #3875
• feat(helm): configure gateway OCSF JSONL output by @krishicks in #3876
• fix(supervisor): restore canonical stdin after connection loss by @shiju-nv in #3852
• fix(mcp): explain revision-scoped policy and rejections by @shiju-nv in #3850
• feat(providers): add Oracle Cloud Infrastructure Generative AI provider profile by @fede-kamel in #3904
• feat(providers): serve sandbox config files on demand by @drew in #3832
• fix(policy): validate raw OPA settings and redact startup errors by @shiju-nv in #3788
• Fix/startup provider readiness by @ebusto in #3819
• test(podman): move podman_preflight into driver-podman integration tests by @politerealism in #3783
• fix(conformance): require successful list to certify deletion by @elezar in #3792
• test(tmachine): add K3s conformance scenario by @SDAChess in #3848
• perf(otel): stop exporting spans from steady-state polling by @krishicks in #3915
• fix(cli): accept sandbox name before -- in exec by @ericcurtin in #3901
• fix(network): refuse protocol upgrades on GraphQL endpoints by @shiju-nv in #3841
• feat(service): add bearer authorization passthrough by @derekwaynecarr in #3796
• fix(server): log polled request responses at debug by @krishicks in #3974
• refactor(sandbox): remove unreachable root-side identity and workspace code by @matthewgrossman in #3979
• fix(e2e): keep locally built Kubernetes images off the chart's default registry by @krishicks in #3991
• fix(gator): require full head SHA for /ok to test by @purp in #4007
• fix(gateway): delete finalized ephemeral sandboxes while connected by @johntmyers in #3984
• refactor(auth): separate sandbox identity from TLS by @drew in #3110
• chore(build): remove bundled Z3 support by @SDAChess in #3275
• fix(runtime): recover SSH relays and bound startup diagnostics by @drew in #4011
• fix(ci): align integration inputs with release candidate source by @SDAChess in #4048
• test(e2e): remove schema parity campaign by @elezar in #3864
• fix(ci): qualify protobuf compatibility by release train by @SDAChess in #4049
• feat(flake): Add missing packages to flake for running mise commands by @bornav in #2151
• test(tmachine): add Fedora RPM package installer by @elezar in #4025
• ci: use package installers consistently in integration tests by @elezar in #4056
• fix(snap): simplify snap hooks by @olivercalder in #3988
• fix(supervisor): wait for repair when the gateway refuses a startup policy write by @shiju-nv in #3785
• fix(cli): start sandbox exec without waiting for piped stdin EOF by @fede-kamel in #4006
• chore(agents): simplify contributor instructions and workflows by @johntmyers in #3987
• fix(supervisor): bound pending exec stdin and cancel stalled writers by @shiju-nv in #3846
• fix(policy): refresh pending proposals when the sandbox policy changes by @fede-kamel in #3923
• feat(sandbox): write agent output to the container log by @krishicks in #4005
• chore(gator): default to GPT-6.1 Sol by @johntmyers in #4065
• feat(examples): run Jupyter notebooks in an OpenShell sandbox by @drew in #2253
• test(python): synchronize interactive exec TTY readiness by @matthewgrossman in #4076
• fix(sandbox): restrict provider file mode by @drew in #4093
• fix(ci): retry Nix shell and app dependency preparation by @matthewgrossman in #4066
• feat(snap): ship the standalone prover binary in the snap by @olivercalder in #3717
• fix(kubernetes): serialize lifecycle cleanup with sandbox restart by @matthewgrossman in #4078
• fix(deps): upgrade russh to address Dependabot alert 40 by @alangou in #4116
• fix(cli)!: stop uploads when Git filtering fails or selects no files by @alangou in #3957
• fix(providers): restore supervisor-backed GCP metadata discovery by @feloy in #3973
• feat(helm): add sandbox UID and GID values by @ericcurtin in #3947
• ci(vm): codesign macOS driver-vm with hypervisor entitlement in CI by @benoitf in #3507
• ci: pin CI images by digest and add native architecture smoke checks by @alangou in #4114
• fix(providers): stabilize provider environment revisions by @drew in #4122
• fix(deps): upgrade ratatui to resolve lru vulnerability by @alangou in #4131
• fix(sandbox): replace lifetime exec cap with retry deadlines by @drew in #4105
• fix(cli): check final exec status and warn on partial input by @shiju-nv in #3803
• fix(install): stop waiting when the gateway service fails by @ericcurtin in #4143
• fix(docker): pull only :latest for a tagless --from, not every tag by @udsy19 in #4124
• fix(vm): reject conflicting workload identity selectors by @shiju-nv in #4036
• fix(vm): reclaim cancelled image preparation after worker exit by @shiju-nv in #4039
• feat(gateway): check VM host tools during config preflight by @shiju-nv in #4037
• fix(relay): close outbound relay stream when target closes first by @ericcurtin in #3772
• fix(tui): preserve quoted post-create command arguments by @thotashashank302 in #4137
• fix(gateway): give image prep...

