OpenShell v0.1.6

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.6 sh

Upgrade notes

• Gateways now refuse to start unless OIDC, mTLS user or operator authentication, or gateway JWTs are configured. For trusted local development only, set allow_unauthenticated_users = true under [openshell.gateway.auth]. #4821
• New sandboxes on Kubernetes, Docker, Podman, and VM now open the control connection from the sandbox to its supervisor, while running sandboxes keep their existing connection direction. Upgrade the supervisor and sandbox runtime binaries together, because older binaries reject the new sandboxes. #4656
• You can now suspend and resume sandboxes with openshell sandbox suspend and openshell sandbox resume or through the SDKs, on compute drivers that support it; other drivers return an unimplemented error. External isolation backends need to know that ResumeBoundaryRequest field 3 is renamed from allow_cold_start_fallback to restart_if_restore_fails. #4765

Bug fixes

• The Python SDK now ships the credential driver and extension protocol bindings, so you can write credential drivers in Python. #4760
• The Go SDK now accepts gateway names derived from FQDNs and IPv4 addresses, as the CLI creates them, and still rejects names that aren't safe as Windows filenames. #4767
• A busy sandbox no longer stalls lifecycle operations on unrelated sandboxes while the gateway checks provisioning deadlines. #4549
• VM sandboxes boot digest-pinned images straight from the local cache without contacting the registry, so they start faster and still boot when the registry is unreachable. #4582
• VM sandboxes built from images with a missing or empty /etc/hosts now resolve localhost. #4182
• The Podman driver now waits up to 60 seconds instead of 30 for API calls, which reduces timeouts during sandbox creation. #4820
• install.sh now finds the gateway config directory under XDG_CONFIG_HOME the same way the CLI does, so local gateway setup no longer times out when that variable is set. #4063
• The snap now provides the openshell-prover command like other packages, replacing openshell.prover. #4835
• Updated webpki to stop trusting the compromised emSign certificate authorities (CVE-2026-111943). #4794
• Updated russh to 0.64.1 to fix GHSA-4wc5-f2rc-q74m (CVE-2026-111061). #4742
• Updated Tokio and crypto-bigint to fix RUSTSEC-2026-0386 and RUSTSEC-2026-0387. #4924
• Updated ctutils to fix the RUSTSEC-2026-0385 timing advisory. #4867
• The multi-agent shared-notepad example now launches on the current CLI. #4807

Features

• Kubernetes gateways can run an experimental shared supervisor that hosts many sandboxes in one process. Enable it with supervisor_topology = "gateway" under [openshell.drivers.kubernetes] (gateway TLS is required), and on OpenShift use supervisor.podSecurityContext so restricted-v2 can assign the IDs. #4695, #4701, #4702, #4785
• Experimental shared supervisors always run as a pool that can take over a failed supervisor's sandboxes; set supervisor.replicas to change capacity, and note that one replica has no spare for immediate failover. During takeover, workloads can briefly freeze, existing proxied connections and interactive sessions must reconnect, and workloads terminate if supervision isn't restored within the recovery deadline. #4864
• The gateway now writes OCSF audit events for authorization denials, accepted credentials, SSH session tokens, and sandbox token checks, and raises a High-severity finding when a sandbox credential looks misused. Callers see the same errors as before. #4728, #4761, #4762
• Operators can require a middleware service to provide specific bindings, such as request inspection, by setting binding_policy to allowlist or exact. Upgrade supervisors before you rely on it, because older supervisors don't enforce it. #4678
• Prerelease builds now publish to the snap's latest/beta channel, and OPENSHELL_VERSION=pre install.sh installs the snap from there. #4870
• The Helm chart adds server.extraEnv for passing extra environment variables, including Secret references, to the gateway container. #4876
• The Helm chart adds pkiInitJob.podLabels and pkiInitJob.podAnnotations for the certificate hook pods. #4895
• Stable releases now tag the Go SDK module as sdk/go/vX.Y.Z, so Go tooling and pkg.go.dev show real versions. #4262

