Documentation Index
Fetch the complete documentation index at: https://mintlify.com/NVIDIA/OpenShell/llms.txt
Use this file to discover all available pages before exploring further.
Support matrix
This page lists the platform, software, runtime, and kernel requirements for running OpenShell.Supported platforms
OpenShell publishes multi-architecture container images forlinux/amd64 and linux/arm64. The CLI is supported on the following host platforms:
| Platform | Architecture | Status |
|---|---|---|
| Linux (Debian/Ubuntu) | x86_64 (amd64) | Supported |
| Linux (Debian/Ubuntu) | aarch64 (arm64) | Supported |
| macOS (Docker Desktop) | Apple Silicon (arm64) | Supported |
| Windows (WSL 2 + Docker Desktop) | x86_64 | Experimental |
On macOS, kernel security modules (Landlock, seccomp) run inside the Docker Desktop Linux VM, not on the host kernel.
Software prerequisites
The following software must be installed and running on the host before using the OpenShell CLI:| Component | Minimum version | Notes |
|---|---|---|
| Docker Desktop or Docker Engine | 28.04 | Must be running before any openshell command. |
Container images
OpenShell publishes two container images. Both are published forlinux/amd64 and linux/arm64.
| Image | Reference | Pulled when |
|---|---|---|
| Cluster | ghcr.io/nvidia/openshell/cluster:latest | openshell gateway start |
| Gateway | ghcr.io/nvidia/openshell/gateway:latest | Cluster startup (via Helm chart) |
openshell-sandbox supervisor binary required to bootstrap the control plane. The supervisor binary is side-loaded into sandbox pods at runtime through a read-only host volume mount.
The gateway image is pulled at cluster startup and runs the API server.
Sandbox images are maintained separately in the openshell-community repository. Refer to that repository for the current list of installed components and their versions.
Image overrides
To override the default image references, set the following environment variables before runningopenshell commands:
| Variable | Purpose |
|---|---|
OPENSHELL_CLUSTER_IMAGE | Override the cluster image reference. |
OPENSHELL_COMMUNITY_REGISTRY | Override the registry for community sandbox images. |
Kernel requirements
OpenShell enforces sandbox isolation through two Linux kernel security modules:| Module | Requirement | Details |
|---|---|---|
| Landlock LSM | Recommended | Enforces filesystem access restrictions at the kernel level. best_effort compatibility uses the highest supported ABI; hard_requirement fails if the required ABI is unavailable. |
| seccomp | Required | Filters dangerous system calls. Available on all modern Linux kernels (3.17+). |
Sandbox runtime versions
Sandbox container images are maintained in the openshell-community repository. Refer to that repository for the current list of installed components and their versions.Default policy
The built-in policy applied when no custom policy is provided.
Policy schema
Complete field reference for the sandbox policy YAML.