OpenShell

No entries match these filters. Clear filters

1. v0.1.7 Nov 3, 2026 · issue 130

   OpenShell adds in-place Kubernetes sandbox updates, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools./HTTP export, per-collector auth headers, mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for OTLP, and containerized browser login via two new env vars⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONHomebrewgit

   Homebrew copy

   $ brew install openshell
   # already installed? upgrade to this version:
   $ brew upgrade openshell

   git copy

   $ git clone --branch v0.1.7 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.1.7

   Homebrew lists this version · checked 4 Nov

   └──▷ USE IT
   Send agent traces from inside a sandbox to your OTLP collector, authenticated with an MLflow experiment header, without writing an egress rule.
   gateway.toml copy

   [openshell.gateway.otlp.agent]
   enabled = true
   
   [openshell.gateway.otlp]
   protocol = "http/protobuf"
   headers_file = "/etc/openshell/otlp-headers.txt"

   Connect your OTLP collector over mutual TLS using a private CA, so traces are encrypted end-to-end without a public certificate.
   gateway.toml copy

   [openshell.gateway.otlp]
   ca_file = "/etc/openshell/pki/ca.pem"
   cert_file = "/etc/openshell/pki/client.pem"
   key_file = "/etc/openshell/pki/client-key.pem"

   Run the CLI inside a container and fix the OAuth callback so browser login completes correctly.
   copy

   $ docker run --rm -e OPENSHELL_CALLBACK_PORT=9876 -e OPENSHELL_CALLBACK_BIND_ADDRESS=0.0.0.0 -p 9876:9876 my-openshell-cli openshell gateway login

   • Route sandbox egress through a private PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. by setting [openshell.supervisor.network].additional_ca_bundle to a PEM bundle, applying to every first-party compute driver.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Forward sandboxed agent OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces to your collector without an egress rule by adding [openshell.gateway.otlp.agent] with enabled = true to gateway.toml; the supervisor tags each span with the sandbox id before forwarding.
   • Use OTLP/HTTP instead of gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. for telemetry export by setting protocol = "http/protobuf" on [openshell.gateway.otlp] or any signal sub-table; gRPC remains the default.
   • Authenticate or route OTLP traffic by setting headers or headers_file on [openshell.gateway.otlp] or a signal table, so collectors like MLflow can receive relayed agent traces via x-mlflow-experiment-id.
   • Connect OTLP collectors over mutual TLS or private CAs by setting ca_file, and optionally cert_file and key_file, on [openshell.gateway.otlp] or a signal table.

   +4 more show less

   • Give each sandbox service a unique hostname when multiple gateways share a cluster by setting service_hostname_format = "hashed" under [openshell.gateway]; the previous readable default is unchanged.
   • Opt into a new supervisor TLS listener that lets declared HTTP and WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. sandbox services accept application traffic directly, bypassing the gateway; disabled by default.
   • The Rust, Go, Python, and TypeScript SDKs now send exec calls directly to the gateway replica that owns the sandbox when replica routing is enabled; Go also routes port-forward and SSH tunnel calls, and TypeScript routes port-forward.
   • The Python gRPC bindings now ship typed sync and async stubs, giving editors and type checkers visibility into concrete request and response types.
   • Route sandbox egress through a private PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. by setting [openshell.supervisor.network].additional_ca_bundle to a PEM bundle, applying to every first-party compute driver.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Forward sandboxed agent OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces to your collector without an egress rule by adding [openshell.gateway.otlp.agent] with enabled = true to gateway.toml; the supervisor tags each span with the sandbox id before forwarding.
   • Authenticate or route OTLP traffic by setting headers or headers_file on [openshell.gateway.otlp] or a signal table, so collectors like MLflow can receive relayed agent traces via x-mlflow-experiment-id.
   • Connect OTLP collectors over mutual TLS or private CAs by setting ca_file, and optionally cert_file and key_file, on [openshell.gateway.otlp] or a signal table.
   • Give each sandbox service a unique hostname when multiple gateways share a cluster by setting service_hostname_format = "hashed" under [openshell.gateway]; the previous readable default is unchanged.

   +1 more show less

   • Opt into a new supervisor TLS listener that lets declared HTTP and WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. sandbox services accept application traffic directly, bypassing the gateway; disabled by default.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !OpenShell now emits only OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.8.0 records; deployments that relied on 1.1 or 1.3 records will now receive 1.8.0 records. The ocsf_schema_version setting, the gateway schema_version fields, Helm server.ocsfLog.schemaVersion, and OPENSHELL_OTLP_OCSF_SCHEMA_VERSION are deprecated and ignored; setting them logs a warning.
   • !config preflight and gateway startup now reject an [openshell.gateway.supervisor_pool] table when the selected driver does not use shared supervision, and also reject a pool recovery timeout shorter than member failure detection.
2. v0.1.6 Oct 27, 2026 · issue 123

   OpenShell v0.1.6 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. audit events, sandbox suspend/resume, shared Kubernetes supervisors, and new HelmHelmA package manager for Kubernetes, maintained by the CNCF, that lets tools define, version, and deploy clusters of Kubernetes resources as a single reusable unit called a chart. chart fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONHomebrewgit

   Homebrew copy

   $ brew install openshell
   # already installed? upgrade to this version:
   $ brew upgrade openshell

   git copy

   $ git clone --branch v0.1.6 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.1.6

   Homebrew lists this version · checked 28 Oct

   └──▷ TRY IT
   Pause a long-running sandbox to free compute resources, then resume it later without losing state.
   copy

   $ openshell sandbox suspend my-sandbox
   # ... later ...
   openshell sandbox resume my-sandbox

   Enable the shared Kubernetes supervisor so many sandboxes share one process and failed supervisors are covered by pool replicas.
   toml copy

   [openshell.drivers.kubernetes]
   supervisor_topology = "gateway"
   
   [openshell.gateway]
   # gateway TLS is required when supervisor_topology = "gateway"
   
   # In the Helm values, set replica count:
   # supervisor:
   #   replicas: 3

   Install the latest prerelease build via the snap beta channel to test upcoming features before a stable release.
   copy

   $ OPENSHELL_VERSION=pre curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

   • Adds openshell sandbox suspend and openshell sandbox resume commands to pause and resume sandboxes on supported compute drivers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds supervisor_topology = "gateway" under [openshell.drivers.kubernetes] to enable an experimental shared supervisor that hosts many sandboxes in one process as a pool that can take over a failed supervisor's sandboxes, with supervisor.replicas to set pool capacity.
   • Adds binding_policy setting (values: allowlist or exact) to require a middleware service to provide specific bindings such as request inspection.
   • Adds server.extraEnv to the Helm chart for passing extra environment variables, including Secret references, to the gateway container, and adds pkiInitJob.podLabels and pkiInitJob.podAnnotations to the Helm chart for the certificate hook pods.
   • Gateways now write OCSF audit events for authorization denials, accepted credentials, SSH session tokens, and sandbox token checks, and raise a High-severity finding when a sandbox credential looks misused.

