trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-11 04:30:53 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
pull-request/3450
OpenShell/docs/reference/support-matrix.mdx
T
Johnny Greco 58b5f8f976 feat(prover): add standalone policy boundary checker (#3289) 
* feat(prover): add standalone policy maximum checker

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* refactor(prover): simplify check scope schema

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): align containment and cancellation with runtime

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): stabilize containment checks in CI

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* test(prover): avoid solver in fast-path guard test

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): align string containment with runtime

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): reject ambiguous z3 string escapes

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): align containment with runtime boundaries

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover-cli): harden cancellation and invalid input

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* feat(packaging): install policy prover with OpenShell

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* docs(prover): clarify installation and check results

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* docs(build): describe prover distribution directly

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* refactor(prover): rename maximum policy to boundary

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* refactor(prover): localize fail-closed validation

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* test(prover): cover fail-closed CLI surfaces

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* test(prover): allow CI load for REST solver proof

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): use canonical policy schema for containment

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): preserve uncertainty for runtime binary globs

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): bound policy validation work

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* docs(prover): document validation resource limits

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(prover): make containment API extensible

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* docs(prover): define containment API contract

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(ci): integrate prover with consolidated builds

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

* fix(ci): declare release packaging dependency

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

---------

Signed-off-by: Johnny Greco <jogreco@nvidia.com>
2026-09-17 17:30:03 +00:00

117 lines
7.1 KiB
Plaintext
Raw Permalink Blame History

---
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
title: "Support Matrix"
description: ""
position: 5
---
This page lists the host platform, compute driver, software, runtime, and kernel requirements for running OpenShell.
## Supported Platforms
OpenShell publishes multi-architecture gateway images for `linux/amd64` and `linux/arm64`. The CLI, policy prover, package-managed gateway, and standalone gateway binary are supported on the following host platforms:
| Platform | Architecture | Status |
| -------------------------------- | --------------------- | --------- |
| Linux (Debian/Ubuntu) | x86_64 (amd64) | Supported |
| Linux (Debian/Ubuntu) | aarch64 (arm64) | Supported |
| macOS (Docker Desktop) | Apple Silicon (arm64) | Supported |
| Windows (WSL 2 + Docker Desktop) | x86_64 | Experimental |
On Linux, the `openshell` CLI is a static musl binary and does not require glibc at runtime.
## Standalone Gateway Binary
OpenShell publishes standalone `openshell-gateway` release assets for manual download on these platforms:
| Platform | Artifact pattern |
| --------------------- | ---------------------------------------------- |
| Linux x86_64 (amd64) | `openshell-gateway-x86_64-unknown-linux-gnu` |
| Linux aarch64 (arm64) | `openshell-gateway-aarch64-unknown-linux-gnu` |
| macOS Apple Silicon | `openshell-gateway-aarch64-apple-darwin` |
These artifacts are attached to GitHub releases. Kubernetes deployments should use the Helm chart and the published gateway image.
On Linux, `openshell-gateway` requires glibc 2.28 or newer. Compatible systems include, for example, Ubuntu 20.04+, RHEL 8+, Rocky Linux 8+, Amazon Linux 2023+, and Fedora 32+.
## Standalone Policy Prover
OpenShell publishes standalone `openshell-prover` release assets for manual download on these platforms:
| Platform | Artifact pattern |
| --------------------- | ----------------------------------------------------- |
| Linux x86_64 (amd64) | `openshell-prover-x86_64-unknown-linux-musl.tar.gz` |
| Linux aarch64 (arm64) | `openshell-prover-aarch64-unknown-linux-musl.tar.gz` |
| macOS Apple Silicon | `openshell-prover-aarch64-apple-darwin.tar.gz` |
These artifacts are attached to GitHub releases. The Linux binaries are static and do not require glibc. All prover archives include the required solver linkage.
## Compute Drivers
The gateway can manage sandboxes through several compute drivers.
| Compute Driver | Status | Notes |
|---|---|---|
| Docker | Supported for local development and single-machine gateways. | Requires Docker Desktop or Docker Engine on the gateway host. |
| Podman | Supported for rootless local and workstation workflows. | Requires a Podman-compatible socket and rootless networking setup. |
| Kubernetes | Supported through the [OpenShell Helm chart](https://github.com/NVIDIA/OpenShell/blob/main/deploy/helm/openshell/README.md). | Requires a Kubernetes cluster supplied by the operator. |
| MicroVM | Supported for VM-backed sandboxes. | Uses the VM compute driver and libkrun-based runtime. |
## Software Prerequisites
Install the software for the compute driver you use:
| Component | Minimum Version | Notes |
|---|---|---|
| Docker Desktop or Docker Engine | 28.0 | Required for Docker-backed gateways, local image builds, and Docker development workflows. |
| Podman | 5.x | Required for Podman-backed gateways. |
| Kubernetes | 1.29 | Required for Helm deployments and Kubernetes sandbox scheduling. |
| Helm | 3.x | Required to install `deploy/helm/openshell`. |
| kubectl | Compatible with your cluster | Required for Kubernetes operational inspection and secret creation. |
| Host virtualization | Host dependent | Required for MicroVM-backed gateways. MicroVM uses Hypervisor.framework on macOS and KVM on Linux. |
## Sandbox Runtime Versions
Sandbox container images are maintained in the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) repository. Refer to that repository for the current list of installed components and their versions.
## Container Images
OpenShell publishes the gateway image for `linux/amd64` and `linux/arm64`.
| Image | Reference | Pulled When |
|---|---|---|
| Gateway | `ghcr.io/nvidia/openshell/gateway:latest` | Helm chart install or upgrade, or standalone container deployment |
The Helm chart in `deploy/helm/openshell` deploys the gateway workload, service account, service, optional persistent storage, and network policy for Kubernetes. It defaults to a StatefulSet for SQLite-backed installs and can render a Deployment for external database-backed installs.
Sandbox images are maintained separately in the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) repository.
To override the default image references, use Helm values:
| Helm value | Purpose |
|---|---|
| `image.repository` / `image.tag` | Override the gateway image reference. |
| `server.sandboxImage` | Override the default sandbox image. |
## Kernel Requirements
The sandbox boundary requires the following Linux kernel facilities, including
when it runs inside a container or microVM:
| Module | Requirement | Details |
| -------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Landlock LSM](https://docs.kernel.org/security/landlock.html) | Required | ABI 3 or newer, introduced in Linux 6.2, with Landlock enabled. The mandatory baseline protects private channel and bootstrap files, including against truncation. A filesystem policy's `best_effort` setting never disables this baseline. |
| seccomp | Required | Nested user-notification filters and atomic `SECCOMP_IOCTL_NOTIF_ADDFD` with `SECCOMP_ADDFD_FLAG_SEND`, usable under the runtime's existing seccomp profile without added capabilities. The sandbox actively probes these operations before admitting the workload. |
A kernel version alone does not establish support. A disabled Landlock LSM or a
runtime profile that blocks the required seccomp operations causes launch to
fail closed. An upstream Linux 6.2 or newer kernel provides the required
Landlock ABI; distribution backports must pass the same active qualification.
On macOS, these kernel modules run inside the Docker Desktop Linux VM, not on the host kernel.
## Agent Compatibility
For the full list of supported agents and their default policy coverage, refer to the [Supported Agents](/about/supported-agents) page.
Reference in New Issue View Git Blame Copy Permalink