Other

• The Docker supervisor healthcheck now runs every 30 seconds once the sandbox is ready, rather than every 250 ms. #4802
• The CLI now connects to gateways through the shared Rust SDK transport. #4817
• Native Windows documentation now identifies windows as its implementation and release branch and explains the current build and runtime limitations. #4758
• Added a guide for connecting an external compute driver to a gateway. #4826
• Added a security policy that uses GitHub private vulnerability reporting, with a report template and advisory authoring workflows. #4832, #4872
• sandbox create --upload help and docs now say it can't take a trailing command; use sandbox exec instead. #4502
• Updated workload image docs: images no longer need iproute2 or nftables, and images without USER run as UID/GID 1000 on Docker and Podman. #3967
• Fixed the OpenRouter provider smoke test so it prints a result. #3907
• Added RFC 0018 on multi-sandbox and highly available supervisors. #4377
• Removed the obsolete privileged SCC grant from the OpenShift e2e setup. #4823
• Native gateway builds on macOS raise the open-file limit to avoid "Too many open files" errors. #3122
• Added the testkit library for SDK-driven end-to-end tests. #4724
• Moved tmachine support files under tests/tmachine. #4726
• Consolidated gateway audit helpers and test fixtures. #4777, #4778
• Repaired the Windows MSVC test suite. #4862
• Fixed a flaky CLI port-forward test. #4799
• Removed the unused openshell-server-macros crate. #4818
• Added a release-captain skill for the weekly release cadence. #4435
• Release and Pre-release workflows can now infer their tags from the branch. #4707
• Stable releases reuse the release notes previewed on the promoted prerelease. #4754
• Allowed the accepted protobuf compatibility breaks for v0.1.6 prerelease qualification. #4976
• The compatibility review now checks executable flags that external compute drivers use. #4644
• Switched the compatibility review to GPT-6.1 Sol. #4796
• Kept Rust CI caches warm on main and stopped saving binary caches from branches. #4881
• Updated the rust-cache action. #4748
• Updated the setup-buildx action to v4.4.1. #4741
• Added cargo-deny exceptions for zstd advisories that don't affect current usage. #4973
• Updated setuptools and Vitest to patched releases. #4969
• Updated Vite in the TypeScript SDK to 8.1.6. #4792
• Updated certifi to 2026.10.19. #4764
• Updated Mermaid lint dependencies. [#4743](https://github.com/NVI...

This build is automatically published on every commit to main that passes CI.

NOTE: This is a development build, not a tagged release, and may be unstable.

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=dev sh

OpenShell v0.1.5

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.5 sh

Upgrade notes

• Supervisor OCSF log files are now named openshell-ocsf.YYYY-MM-DD.jsonl instead of .log, so update any collector patterns from openshell-ocsf.*.log to openshell-ocsf.*.jsonl. Old .log files are not migrated and may be cleaned up, so collect any history you need before upgrading. #4263
• On Kubernetes, sandbox templates that set pod annotations or labels are now rejected unless an operator allowlists those keys with the new allowed_pod_annotations and allowed_pod_labels settings in [openshell.drivers.kubernetes]. This affects direct API or SDK callers that set SandboxTemplate.labels or SandboxTemplate.annotations, including recovery of timed-out sandboxes; the openshell CLI and --label metadata labels are unaffected. #4497
• The gateway now rejects annotation keys with the reserved internal.openshell.ai/ prefix on CreateSandbox and UpdateConfig. #4626
• The Go SDK's SandboxInterface.Create() and CreateFromTemplate() now take functional options such as WithLabels(), WithAnnotations(), and WithServiceExposures() instead of a positional labels argument and the removed CreateOptions struct. Update call sites to the new options. #3198
• External compute drivers that provision openshell-sandbox must update their bootstrap descriptor from outer_fence to provisioning_evidence; drivers that use their own isolation backend are unaffected. This release also publishes the versioned Sandbox Protocol for independently implemented backends. #3898
• The snap no longer enables the user gateway service for every user; the install script enables it only for the user who ran it. After a direct snap install, or if an older snap revision enabled it globally, run sudo systemctl disable --global snap.openshell.user-gateway.service once and then systemctl --user enable --now snap.openshell.user-gateway.service from the single account that should run the gateway. #4615