   +2 more show less

   • Prerelease builds now publish to the snap's latest/beta channel; OPENSHELL_VERSION=pre install.sh installs from there.
   • Stable releases now tag the Go SDK module as sdk/go/vX.Y.Z so Go tooling and pkg.go.dev show real versions.
   • Adds openshell sandbox suspend and openshell sandbox resume commands to pause and resume sandboxes on supported compute drivers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds supervisor_topology = "gateway" under [openshell.drivers.kubernetes] to enable an experimental shared supervisor that hosts many sandboxes in one process as a pool that can take over a failed supervisor's sandboxes, with supervisor.replicas to set pool capacity.
   • Adds binding_policy setting (values: allowlist or exact) to require a middleware service to provide specific bindings such as request inspection.
   • Adds server.extraEnv to the Helm chart for passing extra environment variables, including Secret references, to the gateway container, and adds pkiInitJob.podLabels and pkiInitJob.podAnnotations to the Helm chart for the certificate hook pods.
   • Gateways now write OCSF audit events for authorization denials, accepted credentials, SSH session tokens, and sandbox token checks, and raise a High-severity finding when a sandbox credential looks misused.

   +1 more show less

   • Prerelease builds now publish to the snap's latest/beta channel; OPENSHELL_VERSION=pre install.sh installs from there.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Gateways now refuse to start unless OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. user or operator authentication, or gateway JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. are configured; for trusted local development only, set allow_unauthenticated_users = true under [openshell.gateway.auth].
   • !New sandboxes on Kubernetes, Docker, Podman, and VM now open the control connection from sandbox to supervisor in the opposite direction; supervisor and sandbox runtime binaries must be upgraded together because older binaries reject the new sandboxes.
   • !External isolation backends: ResumeBoundaryRequest field 3 is renamed from allow_cold_start_fallback to restart_if_restore_fails.
3. v0.1.5 Oct 20, 2026 · issue 115

   OpenShell v0.1.5 adds push-based config delivery (~100 ms), OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work.-over-OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. export, virtiofsvirtiofsA shared filesystem protocol for virtual machines, maintained by the Linux kernel project, that lets a VM access a host directory with near-native performance by avoiding network filesystem overhead. host mounts, per-sandbox mutation locks, and new CLI flags --annotation and --e⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.1.5 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.1.5

   └──▷ USE IT
   Reduce policy-change propagation from up to 10 s to ~100 ms by enabling push-based config delivery on the supervisor.
   toml copy

   config_delivery_mode = "push"

   Stream OCSF audit events into your OTLP pipeline (e.g. a separate security observability backend) without mixing them with traces.
   toml copy

   [openshell.gateway.otlp.ocsf]
   enabled = true
   endpoint = "https://ocsf-collector.example.com:4317"

   Pass secrets from the local environment into a new sandbox without exposing them in shell history or process listings.
   copy

   $ openshell sandbox create --name agent-run --env-from AWS_ACCESS_KEY_ID --env-from AWS_SECRET_ACCESS_KEY --annotation team=security -- python agent.py

   • Adds config_delivery_mode = "push" supervisor setting to receive configuration changes pushed over the gateway session in ~100 ms instead of up to 10 seconds; polling remains the default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [openshell.gateway.otlp.ocsf] config block with enabled = true to export OCSF events as OTLP log records, and allows traces and OCSF events to be sent to separate OTLP endpoints.
   • Adds --annotation KEY=VALUE repeatable flag to openshell sandbox create for setting sandbox annotations from the CLI.
   • Adds --env-from KEY[=ENVVAR] flag to openshell sandbox create to pass sandbox environment variables from the caller's environment without putting values on the command line.
   • Adds OPENSHELL_OCSF_JSON=1 gateway audit sink, now available on all platforms.

   +5 more show less

   • Adds enable_bind_mounts = true setting in [openshell.drivers.vm] to allow MicroVM sandboxes to mount host directories through virtiofs; supports up to 3 mounts on x86_64 or 32 on aarch64 (QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware.-backed and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. launches are not supported).
   • Adds supervisor_network_mode setting for the Docker supervisor to enable bridge networking (host networking remains the default).
   • Adds allowed_pod_annotations and allowed_pod_labels settings in [openshell.drivers.kubernetes] to allowlist pod annotation and label keys used in sandbox templates.
   • Adds server.dataStorageSize and server.dataStorageClass Helm values to configure the gateway data PVC.
   • Gateway mutation locks are now scoped per workspace and sandbox with bounded waits, preventing bursts of supervisor reconnects from queuing behind a single fleet-wide lock.
   • Adds config_delivery_mode = "push" supervisor setting to receive configuration changes pushed over the gateway session in ~100 ms instead of up to 10 seconds; polling remains the default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [openshell.gateway.otlp.ocsf] config block with enabled = true to export OCSF events as OTLP log records, and allows traces and OCSF events to be sent to separate OTLP endpoints.
   • Adds enable_bind_mounts = true setting in [openshell.drivers.vm] to allow MicroVM sandboxes to mount host directories through virtiofs; supports up to 3 mounts on x86_64 or 32 on aarch64 (QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware.-backed and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. launches are not supported).
   • Adds supervisor_network_mode setting for the Docker supervisor to enable bridge networking (host networking remains the default).
   • Adds allowed_pod_annotations and allowed_pod_labels settings in [openshell.drivers.kubernetes] to allowlist pod annotation and label keys used in sandbox templates.

