Files
OpenShell/pr-preview/pr-270/reference/support-matrix.html
T
2026-03-13 02:26:31 +00:00

809 lines
30 KiB
HTML

<!DOCTYPE html>
<html lang="en" data-content_root="../" >
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Support Matrix &#8212; NVIDIA OpenShell Developer Guide</title>
<script data-cfasync="false">
document.documentElement.dataset.mode = localStorage.getItem("mode") || "";
document.documentElement.dataset.theme = localStorage.getItem("theme") || "";
</script>
<!--
this give us a css class that will be invisible only if js is disabled
-->
<noscript>
<style>
.pst-js-only { display: none !important; }
</style>
</noscript>
<!-- Loaded before other Sphinx assets -->
<link href="../_static/styles/theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
<link href="../_static/styles/pydata-sphinx-theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=8f2a1f02" />
<link rel="stylesheet" type="text/css" href="../_static/styles/nvidia-sphinx-theme.css?v=933278ad" />
<link rel="stylesheet" type="text/css" href="../_static/copybutton.css?v=76b2166b" />
<link rel="stylesheet" type="text/css" href="../_static/enhanced-search.css?v=2e2db37d" />
<link rel="stylesheet" type="text/css" href="../_static/sphinx-design.min.css?v=95c83b7e" />
<!-- So that users can add custom icons -->
<script src="../_static/scripts/fontawesome.js?digest=8878045cc6db502f8baf"></script>
<!-- Pre-loaded scripts that we'll load fully later -->
<link rel="preload" as="script" href="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf" />
<link rel="preload" as="script" href="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf" />
<script src="../_static/documentation_options.js?v=2caa9db7"></script>
<script src="../_static/doctools.js?v=9a2dae69"></script>
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
<script src="../_static/clipboard.min.js?v=a7894cd8"></script>
<script src="../_static/copybutton.js?v=6dbb43f8"></script>
<script src="../_static/search-assets.bundle.js?v=00e3e057"></script>
<script src="../_static/design-tabs.js?v=f930bc37"></script>
<script>DOCUMENTATION_OPTIONS.pagename = 'reference/support-matrix';</script>
<script>
DOCUMENTATION_OPTIONS.theme_version = '0.16.1';
DOCUMENTATION_OPTIONS.theme_switcher_json_url = '../versions1.json';
DOCUMENTATION_OPTIONS.theme_switcher_version_match = '0.1.0';
DOCUMENTATION_OPTIONS.show_version_warning_banner =
false;
</script>
<link rel="canonical" href="https://docs.nvidia.com/openshell/latest/reference/support-matrix.html" />
<link rel="icon" href="../_static/favicon.png"/>
<link rel="search" title="Search" href="../search.html" />
<link rel="next" title="License" href="../resources/eula.html" />
<link rel="prev" title="Policy Schema Reference" href="policy-schema.html" />
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<meta name="docsearch:language" content="en"/>
<meta name="docsearch:version" content="" />
</head>
<body data-bs-spy="scroll" data-bs-target=".bd-toc-nav" data-offset="180" data-bs-root-margin="0px 0px -60%" data-default-mode="">
<div id="pst-skip-link" class="skip-link d-print-none"><a href="#main-content">Skip to main content</a></div>
<div id="pst-scroll-pixel-helper"></div>
<button type="button" class="btn rounded-pill" id="pst-back-to-top">
<i class="fa-solid fa-arrow-up"></i>Back to top</button>
<dialog id="pst-search-dialog">
<form class="bd-search d-flex align-items-center"
action="../search.html"
method="get">
<i class="fa-solid fa-magnifying-glass"></i>
<input type="search"
class="form-control"
name="q"
placeholder="Search the docs ..."
aria-label="Search the docs ..."