Bug fixes

• Hostname-based network policy is now bound to supervisor-controlled DNS, while sandbox host aliases still require explicit IP validation or a trusted gateway pin. #4602
• Stopping a MicroVM sandbox no longer discards recent writes, because the guest now flushes its filesystem before shutdown. #4195
• You can now stop a sandbox stuck in Error after a startup failure and start it again, without deleting it or its persistent workspace. #4231
• OTLP export with gzip compression or an https:// endpoint no longer fails at startup. #4399
• Podman deployments can trust a private CA for inspected HTTPS egress with the new additional_ca_bundle setting, without rebuilding the supervisor image. The CA is trusted for all destinations by both the supervisor and the workload. #3996
• The Helm chart now installs in namespaces that enforce the Restricted Pod Security standard, and the certgen hook security context can be overridden with pkiInitJob.securityContext. #3340
• GitHub App OAuth token refresh now works, because the gateway asks for a JSON response. #4530
• A deleted provider that sandboxes still reference no longer blocks gateway startup; the gateway logs a warning instead. #4661
• In Kubernetes operator workspace mode, labeled workspaces are no longer rejected with PermissionDenied right after gateway startup. #4527
• Kubernetes PVC mounts can no longer overlap driver-managed runtime and control paths. #4522
• The sandbox network broker now denies operations when it cannot verify a descriptor, instead of falling back to native handling. #4494
• VM guest startup is hardened so the packaged sandbox keeps its expected executable identity. #4539
• Seccomp notification probe failures now report the actual kernel error instead of a generic "notification launcher disappeared" message. #4051
• e2fsprogs preflight checks no longer fail when Linux briefly reports a newly installed executable as busy. #4315
• Middleware now sees http and ws for plaintext requests in a tunnel instead of https and wss. #4397
• L7 OCSF HTTP events now report https for TLS-terminated requests. #4684
• OCSF events now include the required device.os.type_id, so they validate against the OCSF 1.8 schema. #4677
• Mutation-lock metrics from the gateway's startup reconciliation are no longer dropped. #4524
• Updated rustls to 0.23.46 to address RUSTSEC-2026-0346 through RUSTSEC-2026-0349. #4568
• The RPM-installed Python SDK now imports correctly, and its stubs can be generated with older protoc versions. #4439
• Builds now honor the PROTOC environment variable, so distribution builds can use their system protobuf compiler. #4441

Features

• Supervisors can now receive configuration changes pushed over their gateway session by setting config_delivery_mode = "push", so policy and setting changes reach sandboxes in about 100 ms instead of up to 10 seconds. Polling remains the default in this release. #4320
• The gateway and sandbox supervisors can export OCSF events as OTLP log records when [openshell.gateway.otlp.ocsf] sets enabled = true, and you can now send traces and OCSF events to different OTLP endpoints. Existing configurations with only [openshell.gateway.otlp] endpoint behave as before. #4500, #4545
• The gateway now emits OCSF Authentication events for rejected requests, including the authentication mechanism, a reason category, the peer address, and the request ID. #4632, #4655, #4673
• MicroVM sandboxes can mount host directories through virtiofs after an operator sets enable_bind_mounts = true in [openshell.drivers.vm]. You can use up to 3 mounts on x86_64 or 32 on aarch64, and QEMU-backed and GPU launches do not support mounts. #3463
• The Docker supervisor can now use bridge networking with the new supervisor_network_mode setting; host networking remains the default. #4016
• openshell sandbox create now accepts repeatable --annotation KEY=VALUE flags. #4325
• openshell sandbox create adds --env-from KEY[=ENVVAR] to set sandbox environment variables from the CLI's environment without putting values on the command line. The OPENSHELL_OCSF_JSON=1 gateway audit sink is also now available on all platforms. #4106
• When a dynamic token grant is refused, sandbox reads now show a bounded cause and recovery action, while the workload gets an HTTP 502 with an x-openshell-request-id it can share. #4427
• The Helm chart adds server.dataStorageSize and server.dataStorageClass to configure the gateway data PVC. #3854
• Gateway mutation locks are now scoped per workspace and sandbox, with bounded waits, so bursts of supervisor reconnects no longer queue behind a single fleet-wide lock. #4147

Other

• Added documentation for the Port Forwarding IPv6 loopback example, sandbox create size limits, Kubernetes managed workspace setup, and new Observability overview and Traces pages. #2449, #4447, #4622, #4560
• Removed the grpcurl walkthrough from the README. #4585
• Added an RFC that proposes a sandbox service exposure architecture. #4267
• Introduced a backend-neutral cryptography interface while keeping AWS-LC as the production backend and preserving existing credential formats and TLS defaults. #3351
• The CLI and gateway no longer link ring alongside AWS-LC. #4468
• Sped up gateway server builds by removing async_trait from internal traits. #4619
• Updated development and build dependencies, including setuptools, pytest, TypeScript SDK tes...