   +1 more show less

   • Adds server.dataStorageSize and server.dataStorageClass Helm values to configure the gateway data PVC.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Supervisor OCSF log files are renamed from openshell-ocsf.YYYY-MM-DD.log to openshell-ocsf.YYYY-MM-DD.jsonl; update any collector glob patterns from openshell-ocsf.*.log to openshell-ocsf.*.jsonl. Old .log files are not migrated.
   • !On Kubernetes, sandbox templates that set pod annotations or labels are now rejected unless an operator allowlists the keys with allowed_pod_annotations and allowed_pod_labels in [openshell.drivers.kubernetes]. API and SDK callers setting SandboxTemplate.labels or SandboxTemplate.annotations (including recovery of timed-out sandboxes) are affected; the openshell CLI and --label metadata labels are not.
   • !The gateway now rejects annotation keys with the reserved internal.openshell.ai/ prefix on CreateSandbox and UpdateConfig.
   • !The Go SDK's SandboxInterface.Create() and CreateFromTemplate() now take functional options (WithLabels(), WithAnnotations(), WithServiceExposures()) instead of a positional labels argument; the CreateOptions struct has been removed. Call sites must be updated.
   • !External compute drivers that provision openshell-sandbox must update their bootstrap descriptor field from outer_fence to provisioning_evidence.
   • !The snap no longer enables the user gateway service globally; after a direct snap install or if an older revision enabled it globally, run sudo systemctl disable --global snap.openshell.user-gateway.service once, then systemctl --user enable --now snap.openshell.user-gateway.service from the single account that should run the gateway.
4. v0.1.4 Oct 13, 2026 · issue 108

   v0.1.4 adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. server reflection, operator-only credential retrieval, stable credential placeholders, CLI label management, TypeScript log streaming, and Python sandbox sta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.1.4 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.1.4

   └──▷ TRY IT
   Introspect the gateway's gRPC API surface on a local plaintext gateway without any proto files checked out.
   copy

   $ grpcurl -plaintext localhost:18080 list
   grpcurl -plaintext localhost:18080 describe openshell.v1.OpenShell
   grpcurl -plaintext -d '{}' localhost:18080 openshell.v1.OpenShell/Health

   • Adds gRPC server reflection (v1 protocol) to the gateway, enabling grpcurl -plaintext localhost:18080 list and schema introspection without supplying proto files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds operator-only provider credential retrieval so privileged identities can fetch provider credentials without exposing them to sandbox workloads.
   • Adds createdAtMs field to SandboxRef in the TypeScript SDK for millisecond-precision sandbox creation timestamps.
   • Adds watchLogs with loss-aware resume to the TypeScript SDK for streaming sandbox logs that automatically reconnects and tracks gaps.
   • Exposes sandbox status conditions in the Python SDK so callers can inspect structured lifecycle state.

   +2 more show less

   • Adds CLI label creation and filtering for providers, enabling operators to tag and query providers by label.
   • Adds snap gateway as a user service by default, removing the need for system-level privileges on snap-based installs.
   • Adds gRPC server reflection (v1 protocol) to the gateway, enabling grpcurl -plaintext localhost:18080 list and schema introspection without supplying proto files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds operator-only provider credential retrieval so privileged identities can fetch provider credentials without exposing them to sandbox workloads.
   • Adds watchLogs with loss-aware resume to the TypeScript SDK for streaming sandbox logs that automatically reconnects and tracks gaps.
   • Adds CLI label creation and filtering for providers, enabling operators to tag and query providers by label.

   3 more in Everything

5. v0.1.3 Oct 9, 2026 · issue 100

   v0.1.3 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. gateway audit events, bearer auth passthrough, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. traces from sandbox supervisors, Ctrl-D session detach, gateway capacity metrics with optional HPA, VM host-tool preflight checks, runtime image env overrides, and optional cluster-scoped RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. in Helm.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.1.3 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.1.3

   • Adds feat(cli): detach sandbox sessions with Ctrl-D — press Ctrl-D to detach from a running sandbox session without terminating it.
   • Adds feat(server): write gateway OCSF events to JSONL — the gateway now emits structured audit events in OCSF JSONL format.
   • Adds feat(helm): configure gateway OCSF JSONL output — Helm values expose controls for enabling and routing the gateway's OCSF JSONL audit stream.
   • Adds feat(service): add bearer authorization passthrough — the gateway service layer can forward bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. from inbound requests to upstream endpoints.
   • Adds feat(supervisor): export OTLP traces from sandbox supervisors — sandbox supervisors now emit OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces over OTLP for distributed tracing pipelines.

   +10 more show less

   • Adds feat(server): add gateway capacity metrics and optional HPA — the gateway exposes capacity metrics and supports a Horizontal Pod Autoscaler when deployed on Kubernetes.
   • Adds feat(gateway): check VM host tools during config preflight — the gateway now validates that required VM host tools are present before accepting a VM-backed sandbox configuration.
   • Adds feat(gateway): support runtime image env overrides — runtime image environment variables can now be overridden at sandbox launch time.
   • Adds feat(helm): make cluster-scoped RBAC optional — cluster-scoped RBAC can now be disabled in the Helm chart for environments that restrict it.
   • Adds feat(helm): add sandbox UID and GID values — Helm chart gains sandboxUid and sandboxGid values to control the identity under which sandbox workloads run.
   • Adds feat(sandbox): add main restart policy — configure a restart policy for the primary sandbox process.
   • Adds feat(providers): serve sandbox config files on demand — providers can now deliver configuration files into the sandbox at runtime on request.
   • Adds feat(providers): add multiple tokens to one request — a single outbound request can now carry tokens from multiple providers simultaneously.
   • Adds feat(snap): ship the standalone prover binary in the snap — the snap package now includes the standalone formal-verification prover binary.
   • Adds feat(sandbox): write agent output to the container log — agent stdout/stderr is now mirrored to the container log for observability.

   15 details in Everything

   • New integration Oracle Cloud Infrastructure Generative AI provider profile
6. v0.1.0 Sep 25, 2026 · issue 086

   OpenShell v0.1.0 adds sandbox templates, VM HTTP proxy egress, structured list output, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. schema versioning, and ECECElliptic Curve cryptography, a public-key approach where security comes from the algebraic structure of elliptic curves over finite fields, giving tools strong encryption and signatures at smaller key sizes than RSA./EdDSAEdDSAA fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.1.0 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.1.0

   └──▷ TRY IT
   Drop into a sandbox for debugging without sourcing .bashrc or .profile, so startup-file side-effects don't interfere with your session.
   copy

   $ openshell sandbox exec my-sandbox --no-login-shell

   Provision a VM-driver sandbox from a pre-built rootfs tar archive instead of a container image — useful when your artifact pipeline produces filesystem tarballs.
   copy

   $ openshell sandbox create --name rootfs-sandbox --from ./rootfs.tar

   • Adds --no-login-shell flag to openshell sandbox exec to skip shell startup files when entering a sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --from flag accepting a rootfs tar archive as the source for VM driver sandboxes.
   • Adds structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. to openshell list commands for machine-readable results.
   • Adds configurable OCSF schema version for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. backward compatibility.
   • Adds sandbox templates on the server, allowing reusable sandbox configuration to be defined once and referenced at creation time.

