OpenShell v0.0.33

OpenShell v0.0.33

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.33 sh

What's Changed

• fix(sandbox): harden seccomp, inference routing, and process limits by @johntmyers in #869
• feat(vm): add standalone libkrun compute driver by @drew in #858
• docs: fix TOC structure by @miyoungc in #797
• docs: refresh user-facing docs for recent sandbox and inference changes by @miyoungc in #868
• docs(contributing): add bash shell setup example for mise by @mrunalp in #877
• fix(sandbox): strip " (deleted)" suffix from unlinked /proc//exe paths by @mjamiv in #844
• test(sandbox): fix flaky arm64 procfs binary_path tests by @pimlock in #881

New Contributors

• @mrunalp made their first contribution in #877

Full Changelog: v0.0.32...v0.0.33

OpenShell v0.0.32

OpenShell v0.0.32

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.32 sh

What's Changed

• feat(sandbox): load system CA certificates for upstream TLS connections by @matz3 in #862
• feat(release): publish standalone openshell-gateway binaries by @drew in #853
• docs(rfc): adopt per-RFC folder structure by @drew in #870

New Contributors

• @matz3 made their first contribution in #862

Full Changelog: v0.0.31...v0.0.32

OpenShell v0.0.31

OpenShell v0.0.31

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.31 sh

What's Changed

• fix(core): exclude vm-dev tag from git describe version glob by @mjamiv in #843
• fix(inference): allowlist routed request headers by @johntmyers in #826

Full Changelog: v0.0.30...v0.0.31

OpenShell v0.0.30

OpenShell v0.0.30

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.30 sh

What's Changed

• refactor(server): extract kubernetes compute driver by @drew in #817
• fix(inference): prevent silent truncation of large streaming responses by @johntmyers in #834
• refactor(server): use ComputeDriver RPC surface in-process by @drew in #839
• fix(sandbox): preserve ownership for existing read_write paths by @johntmyers in #827
• feat(policy): add deny rules to network policy schema by @johntmyers in #822
• fix(sandbox): disable child core dumps by @johntmyers in #821
• fix(sandbox): escape control characters in format_sse_error by @mjamiv in #842

New Contributors

• @mjamiv made their first contribution in #842

Full Changelog: v0.0.29...v0.0.30

OpenShell v0.0.29

OpenShell v0.0.29

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.29 sh

What's Changed

• fix(sandbox): validate always-blocked IPs at load time, enrich denial logs, and filter un-fixable proposals by @johntmyers in #815
• fix(sandbox): resolve symlinked binary paths in network policy matching by @johntmyers in #774
• fix(sandbox): two-phase Landlock to fix privilege ordering and add enforcement tests by @johntmyers in #810
• fix(sandbox): add JSON bodies to proxy 403/502 responses and include port in HTTP log URLs by @johntmyers in #809
• fix(sandbox): harden seccomp denylist, SSRF protection, and inference policy enforcement by @johntmyers in #819
• fix(cli): support plaintext gateway registration by @drew in #824
• ci: parallelize wheel builds in CI by @pimlock in #820

Full Changelog: v0.0.28...v0.0.29

OpenShell v0.0.28

OpenShell v0.0.28

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.28 sh

What's Changed

• fix(cli): use local z3 in dev wrapper by @johntmyers in #805
• fix(vm): harden build-libkrun.sh for x86_64 and resolve PATH-shadowing issues by @vince-brisebois in #806
• fix(docker): add openshell-prover to Dockerfile skeleton stages and provide z3 by @johntmyers in #800
• test(sandbox): split drop_privileges test to unblock non-root CI by @elezar in #623

New Contributors

• @vince-brisebois made their first contribution in #806

Full Changelog: v0.0.27...v0.0.28

OpenShell v0.0.26

OpenShell v0.0.26

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.26 sh

What's Changed

• docs(fern): migrate OpenShell docs to Fern by @lbliii in #780
• refactor(server): split grpc.rs into submodules by @drew in #777
• ci(gpu): add separate GPU test workflows by @pimlock in #773
• feat(vm): add openshell-vm crate with libkrun microVM gateway by @drew in #611
• docs(fern): finalize preview workflow and nav cleanup by @pimlock in #784

New Contributors

• @lbliii made their first contribution in #780

Full Changelog: v0.0.25...v0.0.26

OpenShell v0.0.25

OpenShell v0.0.25

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.25 sh

What's Changed

• feat(sandbox): integrate OCSF structured logging for sandbox events by @johntmyers in #720

Full Changelog: v0.0.24...v0.0.25

OpenShell v0.0.24

OpenShell v0.0.24

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.24 sh

What's Changed

• chore(proto): remove unused java_package declarations by @drew in #772

Full Changelog: v0.0.23...v0.0.24

OpenShell v0.0.23

OpenShell v0.0.23

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.23 sh

What's Changed

• feat(cli): add sandbox exec subcommand with TTY support by @drew in #752

Full Changelog: v0.0.22...v0.0.23