OpenShell v0.1.4

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.4 sh

What's Changed

• feat(snap): run gateway as a user service by default by @olivercalder in #4099
• chore(test-guest): remove snap reproduction helper by @elezar in #4368
• fix(ci): publish merge queue E2E statuses by @elezar in #4370
• chore(deps): bump mermaid from 11.16.0 to 11.16.1 in /scripts/lint-mermaid by @dependabot[bot] in #4369
• feat(server): add operator-only provider credential retrieval by @sjenning in #4357
• feat(ci): gate merges on maintainer approval via a required status check by @purp in #3176
• test(tmachine): use K3s ClusterIP, wait for gateway, add failure diagnostics by @matthewgrossman in #4258
• fix(core): resolve credential aliases after revision eviction by @stevenlee-oai in #4390
• refactor(runtime): confine and reduce unsafe code by @drew in #4130
• fix(cli): name the sandbox in service not-found errors by @ericcurtin in #3798
• feat(gateway): add gRPC server reflection by @2000krysztof in #3161
• test(conformance): run driver suites with cargo by @elezar in #3866
• feat(providers): support stable credential placeholders by @shiju-nv in #3339
• fix(gator): surface PR-owned security regressions in reviews by @johntmyers in #4338
• feat(sdk/ts): add createdAtMs to SandboxRef by @ericcurtin in #4347
• fix(server): retry stop lifecycle writes after concurrent updates by @pimlock in #4395
• fix(docs): use lowercase "snap" as it is not a proper noun by @olivercalder in #4387
• feat(python): expose sandbox status conditions in the SDK by @maxdubrinsky in #4436
• fix(python): close client when Sandbox entry fails by @ericcurtin in #4367
• fix(network): enforce consistent HTTP framing by @alangou in #4414
• docs: clarify vouch timing, DCO vs signing, Cargo feature conventions by @politerealism in #2810
• fix(sandbox): name Landlock ABI in startup error by @ericcurtin in #4413
• fix(server): return SQLite write versions atomically by @ericcurtin in #4408
• fix(cli): disable ssh connection sharing for sandbox sessions by @ericcurtin in #4157
• fix(cli): preserve external TLS for SSH forwarding by @danehans in #4344
• fix(kubernetes): refresh sandbox runtime image on start by @lunarwhite in #4376
• docs(runtimes): show required schema version in gateway TOML examples by @fede-kamel in #3910
• docs(extensibility): name extension base capabilities by @ericcurtin in #4405
• test(tmachine): add a K3s HA conformance lane with PostgreSQL and mTLS by @matthewgrossman in #4081
• chore(ci): close stale issues after 14 additional days by @purp in #3985
• chore(codeowners): disable wildcard ownership rule by @purp in #3168
• test(vm): avoid inherited lease race in restart cleanup test by @grs in #4316
• fix(windows): restore MSVC lint for CLI and MXC by @feloy in #4194
• chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 by @dependabot[bot] in #2767
• feat(sdk-ts): add watchLogs with loss-aware resume by @letv1nnn in #3778
• fix(server): audit proposal rejections in the gateway by @ericcurtin in #4281
• test(e2e): remove stale policy retries by @TaylorMutch in #4453
• ci: require accepted issues for community pull requests by @elezar in #4340
• refactor(vm): source runtime pins only from pins.env by @benoitf in #4373
• fix(release): qualify prerelease tag pushes by @SDAChess in #4335
• test(oci): add a shared Docker and Podman suite for image USER and WORKDIR by @matthewgrossman in #3931
• fix(kubernetes): time out kube requests per request instead of per idle connection by @matthewgrossman in #4452
• fix(prover): distinguish sibling endpoints and fail closed on solver errors by @alangou in #4326
• fix(vm): bind cached registry images to verified manifest digests by @alangou in #4342
• test(podman): run the e2e binaries that pass in the tmachine guest by @politerealism in #4422
• refactor(prover): remove legacy unused reachability constraints by @eviehoward in #2441
• fix(cli): backpressure sandbox uploads by @shiju-nv in #4448
• ci(security): temporarily remove Codex from release scans by @alangou in #4469
• fix(sandbox): release broker-owned listening sockets by @johntmyers in #4444
• feat(providers): add CLI label creation and filtering by @johntmyers in #4265
• refactor(prover): separate outcome evaluation from rendering by @eviehoward in #2632
• fix(sdk-ts): preserve rpc errors for out-of-range responses by @SDAChess in #4495
• ci(compatibility): review PR breaks and acknowledge release risks by @SDAChess in #4488
• fix(ci): skip maintainer approval in merge queue by @purp in #4496