   +13 more show less

   • Supports corporate HTTP forward proxy egress for microVM sandboxes.
   • Supports EC and EdDSA keys in OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. JWKS validation on the server.
   • Splits the Helm chart into separate gateway and workspace charts.
   • Adds a defaults-without-telemetry feature alias at build time, enabling telemetry-free builds without manual feature flag composition.
   • Broadens HTTP header mutation authority in middleware, expanding the extension surface for interceptors.
   • Defines an HTTP response pre-return interface in middleware for new extension hooks.
   • Preserves exact MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. revision allowlists in policy, enabling pinned MCP version enforcement.
   • Advertises compute resource capabilities from drivers, making sandbox resource metadata visible to the control plane.
   • Makes provider profiles authoritative, so profile definitions drive sandbox authentication rather than being advisory.
   • Delegates sandbox authentication to compute drivers, enabling driver-owned auth flows.
   • Makes the e2e:kubernetes target work transparently on OpenShift.
   • Separates public and contributor agent skill workflows in the skills/ directory.
   • Adds Codex Security release qualification to the CI pipeline.
   • Adds --no-login-shell flag to openshell sandbox exec to skip shell startup files when entering a sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --from flag accepting a rootfs tar archive as the source for VM driver sandboxes.
   • Adds configurable OCSF schema version for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. backward compatibility.
   • Adds sandbox templates on the server, allowing reusable sandbox configuration to be defined once and referenced at creation time.
   • Supports corporate HTTP forward proxy egress for microVM sandboxes.

   +7 more show less

   • Splits the Helm chart into separate gateway and workspace charts.
   • Adds a defaults-without-telemetry feature alias at build time, enabling telemetry-free builds without manual feature flag composition.
   • Defines an HTTP response pre-return interface in middleware for new extension hooks.
   • Preserves exact MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. revision allowlists in policy, enabling pinned MCP version enforcement.
   • Advertises compute resource capabilities from drivers, making sandbox resource metadata visible to the control plane.
   • Separates public and contributor agent skill workflows in the skills/ directory.
   • Adds Codex Security release qualification to the CI pipeline.

   6 more in Everything

7. v0.0.115 Aug 27, 2026 · issue 058

   OpenShell v0.0.115 adds OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. driver trace export, native Windows MXC compute, gateway identity in traces, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue./provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. attestations.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.0.115 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.115

   • Exports Kubernetes driver traces over OTLP, enabling distributed tracing pipelines to ingest OpenShell gateway activity.
   • Adds a native Windows MXC compute driver with full server wiring, extending supported compute platforms to Windows MXC.
   • Tags exported traces with gateway identity so multi-gateway deployments can filter and correlate traces per gateway.
   • Publishes OCI SBOM and provenance attestations alongside release artifacts for supply-chain verification.
   • Unifies the local Kubernetes gateway workflow, streamlining Kubernetes-backed development environments.

   5 details in Everything

8. v0.0.113 Aug 25, 2026 · issue 057

   OpenShell v0.0.113 adds OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. driver trace export for Docker and corporate CA trust for Podman sandbox HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxies.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.0.113 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.113

   • Exports Docker driver traces over OTLP, enabling distributed tracing of sandbox container operations.
   • Trusts corporate CA certificates for HTTPS proxies and intercepted TLS within Podman-backed sandboxes.

   2 details in Everything

9. v0.0.111 Aug 21, 2026 · issue 053

   OpenShell v0.0.111 adds transparent TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. egress, DNS correlation, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. driver traces, and standalone first-party compute drivers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.0.111 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.111

   • Adds policy DNS correlation store for network policy decisions in Docker and Podman sandboxes.
   • Enables transparent TCP egress and policy DNS enforcement for Docker and Podman runtimes.
   • Exports Podman driver traces over OTLP for observability into sandbox compute activity.
   • Establishes direct TCP egress foundation for policy-governed outbound connections.
   • Adds standalone first-party compute drivers for sandbox execution.

   +1 more show less

   • Adds a canonical main process to the sandbox runtime.

   6 details in Everything

10. v0.0.110 Aug 20, 2026 · issue 052

    OpenShell v0.0.110 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. device authorization for headless login, non-root sandbox identities, and persistent credential refresh in providers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.110 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.110

    • Supports OIDC device authorization grant flow for headless (browserless) login, enabling use in CI/CD and other non-interactive environments.
    • Allows non-root identities inside sandbox environments, expanding the range of workloads and privilege models that sandboxes can support.
    • Stores refresh credentials in credential drivers so providers can maintain long-lived credential sessions without re-authentication.

    3 details in Everything

11. v0.0.109 Aug 19, 2026 · issue 050

    OpenShell v0.0.109 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. AI inference event emission via the ai_operation profile on ApiActivity, bumping OCSF schema to v1.8.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.109 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.109

12. v0.0.106 Aug 14, 2026 · issue 046

    OpenShell v0.0.106 adds a complete Go SDK, a TypeScript SDK (@nvidia/openshell-sdk), and cert-manager external issuer with OpenShift passthrough Route support in Helm.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.106 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.106

    • Adds a complete Go SDK with domain clients, authentication, and hardening support.
    • Adds a TypeScript SDK published as @nvidia/openshell-sdk.
    • Adds cert-manager external issuer integration and OpenShift passthrough Route support to the Helm chart deployment.

    3 details in Everything

13. v0.0.105 Aug 13, 2026 · issue 045

    OpenShell v0.0.105 adds stop and start operations for sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.105 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.105

14. v0.0.104 Aug 12, 2026 · issue 043

    OpenShell v0.0.104 adds Windows compilation support, a credential-leak warning on --env, and a glibc-static supervisor variant.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.104 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.104

    • Adds a warning when --env values passed to the CLI look like credentials, helping catch accidental secret exposure at the command line.
    • Adds Windows compilation support for the gateway and CLI components.
    • Adds a glibc-static supervisor libc variant for environments that require static linking.

    3 details in Everything

15. v0.0.103 Aug 11, 2026 · issue 042

    OpenShell v0.0.103 adds static credential binding to proxy provider endpoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.103 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.103

16. v0.0.101 Aug 7, 2026 · issue 039

    OpenShell v0.0.101 adds credential driver targets and a VM driver built from GitHub sources via Bazel.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.101 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.101

    • Adds Bazel build targets for the credential driver, enabling it to be compiled as part of the standard build.

