---
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
title: "Support Matrix"
description: "Review OpenShell compatibility across host platforms, Kubernetes environments, and SDKs."
position: 5
---
OpenShell can run sandboxes on a local macOS, Linux, or Windows machine or as
a distributed deployment on Kubernetes. The OpenShell CLI, TUI, and SDKs can
manage a local gateway or connect to a remote gateway. This matrix lists the
supported platforms, runtimes, and client toolchains.

## Platforms

OpenShell can be installed and run on macOS, Linux, or Windows using standard
package installers. The [Installation guide](/about/installation) provides
setup instructions.

| Platform                | Installation methods | Versions                                     |
| ----------------------- | -------------------- | -------------------------------------------- |
| macOS (Apple Silicon)   | Homebrew             | macOS 13.3 or later                          |
| Linux (x86_64, arm64)   | APT/DEB, RPM, Snap   | glibc 2.28 or later                          |
| Windows (x86_64, arm64) | MSI, WinGet          | Windows minimum version: TBD; MSVC toolchain |

The OpenShell client includes the CLI and TUI. Client binaries are built with
musl and are supported on macOS, Linux, and Windows. The client can be
downloaded and run without a local gateway or package manager.

## Compute Drivers

| Driver     | Supported hosts       | Minimum version                            | Requirements                                                                          |
| ---------- | --------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------- |
| Docker     | macOS, Linux, Windows | 28.0.4 or later                            | Docker Engine or Docker Desktop.                                                      |
| Podman     | macOS, Linux, Windows | 5.x                                        | Podman socket, rootless networking, and cgroups v2.                                   |
| MicroVM    | macOS, Linux          | macOS 13.3 or later; KVM support on Linux  | Host virtualization enabled; `Hypervisor.framework` on macOS; KVM on Linux.           |
| Kubernetes | Kubernetes clusters   | 1.29 or later                              | See [Kubernetes](#kubernetes) for Helm, Agent Sandbox, and distribution requirements. |

## Supervisor Kernel Requirements

These requirements apply to the Linux environment running the supervisor. On
macOS and Windows, they apply to the container or virtual machine kernel, not
the host kernel.

| Kernel capability                      | Requirement | Minimum             | Behavior when unavailable                                                      |
| -------------------------------------- | ----------- | ------------------- | ------------------------------------------------------------------------------ |
| seccomp BPF                            | Required    | Linux 3.17 or later | Supervisor security initialization fails.                                      |
| Network namespaces, veth, and nftables | Required    | Linux 3.13 or later | Network policy enforcement cannot start.                                       |
| Landlock LSM                           | Recommended | Linux 5.13 or later | `best_effort` runs degraded with a security finding; `hard_requirement` fails. |
| cgroups v2 PID controller              | Recommended | Linux 4.5 or later  | The compute driver or container runtime must provide PID limits.               |
| User namespaces                        | Optional    | Linux 5.12 or later | Stronger Kubernetes host isolation is unavailable.                             |

## Kubernetes

OpenShell runs on Kubernetes as a distributed, multi-tenant application.

| Component                         | Supported version               | Notes                                                 |
| --------------------------------- | ------------------------------- | ----------------------------------------------------- |
| Kubernetes                        | 1.29 or later                   | Required for Helm deployments and sandbox scheduling. |
| Helm                              | 3.x                             | Required to install and upgrade the OpenShell chart.  |
| Agent Sandbox controller and CRDs | Compatible release; version TBD | Required before installing the OpenShell chart.       |

Kubernetes deployments require the Agent Sandbox controller and its `Sandbox`
CRDs before the OpenShell Helm chart is installed. The
[Kubernetes setup guide](/kubernetes/setup) provides installation instructions.

### Distributions

- GKE Standard and Autopilot clusters are supported.
- OpenShift 4.x is supported with the OpenShift-specific SCC binding and chart
configuration. Refer to [OpenShift installation](/kubernetes/openshift) for
the required overrides.

## SDKs

The supported SDKs connect to local or remote OpenShell deployments.

| SDK        | Minimum version |
| ---------- | --------------- |
| Python     | 3.12            |
| TypeScript | 5.7             |
| Rust       | 1.90            |
| Go         | 1.24            |

## API Compatibility

OpenShell maintains compatibility across its gRPC APIs, clients, SDKs, and
compute drivers. Refer to [API Compatibility](/reference/api-compatibility) for
the versioning, deprecation, and client/server compatibility policy.