autocomplete="off"
autocorrect="off"
autocapitalize="off"
spellcheck="false"/>
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd>K</kbd></span>
</form>
</dialog>
<div class="pst-async-banner-revealer d-none">
<aside id="bd-header-version-warning" class="d-none d-print-none" aria-label="Version warning"></aside>
</div>
<header class="bd-header navbar navbar-expand-lg bd-navbar d-print-none">
<div class="bd-header__inner bd-page-width">
<button class="pst-navbar-icon sidebar-toggle primary-toggle" aria-label="Site navigation">
<span class="fa-solid fa-bars"></span>
</button>
<div class="col-lg-3 navbar-header-items__start">
<div class="navbar-item">
<a class="navbar-brand logo" href="../index.html">
<img src="../_static/nvidia-logo-horiz-rgb-blk-for-screen.svg" class="logo__image only-light" alt="NVIDIA OpenShell Developer Guide - Home"/>
<img src="../_static/nvidia-logo-horiz-rgb-wht-for-screen.svg" class="logo__image only-dark pst-js-only" alt="NVIDIA OpenShell Developer Guide - Home"/>
<p class="title logo__title">NVIDIA OpenShell Developer Guide</p>
</a></div>
</div>
<div class="col-lg-9 navbar-header-items">
<div class="me-auto navbar-header-items__center">
<div class="navbar-item">
<div class="version-switcher__container dropdown pst-js-only">
<button id="pst-version-switcher-button-2"
type="button"
class="version-switcher__button btn btn-sm dropdown-toggle"
data-bs-toggle="dropdown"
aria-haspopup="listbox"
aria-controls="pst-version-switcher-list-2"
aria-label="Version switcher list"
>
Choose version <!-- this text may get changed later by javascript -->
<span class="caret"></span>
</button>
<div id="pst-version-switcher-list-2"
class="version-switcher__menu dropdown-menu list-group-flush py-0"
role="listbox" aria-labelledby="pst-version-switcher-button-2">
<!-- dropdown will be populated by javascript on page load -->
</div>
</div></div>
</div>
<div class="navbar-header-items__end">
<div class="navbar-item navbar-persistent--container">
<button class="btn search-button-field search-button__button pst-js-only" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="fa-solid fa-magnifying-glass"></i>
<span class="search-button__default-text">Search</span>
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
</button>
</div>
<div class="navbar-item">
<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button pst-js-only" aria-label="Color mode" data-bs-title="Color mode" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light" title="Light"></i>
<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark" title="Dark"></i>
<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto" title="System Settings"></i>
</button></div>
<div class="navbar-item"><ul class="navbar-icon-links"
aria-label="Icon Links">
<li class="nav-item">
<a href="https://github.com/NVIDIA/OpenShell" title="GitHub" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-github fa-lg" aria-hidden="true"></i>
<span class="sr-only">GitHub</span></a>
</li>
<li class="nav-item">
<a href="https://pypi.org/project/openshell/" title="PyPI" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-python fa-lg" aria-hidden="true"></i>
<span class="sr-only">PyPI</span></a>
</li>
</ul></div>
</div>
</div>
<div class="navbar-persistent--mobile">
<button class="btn search-button-field search-button__button pst-js-only" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="fa-solid fa-magnifying-glass"></i>
<span class="search-button__default-text">Search</span>
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
</button>
</div>
<button class="pst-navbar-icon sidebar-toggle secondary-toggle" aria-label="On this page">
<span class="fa-solid fa-outdent"></span>
</button>
</div>
</header>
<div class="bd-container">
<div class="bd-container__inner bd-page-width">
<dialog id="pst-primary-sidebar-modal"></dialog>
<div id="pst-primary-sidebar" class="bd-sidebar-primary bd-sidebar">
<a class="navbar-brand logo" href="../index.html">
<img src="../_static/nvidia-logo-horiz-rgb-blk-for-screen.svg" class="logo__image only-light" alt="NVIDIA OpenShell Developer Guide - Home"/>
<img src="../_static/nvidia-logo-horiz-rgb-wht-for-screen.svg" class="logo__image only-dark pst-js-only" alt="NVIDIA OpenShell Developer Guide - Home"/>
<p class="title logo__title">NVIDIA OpenShell Developer Guide</p>
</a>
<div class="sidebar-header-items sidebar-primary__section">