    1 detail in Everything

17. v0.0.99 Aug 5, 2026 · issue 037

    OpenShell v0.0.99 adds system CA root mode for sandboxes and honors OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image working directories, plus a TCP_NODELAY latency fix.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.99 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.99

    • Adds system CA root mode to the build, enabling sandboxes to trust the host's system certificate authorities.

    1 detail in Everything

18. v0.0.98 Aug 4, 2026 · issue 036

    OpenShell v0.0.98 adds OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. trace export from VM driver sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.98 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.98

    • Exports driver traces from VM-backed sandboxes over OTLP for observability into sandbox execution.

    1 detail in Everything

19. v0.0.97 Aug 3, 2026 · issue 035

    OpenShell v0.0.97 adds gateway callback listener negotiation for compute and a prototype Bazel build system.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.97 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.97

    • Adds gateway callback listener negotiation for the compute layer, enabling dynamic coordination between sandboxes and the gateway control plane.
    • Introduces a prototype Bazel build system, including OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. crate targets, for an alternative build path.

    2 details in Everything

20. v0.0.96 Jul 31, 2026 · issue 032

    OpenShell v0.0.96 adds supervisor middleware content guard, Kubernetes PVC storage class config, policy-first OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image identity, workspace authorization, and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. gateway tracing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.96 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.96

    • Adds supervisor middleware content guard example for filtering or inspecting sandbox traffic at the supervisor layer.
    • Supports configuring a custom storageClassName for workspace PVCs in Kubernetes deployments.
    • Introduces policy-first OCI image identity resolution in the sandbox, giving security policies priority in image evaluation.
    • Wires authorization checks into the workspace model, enabling access control enforcement at the workspace level.
    • Exports gateway traces over OTLP, enabling distributed tracing observability for gateway activity.

    5 details in Everything

21. v0.0.92 Jul 27, 2026 · issue 027

    OpenShell v0.0.92 adds JSON/YAML output for sandbox commands and corporate HTTP proxy egress routing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.92 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.92

    └──▷ TRY IT
    Pipe sandbox status into jq or other tooling by requesting JSON output — useful in CI pipelines or scripted workflows.
    copy

    $ openShell sandbox status --output json | jq '.state'

    Capture newly created sandbox details in YAML for audit logging or config-as-code workflows.
    copy

    $ openShell sandbox create --output yaml > sandbox-record.yaml

    • Adds --output json and --output yaml flags to sandbox get, sandbox status, and sandbox create commands for machine-readable output.
    • Supports routing sandbox egress traffic through a corporate HTTP proxy via the gateway.

    2 details in Everything

22. v0.0.90 Jul 23, 2026 · issue 023

    OpenShell v0.0.90 adds config key support to provider create/update forms in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.90 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.90

23. v0.0.88 Jul 21, 2026 · issue 021

    OpenShell v0.0.88 adds a workspace resource model with scoping and membership controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.88 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.88

24. v0.0.86 Jul 17, 2026 · issue 018

    OpenShell v0.0.86 adds AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. AssumeRole refresh, network egress middleware, and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. panel navigation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.86 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.86

    • Adds AWS STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. AssumeRole refresh strategy and aws-s3 profile support for cloud provider integrations.
    • Introduces supervisor middleware framework (RFC-0009) enabling extensible sandbox lifecycle hooks.
    • Adds network egress middleware via the supervisor middleware layer for controlling outbound sandbox traffic.
    • Enables Up/Down arrow key navigation across panels with overflow at list boundaries in the TUI.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The openshell policy prove command and Z3 dependency have been removed; any workflow or script invoking openshell policy prove will break.
25. v0.0.85 Jul 16, 2026 · issue 017

    OpenShell v0.0.85 adds elevated gateway info surfacing to the gateway component.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.85 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.85

26. v0.0.82 Jul 13, 2026 · issue 015

    OpenShell v0.0.82 adds Kubernetes sidecar supervisor topology and PVC subPath driver config support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.82 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.82

    • Adds sidecar supervisor topology for Kubernetes deployments, enabling a new deployment model for supervisor processes.
    • Supports PVC subPath in driver configuration for Kubernetes, allowing more granular persistent volume claim targeting.

    2 details in Everything

27. v0.0.76 Jul 3, 2026 · issue 014

    OpenShell v0.0.76 adds SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. bind-mount labels and numeric UID support in sandbox policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.76 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.76

    • Adds SELinux label support for bind mounts in Docker and Podman container runtimes.
    • Enables numeric UIDs (in addition to named users) when specifying sandbox process identity in policies.

    2 details in Everything

28. v0.0.75 Jul 2, 2026 · issue 014

    OpenShell v0.0.75 adds TLS termination for Envoy Gateway ingress and a new manifest-driven gator agent.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.75 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.75

    • Adds TLS termination support for Envoy Gateway ingress via Helm, enabling encrypted traffic handling at the ingress layer.
    • Introduces a manifest-driven gator agent, allowing agent behavior to be defined and driven through declarative manifests.

    2 details in Everything

29. v0.0.74 Jul 1, 2026 · issue 014

    OpenShell v0.0.74 adds a combined topology config surface for Kubernetes deployments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.74 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.74

    • Adds combined topology config surface for Kubernetes, enabling unified topology configuration in a single surface.
    • Breaking: removes SandboxTemplate.volume_claim_templates from the API — configurations referencing this field must be updated.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SandboxTemplate.volume_claim_templates field has been removed from the API
30. v0.0.72 Jun 29, 2026 · issue 014

    OpenShell v0.0.72 adds AWS SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. proxy signing, JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets./MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. policy enforcement, and Kubernetes agent-sandbox v1beta1 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.72 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.72

    • Adds proxy-side AWS SigV4 credential signing for CONNECT tunnels in sandbox environments.
    • Adds L7 policy enforcement for JSON-RPC and MCP traffic.
    • Supports Kubernetes agent-sandbox v1beta1 API.