New Contributors

• @stevenlee-oai made their first contribution in #4390

Full Changelog: v0.1.3...v0.1.4

OpenShell v0.1.3

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.3 sh

What's Changed

• feat(helm): make cluster-scoped RBAC optional by @ansjindal in #3459
• fix(supervisor): keep session retries during startup by @drew in #3765
• fix(e2e): reserve distinct corporate proxy fixture ports by @drew in #3761
• test(cli): migrate gateway-free smoke coverage by @elezar in #3641
• test(conformance): migrate file transfer coverage by @elezar in #3597
• fix(server): retry provider attachment CAS conflicts by @drew in #3501
• test(e2e): run podman suite with tmachine by @elezar in #3637
• fix(network): refuse protocol upgrades on JSON-RPC and MCP endpoints by @shiju-nv in #3753
• feat(cli): detach sandbox sessions with Ctrl-D by @drew in #3744
• fix(cli): prevent orphaned SSH forward muxes by @drew in #3759
• test(install): support Bash 3.2 mock capture by @elezar in #3790
• feat(mcp): inspect requests with Tower-selected protocol profiles by @shiju-nv in #3335
• feat(sandbox): add main restart policy by @drew in #2798
• perf(kubernetes): use a TCP readiness probe for the supervisor by @FrostGod in #3700
• feat(docker): support corporate proxy CA bundles by @feloy in #3549
• fix(e2e): stop sandbox leaks from async Drop cleanup by @ericcurtin in #3750
• fix(cli): keep policy and provider diagnostics readable by @shiju-nv in #3444
• feat(server): write gateway OCSF events to JSONL by @krishicks in #3264
• test(sandbox): bind ephemeral port in accepted loopback stream test by @krishicks in #3872
• fix(network): preserve pipelined requests after chunked inspection by @shiju-nv in #3861
• docs: remove the architecture directory by @krishicks in #3799
• fix(ci): restore repository permission vetters by @pimlock in #3875
• feat(helm): configure gateway OCSF JSONL output by @krishicks in #3876
• fix(supervisor): restore canonical stdin after connection loss by @shiju-nv in #3852
• fix(mcp): explain revision-scoped policy and rejections by @shiju-nv in #3850
• feat(providers): add Oracle Cloud Infrastructure Generative AI provider profile by @fede-kamel in #3904
• feat(providers): serve sandbox config files on demand by @drew in #3832
• fix(policy): validate raw OPA settings and redact startup errors by @shiju-nv in #3788
• Fix/startup provider readiness by @ebusto in #3819
• test(podman): move podman_preflight into driver-podman integration tests by @politerealism in #3783
• fix(conformance): require successful list to certify deletion by @elezar in #3792
• test(tmachine): add K3s conformance scenario by @SDAChess in #3848
• perf(otel): stop exporting spans from steady-state polling by @krishicks in #3915
• fix(cli): accept sandbox name before -- in exec by @ericcurtin in #3901
• fix(network): refuse protocol upgrades on GraphQL endpoints by @shiju-nv in #3841
• feat(service): add bearer authorization passthrough by @derekwaynecarr in #3796
• fix(server): log polled request responses at debug by @krishicks in #3974
• refactor(sandbox): remove unreachable root-side identity and workspace code by @matthewgrossman in #3979
• fix(e2e): keep locally built Kubernetes images off the chart's default registry by @krishicks in #3991
• fix(gator): require full head SHA for /ok to test by @purp in #4007