<div class="sidebar-header-items__center">
<div class="navbar-item">
<div class="version-switcher__container dropdown pst-js-only">
<button id="pst-version-switcher-button-3"
type="button"
class="version-switcher__button btn btn-sm dropdown-toggle"
data-bs-toggle="dropdown"
aria-haspopup="listbox"
aria-controls="pst-version-switcher-list-3"
aria-label="Version switcher list"
>
Choose version <!-- this text may get changed later by javascript -->
<span class="caret"></span>
</button>
<div id="pst-version-switcher-list-3"
class="version-switcher__menu dropdown-menu list-group-flush py-0"
role="listbox" aria-labelledby="pst-version-switcher-button-3">
<!-- dropdown will be populated by javascript on page load -->
</div>
</div></div>
</div>
<div class="sidebar-header-items__end">
<div class="navbar-item">
<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button pst-js-only" aria-label="Color mode" data-bs-title="Color mode" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light" title="Light"></i>
<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark" title="Dark"></i>
<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto" title="System Settings"></i>
</button></div>
<div class="navbar-item"><ul class="navbar-icon-links"
aria-label="Icon Links">
<li class="nav-item">
<a href="https://github.com/NVIDIA/OpenShell" title="GitHub" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-github fa-lg" aria-hidden="true"></i>
<span class="sr-only">GitHub</span></a>
</li>
<li class="nav-item">
<a href="https://pypi.org/project/openshell/" title="PyPI" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-brands fa-python fa-lg" aria-hidden="true"></i>
<span class="sr-only">PyPI</span></a>
</li>
</ul></div>
</div>
</div>
<div class="sidebar-primary-items__start sidebar-primary__section">
<div class="sidebar-primary-item">
<nav class="bd-docs-nav bd-links"
aria-label="Table of Contents">
<p class="bd-links__title" role="heading" aria-level="1">Table of Contents</p>
<div class="bd-toc-item navbar-nav"><ul class="nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="../index.html">Home</a></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">About NVIDIA OpenShell</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="../about/overview.html">Overview</a></li>
<li class="toctree-l1"><a class="reference internal" href="../about/architecture.html">How It Works</a></li>
<li class="toctree-l1"><a class="reference internal" href="../about/release-notes.html">Release Notes</a></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Get Started</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="../get-started/quickstart.html">Quickstart</a></li>
<li class="toctree-l1"><a class="reference internal" href="../tutorials/github-sandbox.html">GitHub Policy Tutorial</a></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Sandboxes</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/index.html">About Sandboxes</a></li>
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/create-and-manage.html">Create and Manage Sandboxes</a></li>
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/providers.html">Providers</a></li>
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/policies.html">Customize Sandbox Policies</a></li>
<li class="toctree-l1"><a class="reference internal" href="../sandboxes/community-sandboxes.html">Community Sandboxes</a></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Inference Routing</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="../inference/index.html">About Inference Routing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../inference/configure.html">Configure Inference Routing</a></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Reference</span></p>
<ul class="current nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="cli.html">CLI Reference</a></li>
<li class="toctree-l1"><a class="reference internal" href="cli-generated.html">OpenShell CLI Reference</a></li>
<li class="toctree-l1"><a class="reference internal" href="default-policy.html">Default Policy Reference</a></li>
<li class="toctree-l1"><a class="reference internal" href="policy-schema.html">Policy Schema Reference</a></li>
<li class="toctree-l1 current active"><a class="current reference internal" href="#">Support Matrix</a></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Resources</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1"><a class="reference internal" href="../resources/eula.html">License</a></li>