    3 details in Everything

31. v0.0.71 Jun 26, 2026 · release notes

    OpenShell v0.0.71 adds support for out-of-tree compute drivers via a new server socket flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.71 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.71

    └──▷ TRY IT
    Load a custom or out-of-tree compute driver without rebuilding the server — useful when running non-standard GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. drivers in air-gapped or specialized environments.
    copy

    $ openshell-server --compute-driver-socket /path/to/custom-driver.sock

32. v0.0.69 Jun 24, 2026 · release notes

    OpenShell v0.0.69 adds AWS Bedrock as an inference provider, GCEGCEGoogle Compute Engine, Google's infrastructure-as-a-service platform for running virtual machines in the cloud; cyber tools use it for scalable, on-demand compute without managing physical hardware. metadata emulation, GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. count requests, and profile updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.69 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.69

    • Adds AWS Bedrock as a recognized inference provider in sandbox and provider configurations.
    • Adds a GCE metadata emulator for Google Cloud sandbox environments.
    • Supports provider profile updates.
    • Enables GPU count requests via the CLI.

    4 details in Everything

33. v0.0.65 Jun 17, 2026 · release notes

    OpenShell v0.0.65 adds TLS certificate hot-reload and DeepInfra as a built-in inference provider.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.65 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.65

    • Supports TLS certificate hot-reload on the server, eliminating restarts when rotating certificates.
    • Adds DeepInfra as a built-in inference provider, expanding the set of natively supported LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. backends.

    2 details in Everything

34. v0.0.62 Jun 12, 2026 · release notes

    OpenShell v0.0.62 adds HA multi-replica gateway support and system registry with source indicators.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.62 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.62

    • Adds reconciler lease to the gateway for high-availability multi-replica deployments.
    • Adds system registry support and source indicators to the gateway.

    2 details in Everything

35. v0.0.59 Jun 9, 2026 · release notes

    OpenShell v0.0.59 adds VM lifecycle extensions and an --env flag for sandbox environment variable injection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.59 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.59

    └──▷ TRY IT
    Inject environment variables into a sandbox at creation time — useful for passing secrets or runtime config without baking them into the image.
    copy

    $ openshell sandbox create --env MY_API_KEY=abc123 --env ENV=production <sandbox-name>

    Pass environment variables into a one-off exec inside a running sandbox, e.g. to parameterize a training run.
    copy

    $ openshell sandbox exec --env BATCH_SIZE=64 --env DEBUG=1 <sandbox-name> -- python train.py

    • Adds VM lifecycle extensions for managing virtual machine states.
    • New --env flag on sandbox create and sandbox exec commands enables passing environment variables into sandboxes.
    • Adds a generic output formatter across CLI commands, eliminating per-command --output flag duplication.

    3 details in Everything

36. v0.0.58 Jun 8, 2026 · release notes

    OpenShell v0.0.58 adds Kubernetes driver config passthrough, path-based auth style for providers, and local embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. routing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.58 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.58

    • Supports driver config passthrough for Kubernetes deployments.
    • Adds path auth style option for providers v2 configuration.
    • Enables local embeddings route for inference.

    3 details in Everything

37. v0.0.56 Jun 4, 2026 · release notes

    OpenShell v0.0.56 adds multi-file sandbox uploads, a default runtime class for K8s sandbox pods, and Hermes Agent support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.56 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.56

    └──▷ TRY IT
    Upload multiple files into a sandbox at creation time instead of running separate upload steps.
    copy

    $ openShell sandbox create --upload ./model.bin --upload ./config.yaml --upload ./secrets.env

    • Supports multiple --upload flags on sandbox create, enabling several files to be uploaded in a single command.
    • Adds default_runtime_class_name config option for the Kubernetes driver to set the runtime class on sandbox pods.
    • Adds Hermes Agent to the list of supported agents.

    3 details in Everything

38. v0.0.55 Jun 3, 2026 · release notes

    OpenShell v0.0.55 adds Google Vertex AI as an inference provider and introduces profile-backed policy visibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.55 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.55

    • Adds Google Vertex AI as a supported inference provider.
    • Introduces profile-backed policy visibility, enabling policy inspection tied to user profiles.

    2 details in Everything

39. v0.0.54 Jun 2, 2026 · release notes

    OpenShell v0.0.54 adds anonymous usage telemetry opt-out and Kubernetes sandbox image pull secret support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.54 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.54

    • Adds anonymous usage telemetry with an opt-out mechanism for OpenShell deployments.
    • Supports sandbox image pull secrets in Kubernetes deployments.

    2 details in Everything

40. v0.0.53 Jun 1, 2026 · release notes

    OpenShell v0.0.53 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Bearer auth for the Python SDK, an agentic approval loop for policies, multi-device PCIe passthrough, and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. pane scrolling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.53 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.53

    • Supports OIDC Bearer authentication on SandboxClient in the Python SDK.
    • Adds an agentic approval loop to the policy engine for human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. control over agent actions.
    • Generalizes PCIe passthrough crate to support multi-device configurations.
    • Adds PageUp/PageDown scrolling to all panes in the terminal UI.

    4 details in Everything

41. v0.0.52 May 29, 2026 · release notes

    OpenShell v0.0.52 adds optional PostgreSQL backing store via Helm and a Nix development shell.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.52 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.52

    • Adds optional PostgreSQL backing store configurable through the Helm chart.
    • Adds Nix development shell (flake) for reproducible dev environments.

    2 details in Everything

42. v0.0.51 May 28, 2026 · release notes

    OpenShell v0.0.51 adds Docker provisioning progress events, configurable sandbox nproc limits, and handler-level gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. auth enforcement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.51 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.51

    • Adds provisioning progress events for Docker sandboxes, giving visibility into container startup.
    • Declares gRPC authentication mode, scope, and role at the handler level and enforces them at the router.

    2 details in Everything

43. v0.0.48 May 25, 2026 · release notes

    OpenShell v0.0.48 adds automatic provider discovery derived from profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.48 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.48

44. v0.0.47 May 22, 2026 · release notes

    OpenShell v0.0.47 adds JSON/YAML output for gateway list and per-sandbox authentication to the gateway.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.47 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.47

    • Adds JSON and YAML output format options to the gateway list CLI command.
    • Adds JSON output format to the policy get CLI command.
    • Enables per-sandbox authentication to the gateway.

    3 details in Everything

45. v0.0.45 May 20, 2026 · release notes

    OpenShell v0.0.45 adds configurable workspace PVC storage size and LSM compatibility checks in agent skills.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.45 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.45

    • Adds configurable default workspace PVC storage size for Kubernetes deployments.
    • Adds LSM (Linux Security Module) compatibility checks to the review and spike agent skills.