• fix(gateway): delete finalized ephemeral sandboxes while connected by @johntmyers in #3984
• refactor(auth): separate sandbox identity from TLS by @drew in #3110
• chore(build): remove bundled Z3 support by @SDAChess in #3275
• fix(runtime): recover SSH relays and bound startup diagnostics by @drew in #4011
• fix(ci): align integration inputs with release candidate source by @SDAChess in #4048
• test(e2e): remove schema parity campaign by @elezar in #3864
• fix(ci): qualify protobuf compatibility by release train by @SDAChess in #4049
• feat(flake): Add missing packages to flake for running mise commands by @bornav in #2151
• test(tmachine): add Fedora RPM package installer by @elezar in #4025
• ci: use package installers consistently in integration tests by @elezar in #4056
• fix(snap): simplify snap hooks by @olivercalder in #3988
• fix(supervisor): wait for repair when the gateway refuses a startup policy write by @shiju-nv in #3785
• fix(cli): start sandbox exec without waiting for piped stdin EOF by @fede-kamel in #4006
• chore(agents): simplify contributor instructions and workflows by @johntmyers in #3987
• fix(supervisor): bound pending exec stdin and cancel stalled writers by @shiju-nv in #3846
• fix(policy): refresh pending proposals when the sandbox policy changes by @fede-kamel in #3923
• feat(sandbox): write agent output to the container log by @krishicks in #4005
• chore(gator): default to GPT-6.1 Sol by @johntmyers in #4065
• feat(examples): run Jupyter notebooks in an OpenShell sandbox by @drew in #2253
• test(python): synchronize interactive exec TTY readiness by @matthewgrossman in #4076
• fix(sandbox): restrict provider file mode by @drew in #4093
• fix(ci): retry Nix shell and app dependency preparation by @matthewgrossman in #4066
• feat(snap): ship the standalone prover binary in the snap by @olivercalder in #3717
• fix(kubernetes): serialize lifecycle cleanup with sandbox restart by @matthewgrossman in #4078
• fix(deps): upgrade russh to address Dependabot alert 40 by @alangou in #4116
• fix(cli)!: stop uploads when Git filtering fails or selects no files by @alangou in #3957
• fix(providers): restore supervisor-backed GCP metadata discovery by @feloy in #3973
• feat(helm): add sandbox UID and GID values by @ericcurtin in #3947
• ci(vm): codesign macOS driver-vm with hypervisor entitlement in CI by @benoitf in #3507
• ci: pin CI images by digest and add native architecture smoke checks by @alangou in #4114
• fix(providers): stabilize provider environment revisions by @drew in #4122
• fix(deps): upgrade ratatui to resolve lru vulnerability by @alangou in #4131
• fix(sandbox): replace lifetime exec cap with retry deadlines by @drew in #4105
• fix(cli): check final exec status and warn on partial input by @shiju-nv in #3803
• fix(install): stop waiting when the gateway service fails by @ericcurtin in #4143
• fix(docker): pull only :latest for a tagless --from, not every tag by @udsy19 in #4124
• fix(vm): reject conflicting workload identity selectors by @shiju-nv in #4036
• fix(vm): reclaim cancelled image preparation after worker exit by @shiju-nv in #4039
• feat(gateway): check VM host tools during config preflight by @shiju-nv in #4037
• fix(relay): close outbound relay stream when target closes first by @ericcurtin in #3772
• fix(tui): preserve quoted post-create command arguments by @thotashashank302 in #4137
• fix(gateway): give image prep...