</ul>
</div>
</nav></div>
</div>
<div class="sidebar-primary-items__end sidebar-primary__section">
</div>
</div>
<main id="main-content" class="bd-main" role="main">
<div class="bd-content">
<div class="bd-article-container">
<div class="bd-header-article d-print-none">
<div class="header-article-items header-article__inner">
<div class="header-article-items__start">
<div class="header-article-item">
<nav aria-label="Breadcrumb" class="d-print-none">
<ul class="bd-breadcrumbs">
<li class="breadcrumb-item breadcrumb-home">
<a href="../index.html" class="nav-link" aria-label="Home">
<i class="fa-solid fa-home"></i>
</a>
</li>
<li class="breadcrumb-item active" aria-current="page"><span class="ellipsis">Support Matrix</span></li>
</ul>
</nav>
</div>
</div>
</div>
</div>
<div id="searchbox"></div>
<article class="bd-article">
<!--
SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
SPDX-License-Identifier: Apache-2.0
-->
<section class="tex2jax_ignore mathjax_ignore" id="support-matrix">
<h1>Support Matrix<a class="headerlink" href="#support-matrix" title="Link to this heading">#</a></h1>
<p>This page lists the platform, software, runtime, and kernel requirements for running OpenShell.</p>
<section id="supported-platforms">
<h2>Supported Platforms<a class="headerlink" href="#supported-platforms" title="Link to this heading">#</a></h2>
<p>OpenShell publishes multi-architecture container images for <code class="docutils literal notranslate"><span class="pre">linux/amd64</span></code> and <code class="docutils literal notranslate"><span class="pre">linux/arm64</span></code>. The CLI is supported on the following host platforms:</p>
<div class="pst-scrollable-table-container"><table class="table">
<thead>
<tr class="row-odd"><th class="head"><p>Platform</p></th>
<th class="head"><p>Architecture</p></th>
<th class="head"><p>Status</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>Linux (Debian/Ubuntu)</p></td>
<td><p>x86_64 (amd64)</p></td>
<td><p>Supported</p></td>
</tr>
<tr class="row-odd"><td><p>Linux (Debian/Ubuntu)</p></td>
<td><p>aarch64 (arm64)</p></td>
<td><p>Supported</p></td>
</tr>
<tr class="row-even"><td><p>macOS (Docker Desktop)</p></td>
<td><p>Apple Silicon (arm64)</p></td>
<td><p>Supported</p></td>
</tr>
<tr class="row-odd"><td><p>macOS (Docker Desktop)</p></td>
<td><p>Intel (amd64)</p></td>
<td><p>Supported</p></td>
</tr>
<tr class="row-even"><td><p>Windows (WSL 2 + Docker Desktop)</p></td>
<td><p>x86_64</p></td>
<td><p>Untested</p></td>
</tr>
</tbody>
</table>
</div>
</section>
<section id="software-prerequisites">
<h2>Software Prerequisites<a class="headerlink" href="#software-prerequisites" title="Link to this heading">#</a></h2>
<p>The following software must be installed on the host before using the OpenShell CLI:</p>
<div class="pst-scrollable-table-container"><table class="table">
<thead>
<tr class="row-odd"><th class="head"><p>Component</p></th>
<th class="head"><p>Minimum Version</p></th>
<th class="head"><p>Notes</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>Python</p></td>
<td><p>3.12</p></td>
<td><p>Python 3.12 and 3.13 are supported.</p></td>
</tr>
<tr class="row-odd"><td><p><a class="reference external" href="https://docs.astral.sh/uv/" rel="noreferer noopener" target="_blank">uv</a></p></td>
<td><p>0.9</p></td>
<td><p>Used to install the CLI (<code class="docutils literal notranslate"><span class="pre">uv</span> <span class="pre">pip</span> <span class="pre">install</span> <span class="pre">openshell</span></code>).</p></td>
</tr>
<tr class="row-even"><td><p>Docker Desktop or Docker Engine</p></td>
<td><p>—</p></td>
<td><p>Must be running before any <code class="docutils literal notranslate"><span class="pre">openshell</span></code> command. No minimum version is enforced.</p></td>
</tr>
</tbody>
</table>
</div>
</section>
<section id="sandbox-runtime-versions">
<h2>Sandbox Runtime Versions<a class="headerlink" href="#sandbox-runtime-versions" title="Link to this heading">#</a></h2>
<p>The base sandbox container image ships the following components. These versions apply to sandboxes created with the default image (<code class="docutils literal notranslate"><span class="pre">ghcr.io/nvidia/openshell/sandbox</span></code>).</p>
<div class="pst-scrollable-table-container"><table class="table">