OpenShell v0.1.2

OpenShell v0.1.2

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.2 sh

What's Changed

• docs(policy): clarify sandbox-local loopback access by @drew in #3740
• docs: refresh architecture and extensibility pages by @drew in #3741
• fix(supervisor-network): keep workload bytes read with a mediated CONNECT header by @dims in #3745
• fix(homebrew): overwrite generated gateway config during migration by @drew in #3752
• fix(ci): keep snap canary sandbox name within limit by @drew in #3751
• fix(docs): sync redirects with versioned snapshots by @johnnygreco in #3754
• docs: keep page URLs aligned with file paths by @johnnygreco in #3713
• perf(sandbox): wake orphan reaper on child exit by @drew in #3757

Full Changelog: v0.1.1...v0.1.2

OpenShell v0.1.1

OpenShell v0.1.1

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.1 sh

What's Changed

• fix(gateway): make the WebSocket tunnel opt-in by @drew in #3727
• test(binary-identity): stabilize procfs identity fixtures by @grs in #3708
• docs(tutorials): run Pi with OpenRouter by @johnnygreco in #3722
• fix(snap): require mTLS for the snap gateway by @drew in #3726
• docs: describe 0.1 series in release callouts by @drew in #3732

Full Changelog: v0.1.0...v0.1.1

OpenShell v0.1.0

OpenShell v0.1.0

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.0 sh

What's Changed

• ci(codeql): run nightly scans on main by @alangou in #3007
• feat!(ci): remove daily minor release automatic workflow by @SDAChess in #3008
• fix(kubernetes): recover compute driver watches by @jhjaggars in #2842
• fix(cli): include provider identity metadata for interceptors on update by @slopp in #3014
• fix(sandbox): complete successful main processes by @drew in #2884
• fix(ci): preserve VM runtime embedding inputs by @SDAChess in #3040
• feat(sandbox): add --no-login-shell to skip shell startup files on exec by @letv1nnn in #2852
• fix(compute): recover Error-phase sandboxes on gateway startup by @r3v5 in #2269
• feat(compute): delegate sandbox authentication to drivers by @drew in #2968
• fix(cli): reject out-of-range durations instead of overflowing by @natedemoss in #3044
• docs: correct some comments and references by @krishicks in #3059
• test: backfill coverage for OCSF logging by @krishicks in #3065
• fix(kubernetes): prevent stop-start relay race by @johntmyers in #3064
• fix(policy): compose advisor proposals with provider endpoints by @johntmyers in #2935
• chore(deps): remove legacy rustls webpki path by @elezar in #3013
• test(e2e): run conformance in gateway lanes by @elezar in #2925
• feat(ci): add Codex Security release qualification by @alangou in #3087
• fix(cli): fail sandbox exec when relay closes without exit status by @rootkiller6788 in #2957
• fix(podman): restore rootless workload SIGTERM shutdown by @elezar in #3036
• ci(release): publish prerelease artifacts by @SDAChess in #3093
• fix(release): handle prerelease tag builds by @SDAChess in #3094
• feat(cli): add structured output to list commands by @mrunalp in #3067
• fix(release): provide conformance binary to e2e by @SDAChess in #3097
• fix(policy): ignore advisor provenance during contract inference by @johntmyers in #3069
• fix(gateway): batch SSH session cleanup writes by @drew in #3000
• fix(helm): honor empty clientCaSecretName for HTTPS-only mode by @lunarwhite in #2235
• fix(server): release driver-owned sandbox resources on out-of-band removal by @politerealism in #3042
• fix(sandbox): reconcile early container exits by @johntmyers in #3101
• feat(providers): make profiles authoritative by @johntmyers in #2962
• fix(cli): size auto-detected interactive exec terminals by @elezar in #3084
• fix(cli): allow multiple provider profiles to be deleted by @grs in #3032
• feat(build): add defaults-without-telemetry feature alias by @russellb in #2843
• fix(cli): suppress ANSI color when stdout is not a terminal by @mrunalp in #3026
• refactor(compute): decouple gateway driver composition by @drew in #2823
• fix(cli): continue multi-item deletes after failures by @grs in #3111