OpenShell v0.1.2

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.2 sh

What's Changed

• docs(policy): clarify sandbox-local loopback access by @drew in #3740
• docs: refresh architecture and extensibility pages by @drew in #3741
• fix(supervisor-network): keep workload bytes read with a mediated CONNECT header by @dims in #3745
• fix(homebrew): overwrite generated gateway config during migration by @drew in #3752
• fix(ci): keep snap canary sandbox name within limit by @drew in #3751
• fix(docs): sync redirects with versioned snapshots by @johnnygreco in #3754
• docs: keep page URLs aligned with file paths by @johnnygreco in #3713
• perf(sandbox): wake orphan reaper on child exit by @drew in #3757

Full Changelog: v0.1.1...v0.1.2

OpenShell v0.1.1

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.1 sh

What's Changed

• fix(gateway): make the WebSocket tunnel opt-in by @drew in #3727
• test(binary-identity): stabilize procfs identity fixtures by @grs in #3708
• docs(tutorials): run Pi with OpenRouter by @johnnygreco in #3722
• fix(snap): require mTLS for the snap gateway by @drew in #3726
• docs: describe 0.1 series in release callouts by @drew in #3732

Full Changelog: v0.1.0...v0.1.1

OpenShell v0.1.0

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.0 sh

What's Changed

• ci(codeql): run nightly scans on main by @alangou in #3007
• feat!(ci): remove daily minor release automatic workflow by @SDAChess in #3008
• fix(kubernetes): recover compute driver watches by @jhjaggars in #2842
• fix(cli): include provider identity metadata for interceptors on update by @slopp in #3014
• fix(sandbox): complete successful main processes by @drew in #2884
• fix(ci): preserve VM runtime embedding inputs by @SDAChess in #3040
• feat(sandbox): add --no-login-shell to skip shell startup files on exec by @letv1nnn in #2852
• fix(compute): recover Error-phase sandboxes on gateway startup by @r3v5 in #2269
• feat(compute): delegate sandbox authentication to drivers by @drew in #2968
• fix(cli): reject out-of-range durations instead of overflowing by @natedemoss in #3044
• docs: correct some comments and references by @krishicks in #3059
• test: backfill coverage for OCSF logging by @krishicks in #3065
• fix(kubernetes): prevent stop-start relay race by @johntmyers in #3064
• fix(policy): compose advisor proposals with provider endpoints by @johntmyers in #2935
• chore(deps): remove legacy rustls webpki path by @elezar in #3013
• test(e2e): run conformance in gateway lanes by @elezar in #2925
• feat(ci): add Codex Security release qualification by @alangou in #3087
• fix(cli): fail sandbox exec when relay closes without exit status by @rootkiller6788 in #2957
• fix(podman): restore rootless workload SIGTERM shutdown by @elezar in #3036
• ci(release): publish prerelease artifacts by @SDAChess in #3093
• fix(release): handle prerelease tag builds by @SDAChess in #3094
• feat(cli): add structured output to list commands by @mrunalp in #3067
• fix(release): provide conformance binary to e2e by @SDAChess in #3097
• fix(policy): ignore advisor provenance during contract inference by @johntmyers in #3069
• fix(gateway): batch SSH session cleanup writes by @drew in #3000
• fix(helm): honor empty clientCaSecretName for HTTPS-only mode by @lunarwhite in #2235
• fix(server): release driver-owned sandbox resources on out-of-band removal by @politerealism in #3042
• fix(sandbox): reconcile early container exits by @johntmyers in #3101
• feat(providers): make profiles authoritative by @johntmyers in #2962
• fix(cli): size auto-detected interactive exec terminals by @elezar in #3084
• fix(cli): allow multiple provider profiles to be deleted by @grs in #3032
• feat(build): add defaults-without-telemetry feature alias by @russellb in #2843
• fix(cli): suppress ANSI color when stdout is not a terminal by @mrunalp in #3026
• refactor(compute): decouple gateway driver composition by @drew in #2823
• fix(cli): continue multi-item deletes after failures by @grs in #3111
• feat(helm): split gateway and workspace charts by @dhirajsb in #2643
• fix(tui): expose workspace switching from providers by @johntmyers in #3115
• chore(gator): adopt authoritative provider profiles by @johntmyers in #3108
• feat(server): add sandbox templates by @grs in #2833
• fix(release): publish prerelease helm charts by @SDAChess in #3126