<thead>
<tr class="row-odd"><th class="head"><p>Component</p></th>
<th class="head"><p>Version</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>Base OS</p></td>
<td><p>Debian Bookworm</p></td>
</tr>
<tr class="row-odd"><td><p>Python</p></td>
<td><p>3.12.13</p></td>
</tr>
<tr class="row-even"><td><p>Node.js</p></td>
<td><p>22.22.1</p></td>
</tr>
<tr class="row-odd"><td><p>npm</p></td>
<td><p>11.11.0</p></td>
</tr>
<tr class="row-even"><td><p>uv</p></td>
<td><p>0.10.8</p></td>
</tr>
<tr class="row-odd"><td><p>Claude Code</p></td>
<td><p>Latest (installed at image build time)</p></td>
</tr>
<tr class="row-even"><td><p>OpenCode</p></td>
<td><p>1.2.18</p></td>
</tr>
<tr class="row-odd"><td><p>Codex</p></td>
<td><p>0.111.0</p></td>
</tr>
</tbody>
</table>
</div>
</section>
<section id="container-images">
<h2>Container Images<a class="headerlink" href="#container-images" title="Link to this heading">#</a></h2>
<p>OpenShell uses several container images that are pulled automatically during gateway startup and sandbox creation. All images are published for <code class="docutils literal notranslate"><span class="pre">linux/amd64</span></code> and <code class="docutils literal notranslate"><span class="pre">linux/arm64</span></code>.</p>
<div class="pst-scrollable-table-container"><table class="table">
<thead>
<tr class="row-odd"><th class="head"><p>Image</p></th>
<th class="head"><p>Registry</p></th>
<th class="head"><p>Reference</p></th>
<th class="head"><p>Pulled When</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>Cluster</p></td>
<td><p>ghcr.io</p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">ghcr.io/nvidia/openshell/cluster:latest</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">openshell</span> <span class="pre">gateway</span> <span class="pre">start</span></code></p></td>
</tr>
<tr class="row-odd"><td><p>Gateway</p></td>
<td><p>ghcr.io</p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">ghcr.io/nvidia/openshell/gateway:latest</span></code></p></td>
<td><p>Cluster startup (via Helm chart)</p></td>
</tr>
<tr class="row-even"><td><p>Sandbox</p></td>
<td><p>ghcr.io</p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">ghcr.io/nvidia/openshell/sandbox:latest</span></code></p></td>
<td><p>First sandbox creation (via Helm chart)</p></td>
</tr>
<tr class="row-odd"><td><p>Community sandboxes</p></td>
<td><p>GHCR</p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">ghcr.io/nvidia/openshell-community/sandboxes/{name}:latest</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">openshell</span> <span class="pre">sandbox</span> <span class="pre">create</span> <span class="pre">--from</span> <span class="pre">&lt;name&gt;</span></code></p></td>
</tr>
</tbody>
</table>
</div>
<p>The cluster image is based on <code class="docutils literal notranslate"><span class="pre">rancher/k3s:v1.35.2-k3s1</span></code> and bundles the Helm charts and Kubernetes manifests required to bootstrap the control plane. The server and sandbox images are pulled separately at runtime.</p>
<p>To override the default image references, set the following environment variables:</p>
<div class="pst-scrollable-table-container"><table class="table">
<thead>
<tr class="row-odd"><th class="head"><p>Variable</p></th>
<th class="head"><p>Purpose</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">OPENSHELL_CLUSTER_IMAGE</span></code></p></td>
<td><p>Override the cluster image reference.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">OPENSHELL_COMMUNITY_REGISTRY</span></code></p></td>
<td><p>Override the registry for community sandbox images.</p></td>
</tr>
</tbody>
</table>
</div>
</section>
<section id="kernel-requirements">
<h2>Kernel Requirements<a class="headerlink" href="#kernel-requirements" title="Link to this heading">#</a></h2>
<p>OpenShell enforces sandbox isolation through two Linux kernel security modules:</p>
<div class="pst-scrollable-table-container"><table class="table">
<thead>
<tr class="row-odd"><th class="head"><p>Module</p></th>
<th class="head"><p>Requirement</p></th>
<th class="head"><p>Details</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><a class="reference external" href="https://docs.kernel.org/security/landlock.html" rel="noreferer noopener" target="_blank">Landlock LSM</a></p></td>
<td><p>Recommended</p></td>