• feat(helm): split gateway and workspace charts by @dhirajsb in #2643
• fix(tui): expose workspace switching from providers by @johntmyers in #3115
• chore(gator): adopt authoritative provider profiles by @johntmyers in #3108
• feat(server): add sandbox templates by @grs in #2833
• fix(release): publish prerelease helm charts by @SDAChess in #3126
• test(guest): consolidate rootless Podman provisioning by @elezar in #3125
• ci: add Fedora conformance workflow by @SDAChess in #3086
• fix(ci): use multi-arch Fedora image for RPM builds by @SDAChess in #3130
• feat(vm): support corporate HTTP forward proxy egress for microVM sandboxes by @feloy in #3090
• fix(cli): require ANSI-capable terminal before colorizing by @mrunalp in #3121
• fix(tui): replace alpha badges with version by @johntmyers in #3114
• feat(skills): separate public and contributor workflows by @johnnygreco in #2899
• fix(go-sdk): prevent duplicate credential renewal by @johntmyers in #3133
• fix(cli): preserve provider type on credential updates by @natedemoss in #3109
• test(e2e): keep lifecycle sandboxes running by @elezar in #3128
• fix(vm): retry transient registry requests by @drew in #3134
• fix(compute): fence stale container exits during start by @drew in #3132
• ci: add branch check and test timeouts by @pimlock in #3139
• fix(middleware): drain websocket session end streams by @pimlock in #3143
• fix(deps): remediate h2 advisory by @elezar in #3085
• docs: fix first-network-policy sandbox lifecycle flow by @russellb in #3140
• chore(ci): remove obsolete Rust cache seeder by @pimlock in #3148
• fix(sdk-go): update Go IDNA dependencies by @johntmyers in #3137
• feat(middleware): broaden HTTP header mutation authority by @pimlock in #3072
• fix(ci): restore Codex Security scan execution by @alangou in #3124
• fix(snap): recover gateway after Docker connection by @elezar in #2866
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /sdk/go by @dependabot[bot] in #3119
• test(conformance): add plan-driven continuity verification by @elezar in #3107
• feat(test-guest): allow copy mode overrides by @elezar in #3091
• feat(docs): fix Windows bundled-z3 build command in CONTRIBUTING.md by @pkhodade-NV in #3141
• refactor(otel): unify compute driver tracing by @krishicks in #2995
• docs: add project maintainers by @johntmyers in #3166
• fix(driver-mxc): implement authenticate_sandbox trait method by @jeffmaury in #3158
• refactor(cli): extract provider commands into commands/provider module by @varshaprasad96 in #2605
• fix(sandbox): detect an available login shell instead of hardcoding /bin/bash by @akram in #3147
• feat(server): support EC and EdDSA keys in OIDC JWKS validation by @lunarwhite in #2593
• docs(gateway-config): fix stale community sandbox image path by @lunarwhite in #2800
• fix(dev): inherit non-expiring sandbox JWT in local gateway scripts by @pimlock in #2636
• fix(tui): keep sandbox actions visible by @johntmyers in #3189
• fix(server): preserve in-memory SQLite across reconnects by @EmilienM in #3175
• feat(ocsf): configurable schema version for SIEM backward compatibility by @zanetworker in #2717
• docs: add project governance by @johntmyers in #3191
• fix(policy): harden advisor transport proposals by @johntmyers in #3136
• fix(supervisor): reject MCP initialize batches by @shiju-nv in #3192
• feat(middleware): define HTTP response pre-return interface by @pimlock in #3073
• feat(policy): preserve exact MCP revision allowlists by @shiju-nv in #3027
• fix(supervisor-network): omit absent L7 selectors from policy data by @shiju-nv in #3200
• perf(supervisor-network): cache proposal coverage by policy snapshot by @shiju-nv in #3201
• test(test-guest): support rootful Podman gateways by @elezar in https://github.com/NVID...

OpenShell VM Runtime

Build of the OpenShell VM runtime artifacts used by openshell-driver-vm.

NOTE: This is a development build.

Kernel Runtime Artifacts

Pre-built kernel runtime (libkrunfw + libkrun + umoci) for embedding
into the openshell-driver-vm binary. These are rebuilt on demand when the
kernel config or pinned dependency versions change.