    2 details in Everything

46. v0.0.44 May 19, 2026 · release notes

    OpenShell v0.0.44 adds JSON/YAML sandbox listing, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for Podman, nftables network policy, cert generation, and credential refresh foundation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.44 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.44

    └──▷ TRY IT
    Generate gateway TLS certificates during RPM-based deployment instead of running the old init-pki.sh script.
    copy

    $ openshell-gateway generate-certs

    • Adds -o json and -o yaml output format flags to sandbox list for machine-readable sandbox enumeration.
    • Introduces openshell-gateway generate-certs command, replacing the previous init-pki.sh script for certificate generation in RPM deployments.
    • Enables mTLS support for the Podman compute driver, securing compute node communication.
    • Replaces iptables with nftables for sandbox network policy enforcement.
    • Injects DENO_CERT into the sandbox child environment, enabling custom CA trust for Deno-based sandboxes.

    +2 more show less

    • Adds resource version compare-and-swap (CAS) support to the database layer.
    • Introduces credential refresh foundation for providers, enabling automated credential rotation.

    7 details in Everything

47. v0.0.43 May 18, 2026 · release notes

    OpenShell v0.0.43 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with./HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. separation, interactive TTY streaming, TOML config, and ext4 sandbox disks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.43 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.43

    • Separates HTTPS from mTLS authentication on the server, enabling independent configuration of each transport security mode.
    • Adds OIDC authentication support to the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., allowing users to authenticate via identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. from the terminal interface.
    • Adds bidirectional streaming for interactive TTY sessions in exec, enabling real interactive shell workflows.
    • Introduces a TOML configuration file for the gateway (RFC 0003), replacing or supplementing prior configuration methods.
    • Supports booting sandboxes from ext4 root disks in the VM layer, enabling persistent or custom disk-backed sandbox environments.

    5 details in Everything

48. v0.0.42 May 15, 2026 · release notes

    OpenShell v0.0.42 adds Podman socket fallback and drops the SSH handshake secret.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.42 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.42

    • Falls back to Podman socket automatically when Docker is unavailable, broadening container runtime support.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SSH handshake secret has been dropped (refactor!(auth): drop SSH handshake secret); any configuration or tooling that supplies or validates this secret will break on upgrade.
49. v0.0.41 May 14, 2026 · release notes

    OpenShell v0.0.41 adds agent-driven policy management, sandbox resource flags, and custom CA support for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. TLS.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.41 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.41

    • Adds agent-driven policy management, enabling the agent to participate in policy enforcement decisions.
    • Adds sandbox resource flags to the CLI for controlling resource allocation when creating sandboxes.
    • Supports custom CA certificates for OIDC issuer TLS verification in Helm deployments.

    3 details in Everything

50. v0.0.40 May 13, 2026 · release notes

    OpenShell v0.0.40 adds Kubernetes nodeSelector/toleration support and local-domain service routing in the gateway.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.40 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.40

    • Supports nodeSelector and tolerations configuration for Kubernetes deployments via platform_config.
    • Adds local-domain service routing in the gateway, enabling resolution and routing to cluster-local services.

    2 details in Everything

51. v0.0.39 May 12, 2026 · release notes

    OpenShell v0.0.39 adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. device-ID awareness in Docker/Podman, Kubernetes ImageVolumeSource sideload support, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. relay forwarding.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.39 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.39

    • Honors GPU device IDs in Docker and Podman container runtimes, enabling precise GPU assignment within containerized workloads.
    • Supports ImageVolumeSource for Kubernetes supervisor sideload, broadening how supervisor images can be delivered in k8s environments.
    • Adds TCP route forwarding via ForwardTcp in the relay layer, enabling new network-tunneling use cases.

    3 details in Everything

52. v0.0.38 May 11, 2026 · release notes

    OpenShell v0.0.38 adds agent-driven policy management MVP, Snap package support, and Kubernetes service-account token hardening.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.38 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.38

    • Adds agent-driven policy management MVP, enabling automated policy control through the OpenShell agent.
    • Adds early Snap package support, extending installation options to Snap-managed environments.
    • Disables service account token auto-mounting in the Kubernetes driver, reducing the default credential exposure of OpenShell pods.

    3 details in Everything

53. v0.0.37 May 8, 2026 · release notes

    OpenShell v0.0.37 adds pluggable compute drivers (Docker, Podman, Kubernetes, MicroVM/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware.), OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. auth, GraphQL L7 policy inspection, CDI GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. sandboxes, Helm chart, and Debian/RPM/Homebrew packaging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.37 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.37

    └──▷ TRY IT
    Install v0.0.37 fresh (or after destroying the old gateway) to get the new system-service-managed gateway with pluggable drivers.
    copy

    $ curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.37 sh

    Before upgrading from v0.0.36, clean up incompatible gateway state to avoid data loss.
    copy

    $ openshell sandbox delete --all && openshell gateway destroy

    • Adds pluggable compute drivers for Docker, Podman, Kubernetes, and experimental MicroVM-backed sandboxes (RFC-0001 implementation).
    • Adds QEMU VM driver with GPU pass-through support for MicroVM sandboxes.
    • Adds OIDC/Keycloak authentication with RBAC and scope-based permissions for gateway access control.
    • Adds CDI GPU sandboxes via the Docker compute driver.
    • Adds Prometheus metrics infrastructure with gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. and HTTP request metrics.

    +8 more show less

    • Adds auto-detection of compute driver at gateway startup.
    • Adds initial provider profiles and sandbox-provider attach lifecycle.
    • Introduces an experimental Helm chart for Kubernetes and OpenShift deployments.
    • Adds Debian package publishing; expands RPM and Homebrew packaging.
    • Adopts Kubernetes-style object metadata and labels as the shared entity schema for sandboxes, providers, SSH sessions, and policies.
    • Adds TTY support for exec in the VM driver.
    • Adds guest rootfs derived from sandbox images in the VM driver.
    • Gateway service is now managed as a system service via the package manager instead of CLI commands.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The openshell gateway start|stop|destroy commands no longer exist; existing gateway state from v0.0.36 or earlier is incompatible and must be destroyed before upgrading.
    • !Public protobuf shapes for core resources (sandboxes, providers, SSH sessions) have changed; existing clients and gateway instances must be recreated.
    • !Policy and draft policy recommendations are now stored in the unified objects table instead of dedicated policy tables; policies must be reconfigured after upgrade.
    • !Gateway persistence now uses a shared entity schema with Kubernetes-style metadata and labels, replacing the previous schema; existing gateway state is not forward-compatible.
54. v0.0.36 Apr 23, 2026 · release notes

    OpenShell v0.0.36 adds disabling health check listener, configurable image transfer timeout, and gateway-owned readiness with VM compute driver E2E.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.36 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.36

    • Adds option to disable the health check listener on the server.
    • Adds configurable timeout for image transfer to gateway containerd.
    • Adds gateway-owned readiness signaling and VM compute driver end-to-end support.

