NVIDIA OpenShell is NVIDIA's open runtime for sandboxed AI agents. PyPI and GitHub are at 0.1.2, and the docs still introduce the line as 0.1.x.

Three version labels

The docs open by calling this generation OpenShell 0.1.x, and they point the upgrade notes at a page named 0.1.0. The package on PyPI is 0.1.2 and requires Python 3.11 or newer. The GitHub release with the same number, v0.1.2, is dated 28 September 2026. The support matrix then separates three publication lines. A dev build comes from commits on main. A pre-release uses the form X.Y.Z-pre.N. A stable release uses X.Y.Z. The page says tagged stable releases generally go out every week, aimed at Tuesday when the checks pass. Security and critical reliability updates cover the latest minor release and the one before it.

The readme's machines, and the support table

The readme says you need Linux, macOS on Apple Silicon, or Windows with WSL 2, which it marks experimental, plus Docker, Podman, or the host's own virtualization. The support matrix is more specific. Linux on Debian or Ubuntu is supported for both x86_64 and arm64. macOS is supported with Docker Desktop on Apple Silicon. Windows is experimental, and only for x86_64 with WSL 2 and Docker Desktop. On Linux the openshell command is a static musl binary and does not need glibc. The standalone Linux gateway binary on the same page requires glibc 2.28 or newer. Docker is listed at 28.0 or newer, Podman at 5.x, Kubernetes at 1.29, and Helm at 3.x. A Kubernetes install also says the network plugin must enforce network policy.

The readme says the default sandbox image is a minimal Ubuntu with no agent installed. The matrix names that image, nvcr.io/nvidia/base/ubuntu:24.04, for linux/amd64 and linux/arm64: a minimal Ubuntu Noble userspace that does not bundle agent command-line tools. The sandbox boundary wants Landlock at ABI 3, which the page ties to Linux 6.2 or newer. On kernels before 5.19, and the page names RHEL 9 as the example, the sandbox can still start, in a legacy read-only mode. The install line is curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh, then openshell sandbox create. The first-agent tutorial runs OpenCode against a free OpenRouter model. That model belongs to the tutorial. The docs and the repository do not print a price for OpenShell.

That matrix also publishes a standalone gateway binary for Linux x86_64, Linux arm64, and macOS on Apple Silicon. The list has no Windows build. The sandbox runtime binary is Linux only, a static musl archive for x86_64 and arm64, and the page says it does not hold provider credentials. Those stay with the supervisor, outside the workload. Gateway images are pulled from ghcr.io/nvidia/openshell/gateway:latest. On a Mac, the kernel checks run inside the Docker Desktop Linux virtual machine. A Helm install defaults to a StatefulSet when the database is SQLite, and can render a Deployment when the database is external. The readme lists Python, TypeScript, Go, and Rust SDKs, and says to use the same OpenShell release for the SDK and the gateway when you can. A coding agent can load the public skills with npx skills add NVIDIA/OpenShell.

Credentials stay outside

The readme says each agent runs in an isolated sandbox, and that agents never see real credentials. OpenShell adds them only to requests bound for an approved endpoint. Before a policy change is applied, formal verification flags risky new access, such as reaching a new host with credentials, and the page says those changes wait for a person. The gateway collects anonymous telemetry by default, limited to operational categories and counts. The same section says it does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. Turn it off with OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or with server.telemetryEnabled=false on a Helm install. The license is Apache 2.0. Python installs as the package openshell. The TypeScript line in the readme is @nvidia/openshell-sdk, and it says that package comes from GitHub Packages.

Three version labels