Platform	Artifact
Linux ARM64	vm-runtime-linux-aarch64.tar.zst
Linux x86_64	vm-runtime-linux-x86_64.tar.zst
macOS ARM64	vm-runtime-darwin-aarch64.tar.zst

Verify

gh release download vm-runtime -R NVIDIA/OpenShell -p vm-runtime-linux-x86_64.tar.zst
gh attestation verify vm-runtime-linux-x86_64.tar.zst -R NVIDIA/OpenShell

OpenShell v0.0.116

OpenShell v0.0.116

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.116 sh

What's Changed

• fix(dev): harden local cluster and gateway startup by @krishicks in #2993
• fix(server): suppress expected session errors on shutdown by @krishicks in #2994
• test(network): avoid DNS socket bind race by @krishicks in #2996
• chore(deps): bump jdx/mise-action from 4.2.4 to 4.3.0 by @dependabot[bot] in #2970
• fix(ci): normalize macOS binary dependencies by @SDAChess in #3006

Full Changelog: v0.0.115...v0.0.116

OpenShell v0.0.115

OpenShell v0.0.115

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.115 sh

What's Changed

• feat(dev): unify local Kubernetes gateway workflow by @krishicks in #2914
• docs(agents): clarify user-visible PR review feedback by @krishicks in #2910
• feat(kubernetes): export driver traces over OTLP by @krishicks in #2958
• fix(supervisor): log unmatched L7 route denials by @wtrep in #2916
• fix(supervisor-network): distinguish absent policy binary from filesystem-access failure by @letv1nnn in #2948
• feat(driver-mxc): native Windows MXC compute driver + server wiring by @jamieknvidia in #2721
• ci: remove rootless podman e2e lane by @elezar in #2981
• ci(stale): increase stale workflow processing budget by @elezar in #2979
• ci(security): add informational security checks by @alangou in #2930
• chore(deps): bump quinn-proto from 0.11.14 to 0.11.17 by @dependabot[bot] in #2986
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /sdk/go by @dependabot[bot] in #2985
• feat(test-guest): add snap lifecycle reproduction harness by @elezar in #2865
• feat(build): publish OCI SBOM and provenance attestations by @alangou in #2836
• ci: build release binaries with Nix by @SDAChess in #2977
• feat(gateway): identify gateways in exported traces by @krishicks in #2647

New Contributors

• @wtrep made their first contribution in #2916
• @jamieknvidia made their first contribution in #2721

Full Changelog: v0.0.114...v0.0.115

OpenShell v0.0.113

OpenShell v0.0.113

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.113 sh

What's Changed

• feat(docker): export driver traces over OTLP by @krishicks in #2851
• fix(proxy): normalize trailing-dot CONNECT hosts before policy evaluation by @letv1nnn in #2248
• feat(sandbox,podman): trust corporate CA for https:// proxies and intercepted TLS by @feloy in #2512
• test(e2e): pin direct podman calls to harness socket on macOS by @russellb in #2909
• fix(core): fall back to podman CLI when no API socket is found by @russellb in #1858
• fix(ci): allow pasta to receive Podman stop signals by @elezar in #2900
• fix(python): remove CLI from wheel by @SDAChess in #2321

Full Changelog: v0.0.112...v0.0.113

OpenShell v0.0.111

OpenShell v0.0.111

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.111 sh

What's Changed

• chore: remove Bazel build support by @SDAChess in #2840
• refactor(compute): support external driver parity by @drew in #2744
• feat(policy): establish direct TCP egress foundation by @johntmyers in #2711
• feat(network): add policy DNS correlation store by @johntmyers in #2713
• feat(podman): export driver traces over OTLP by @krishicks in #2782
• feat(network): enable Docker and Podman policy DNS and transparent TCP by @johntmyers in #2723
• refactor(compute): register compiled drivers by @drew in #2786
• feat(sandbox): add canonical main process by @drew in #2726
• fix(sandbox): stabilize canonical main process tests by @drew in #2854
• fix(sandbox): order sidecar provider updates by generation by @johntmyers in #2849
• test(e2e): align detached sandbox assertions by @drew in #2856
• feat(compute): add standalone first-party drivers by @drew in #2822
• docs(rfc): define stable release policy by @drew in #2695
• fix(sandbox): reject stale exit during restart by @drew in #2857

Full Changelog: v0.0.110...v0.0.111