• test(guest): consolidate rootless Podman provisioning by @elezar in #3125
• ci: add Fedora conformance workflow by @SDAChess in #3086
• fix(ci): use multi-arch Fedora image for RPM builds by @SDAChess in #3130
• feat(vm): support corporate HTTP forward proxy egress for microVM sandboxes by @feloy in #3090
• fix(cli): require ANSI-capable terminal before colorizing by @mrunalp in #3121
• fix(tui): replace alpha badges with version by @johntmyers in #3114
• feat(skills): separate public and contributor workflows by @johnnygreco in #2899
• fix(go-sdk): prevent duplicate credential renewal by @johntmyers in #3133
• fix(cli): preserve provider type on credential updates by @natedemoss in #3109
• test(e2e): keep lifecycle sandboxes running by @elezar in #3128
• fix(vm): retry transient registry requests by @drew in #3134
• fix(compute): fence stale container exits during start by @drew in #3132
• ci: add branch check and test timeouts by @pimlock in #3139
• fix(middleware): drain websocket session end streams by @pimlock in #3143
• fix(deps): remediate h2 advisory by @elezar in #3085
• docs: fix first-network-policy sandbox lifecycle flow by @russellb in #3140
• chore(ci): remove obsolete Rust cache seeder by @pimlock in #3148
• fix(sdk-go): update Go IDNA dependencies by @johntmyers in #3137
• feat(middleware): broaden HTTP header mutation authority by @pimlock in #3072
• fix(ci): restore Codex Security scan execution by @alangou in #3124
• fix(snap): recover gateway after Docker connection by @elezar in #2866
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /sdk/go by @dependabot[bot] in #3119
• test(conformance): add plan-driven continuity verification by @elezar in #3107
• feat(test-guest): allow copy mode overrides by @elezar in #3091
• feat(docs): fix Windows bundled-z3 build command in CONTRIBUTING.md by @pkhodade-NV in #3141
• refactor(otel): unify compute driver tracing by @krishicks in #2995
• docs: add project maintainers by @johntmyers in #3166
• fix(driver-mxc): implement authenticate_sandbox trait method by @jeffmaury in #3158
• refactor(cli): extract provider commands into commands/provider module by @varshaprasad96 in #2605
• fix(sandbox): detect an available login shell instead of hardcoding /bin/bash by @akram in #3147
• feat(server): support EC and EdDSA keys in OIDC JWKS validation by @lunarwhite in #2593
• docs(gateway-config): fix stale community sandbox image path by @lunarwhite in #2800
• fix(dev): inherit non-expiring sandbox JWT in local gateway scripts by @pimlock in #2636
• fix(tui): keep sandbox actions visible by @johntmyers in #3189
• fix(server): preserve in-memory SQLite across reconnects by @EmilienM in #3175
• feat(ocsf): configurable schema version for SIEM backward compatibility by @zanetworker in #2717
• docs: add project governance by @johntmyers in #3191
• fix(policy): harden advisor transport proposals by @johntmyers in #3136
• fix(supervisor): reject MCP initialize batches by @shiju-nv in #3192
• feat(middleware): define HTTP response pre-return interface by @pimlock in #3073
• feat(policy): preserve exact MCP revision allowlists by @shiju-nv in #3027
• fix(supervisor-network): omit absent L7 selectors from policy data by @shiju-nv in #3200
• perf(supervisor-network): cache proposal coverage by policy snapshot by @shiju-nv in #3201
• test(test-guest): support rootful Podman gateways by @elezar in https://github.com/NVID...

Build of the OpenShell VM runtime artifacts used by openshell-driver-vm.

NOTE: This is a development build.

Kernel Runtime Artifacts

Pre-built kernel runtime (libkrunfw + libkrun + umoci) for embedding
into the openshell-driver-vm binary. These are rebuilt on demand when the
kernel config or pinned dependency versions change.

Verify

gh release download vm-runtime -R NVIDIA/OpenShell -p vm-runtime-linux-x86_64.tar.zst
gh attestation verify vm-runtime-linux-x86_64.tar.zst -R NVIDIA/OpenShell

OpenShell v0.0.116

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.116 sh

What's Changed

• fix(dev): harden local cluster and gateway startup by @krishicks in #2993
• fix(server): suppress expected session errors on shutdown by @krishicks in #2994
• test(network): avoid DNS socket bind race by @krishicks in #2996
• chore(deps): bump jdx/mise-action from 4.2.4 to 4.3.0 by @dependabot[bot] in #2970
• fix(ci): normalize macOS binary dependencies by @SDAChess in #3006

Full Changelog: v0.0.115...v0.0.116