<td><p>Enforces filesystem access restrictions at the kernel level. The <code class="docutils literal notranslate"><span class="pre">best_effort</span></code> compatibility mode uses the highest Landlock ABI the host kernel supports. The <code class="docutils literal notranslate"><span class="pre">hard_requirement</span></code> mode fails sandbox creation if the required ABI is unavailable.</p></td>
</tr>
<tr class="row-odd"><td><p>seccomp</p></td>
<td><p>Required</p></td>
<td><p>Filters dangerous system calls. Available on all modern Linux kernels (3.17+).</p></td>
</tr>
</tbody>
</table>
</div>
<p>On macOS, these kernel modules run inside the Docker Desktop Linux VM, not on the host kernel.</p>
</section>
<section id="agent-compatibility">
<h2>Agent Compatibility<a class="headerlink" href="#agent-compatibility" title="Link to this heading">#</a></h2>
<p>For the full list of supported agents and their default policy coverage, refer to the <a class="reference internal" href="../sandboxes/index.html#supported-agents"><span class="std std-ref">Supported Agents</span></a> table.</p>
</section>
</section>
</article>
<footer class="prev-next-footer d-print-none">
<div class="prev-next-area">
<a class="left-prev"
href="policy-schema.html"
title="previous page">
<i class="fa-solid fa-angle-left"></i>
<div class="prev-next-info">
<p class="prev-next-subtitle">previous</p>
<p class="prev-next-title">Policy Schema Reference</p>
</div>
</a>
<a class="right-next"
href="../resources/eula.html"
title="next page">
<div class="prev-next-info">
<p class="prev-next-subtitle">next</p>
<p class="prev-next-title">License</p>
</div>
<i class="fa-solid fa-angle-right"></i>
</a>
</div>
</footer>
</div>
<dialog id="pst-secondary-sidebar-modal"></dialog>
<div id="pst-secondary-sidebar" class="bd-sidebar-secondary bd-toc"><div class="sidebar-secondary-items sidebar-secondary__inner">
<div class="sidebar-secondary-item">
<div
id="pst-page-navigation-heading-2"
class="page-toc tocsection onthispage">
<i class="fa-solid fa-list"></i> On this page
</div>
<nav class="bd-toc-nav page-toc" aria-labelledby="pst-page-navigation-heading-2">
<ul class="visible nav section-nav flex-column">
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#supported-platforms">Supported Platforms</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#software-prerequisites">Software Prerequisites</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#sandbox-runtime-versions">Sandbox Runtime Versions</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#container-images">Container Images</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#kernel-requirements">Kernel Requirements</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#agent-compatibility">Agent Compatibility</a></li>
</ul>
</nav></div>
</div></div>
</div>
<footer class="bd-footer-content">
</footer>
</main>
</div>
</div>
<!-- Scripts loaded after <body> so the DOM is not blocked -->
<script defer src="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf"></script>
<script defer src="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf"></script>
<footer class="bd-footer">
<div class="bd-footer__inner bd-page-width">
<div class="footer-items__start">
<div class="footer-item">
<a class="footer-brand logo" href="https://www.nvidia.com">
<img src="../_static/nvidia-logo-horiz-rgb-1c-blk-for-screen.svg" class="logo__image only-light" alt="NVIDIA"/>
<img src="../_static/nvidia-logo-horiz-rgb-1c-wht-for-screen.svg" class="logo__image only-dark" alt="NVIDIA"/>
</a></div>
<div class="footer-item">
<div class="footer-links">
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/privacy-policy/">Privacy Policy</a>
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/privacy-center/">Your Privacy Choices</a>
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/terms-of-service/">Terms of Service</a>
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/accessibility/">Accessibility</a>
|
<a class="external" href="https://www.nvidia.com/en-us/about-nvidia/company-policies/">Corporate Policies</a>
|
<a class="external" href="https://www.nvidia.com/en-us/product-security/">Product Security</a>
|
<a class="external" href="https://www.nvidia.com/en-us/contact/">Contact</a>
</div>
</div>
<div class="footer-item">
<p class="copyright">
Copyright © 2025-2026, NVIDIA Corporation.
<br/>
</p>
</div>
</div>
</div>
</footer>
</body>
</html>