    3 details in Everything

55. v0.0.35 Apr 22, 2026 · release notes

    OpenShell v0.0.35 adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.-multiplexed SSH relay, request-level tracing, and a dedicated unauthenticated health-check port.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.35 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.35

    • Adds supervisor-initiated SSH connect and exec tunneled over a gRPC-multiplexed relay between server and sandbox.
    • Adds request-level logging via TraceLayer on the server for per-request observability.
    • Serves health endpoints on a separate, unauthenticated port so load balancers and orchestrators can probe liveness/readiness without credentials.

    3 details in Everything

56. v0.0.34 Apr 21, 2026 · release notes

    OpenShell v0.0.34 adds incremental sandbox policy updates and VM driver installation with directory resolution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.34 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.34

    └──▷ TRY IT
    Install the OpenShell gateway and VM driver with a custom driver directory during VM setup.
    copy

    $ OPENSHELL_VERSION=v0.0.34 sh install.sh install-vm --driver-dir <path>

    • Supports incremental sandbox policy updates, enabling partial policy changes without full redeployment.
    • Adds gateway and VM driver installation via install-vm, with --driver-dir flag for custom driver directory resolution.

    2 details in Everything

57. v0.0.33 Apr 20, 2026 · release notes

    OpenShell v0.0.33 adds a standalone libkrun compute driver for VM-based sandbox execution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.33 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.33

58. v0.0.32 Apr 17, 2026 · release notes

    OpenShell v0.0.32 adds system CA certificate support for upstream TLS and standalone gateway binaries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.32 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.32

    • Loads system CA certificates for upstream TLS connections in sandbox environments, enabling trust of enterprise/internal CAs without manual config.
    • Publishes standalone openshell-gateway binaries for direct download and deployment without a full install.

    2 details in Everything

59. v0.0.30 Apr 15, 2026 · release notes

    OpenShell v0.0.30 adds deny rules to the network policy schema for sandbox environments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.30 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.30

60. v0.0.26 Apr 9, 2026 · release notes

    OpenShell v0.0.26 adds a libkrun microVM gateway crate for VM-based execution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.26 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.26

61. v0.0.25 Apr 8, 2026 · release notes

    OpenShell v0.0.25 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. structured logging for sandbox events.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.25 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.25

62. v0.0.23 Apr 6, 2026 · release notes

    OpenShell v0.0.23 adds a sandbox exec subcommand with TTY support for interactive shell sessions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.23 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.23

63. v0.0.22 Apr 3, 2026 · release notes

    OpenShell v0.0.22 adds gateway state persistence and SSH handshake secret resumption across stop/start cycles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.22 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.22

64. v0.0.20 Apr 1, 2026 · release notes

    OpenShell v0.0.20 switches GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. injection to CDI and extends L7 credential injection to query params, Basic auth, and URL paths.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.20 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.20

    • Switches GPU injection to CDI (Container Device Interface) where supported, in both bootstrap/CLI and sandbox device plugin modes.
    • Extends L7 credential injection to cover query parameters, HTTP Basic auth, and URL paths — broadening credential forwarding beyond headers alone.

    2 details in Everything

65. v0.0.19 Mar 31, 2026 · release notes

    OpenShell v0.0.19 adds L7 query parameter matchers, custom inference timeouts, and streaming SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. identity resolution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.19 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.19

    • Adds L7 query parameter matchers in the sandbox for fine-grained request filtering based on URL query strings.
    • Enables setting a custom inference timeout for inference workloads.
    • Introduces streaming SHA256 hashing and non-blocking spawn for identity resolution, improving performance at scale.

    3 details in Everything

66. v0.0.16 Mar 25, 2026 · release notes

    OpenShell v0.0.16 adds a dedicated cluster:gpu task to manage GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. cluster operations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.16 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.16

    └──▷ USE IT
    Execute GPU-specific tasks within an OpenShell cluster environment.
    shell copy

    openshell run cluster:gpu

    Run end-to-end tests that leverage the new GPU task infrastructure.
    shell copy

    openshell run e2e:gpu

    • feat(tasks): add cluster:gpu task and wire e2e:gpu to use it

    1 detail in Everything

67. v0.0.15 Mar 24, 2026 · release notes

    OpenShell v0.0.15 adds automatic TLS detection with unconditional termination for credential injection in sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.15 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.15

    • Auto-detects TLS and terminates it unconditionally for credential injection in sandbox environments.

    1 detail in Everything

68. v0.0.13 Mar 21, 2026 · release notes

    OpenShell v0.0.13 adds GitHub Copilot CLI agent provider, standalone OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. event library, and a gateway-to-sandbox runtime settings channel.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.13 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.13

    • Adds GitHub Copilot CLI as an agent provider, enabling Copilot-backed shell interactions.
    • Introduces the openshell-ocsf crate — a standalone library of OCSF event types, formatters, and tracing layers for structured security telemetry.
    • Adds a gateway-to-sandbox runtime settings channel, enabling live configuration updates to sandboxes without restart.
    • Disables NFD/GFD and removes nodeAffinity from the device plugin chart, simplifying GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. node configuration.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The UpdateSettings RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. is renamed to UpdateConfig — any client or automation calling UpdateSettings will break.
    • !The pod_template field is removed from the CreateSandbox RPC — any client passing this field will break.
69. v0.0.11 Mar 19, 2026 · release notes

    OpenShell v0.0.11 adds OPENSHELL_NO_BROWSER env var to suppress browser popups during authentication

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.11 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.11

    └──▷ USE IT
    Run CLI authentication in headless or non-interactive environments without opening a web browser.
    shell copy

    OPENSHELL_NO_BROWSER=1 openshell auth

    • Add OPENSHELL_NO_BROWSER environment variable to suppress browser popup during auth

    1 detail in Everything

70. v0.0.8 Mar 17, 2026 · release notes

    OpenShell v0.0.8 adds host wildcards and multi-port endpoint support in policy definitions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.8 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.8

    • Supports host wildcards and multi-port endpoints in policy configuration, enabling broader and more flexible access rules.

    1 detail in Everything

71. v0.0.7 Mar 17, 2026 · release notes

    OpenShell v0.0.7 adds host wildcard and multi-port endpoint support in policy definitions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.7 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.7

    • Supports host wildcards and multi-port endpoints in policy rules, enabling broader and more flexible access control expressions.

    1 detail in Everything