OpenShell
OpenShell is the safe, private runtime for autonomous AI agents.
File Explorer
Download Latest Version (.zip)- SKILL.md
- reference.md
- SKILL.md
- SKILL.md
- SKILL.md
- openai.yaml
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- examples.md
- SKILL.md
- SKILL.md
- SKILL.md
- cli-reference.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- SKILL.md
- config.toml
- MEMORY.md
- MEMORY.md
- arch-doc-writer.md
- principal-engineer-reviewer.md
- README.md
- skills
- action.yml
- action.yml
- action.yml
- action.yml
- action.yml
- action.yml
- action.yml
- vouch-request.yml
- bug_report.yml
- config.yml
- feature_request.yml
- branch-checks.yml
- branch-docs.yml
- branch-e2e.yml
- cargo-deny.yml
- ci-image.yml
- dco.yml
- deb-package.yml
- docker-build.yml
- driver-vm-linux.yml
- driver-vm-macos.yml
- e2e-gpu-test.yaml
- e2e-kubernetes-test.yml
- e2e-label-help.yml
- e2e-test.yml
- helm-lint.yml
- issue-triage.yml
- publish-docs-website.yml
- release-auto-tag.yml
- release-canary.yml
- release-dev.yml
- release-tag.yml
- release-vm-kernel.yml
- required-ci-gates.yml
- rpm-package.yml
- rust-cache-seed.yml
- rust-native-build.yml
- snap-package.yml
- stale.yml
- supervisor-static-validate.yml
- sync-docs.yml
- vouch-check.yml
- vouch-command.yml
- windows-msvc.yml
- CODEOWNERS
- copy-pr-bot.yaml
- dependabot.yml
- PULL_REQUEST_TEMPLATE.md
- VOUCHED.td
- arch-doc-writer.md
- principal-engineer-reviewer.md
- build.md
- compute-runtimes.md
- gateway.md
- google-vertex-ai-provider.md
- README.md
- sandbox-limits.md
- sandbox.md
- security-policy.md
- windows-msvc-build.md
- build.rs
- build_windows.rs
- edge_token.rs
- jwt.rs
- lib.rs
- metadata.rs
- mtls.rs
- oidc_token.rs
- paths.rs
- pki.rs
- Cargo.toml
- common.rs
- gateway.rs
- mod.rs
- auth.rs
- completers.rs
- edge_tunnel.rs
- lib.rs
- main.rs
- oidc_auth.rs
- output.rs
- policy_update.rs
- run.rs
- ssh.rs
- test_utils.rs
- tls.rs
- fake_forward.rs
- mod.rs
- ensure_providers_integration.rs
- mtls_integration.rs
- provider_commands_integration.rs
- sandbox_create_lifecycle_integration.rs
- sandbox_name_fallback_integration.rs
- sandbox_upload_integration.rs
- Cargo.toml
- mod.rs
- activity.rs
- auth.rs
- config.rs
- container_paths.rs
- denial.rs
- driver_mounts.rs
- driver_utils.rs
- endpoint_path.rs
- error.rs
- external_driver_socket.rs
- forward.rs
- google_cloud.rs
- gpu.rs
- grpc_client.rs
- host_pattern.rs
- image.rs
- inference.rs
- jwt.rs
- lib.rs
- metadata.rs
- middleware.rs
- net.rs
- operator_namespace_allowlist.rs
- paths.rs
- policy.rs
- progress.rs
- proposals.rs
- proto_struct.rs
- provider_credentials.rs
- sandbox_env.rs
- secrets.rs
- settings.rs
- telemetry.rs
- time.rs
- transport_errors.rs
- build.rs
- Cargo.toml
- README.md
- lib.rs
- Cargo.toml
- lib.rs
- main.rs
- tests.rs
- Cargo.toml
- README.md
- config.rs
- driver.rs
- grpc.rs
- lib.rs
- main.rs
- Cargo.toml
- README.md
- lib.rs
- main.rs
- Cargo.toml
- client.rs
- config.rs
- container.rs
- driver.rs
- grpc.rs
- lib.rs
- main.rs
- otel_tracing.rs
- test_utils.rs
- watcher.rs
- Cargo.toml
- NETWORKING.md
- README.md
- lib.rs
- main.rs
- Cargo.toml
- openshell.kconfig
- pins.env
- README.md
- openshell-vm-sandbox-init.sh
- mod.rs
- driver.rs
- embedded_runtime.rs
- ffi.rs
- gpu.rs
- lib.rs
- lifecycle.rs
- main.rs
- nft_ruleset.rs
- otel_tracing.rs
- procguard.rs
- rootfs.rs
- runtime.rs
- build.rs
- Cargo.toml
- entitlements.plist
- README.md
- auth.rs
- identity.rs
- jwt.rs
- lib.rs
- store.rs
- transport.rs
- Cargo.toml
- README.md
- lib.rs
- plan.rs
- profile_source.rs
- proto_json.rs
- routes.rs
- runtime.rs
- Cargo.toml
- application_lifecycle.json
- base_event.json
- detection_finding.json
- device_config_state_change.json
- http_activity.json
- network_activity.json
- process_activity.json
- ssh_activity.json
- actor.json
- attack.json
- connection_info.json
- container.json
- device.json
- evidences.json
- finding_info.json
- firewall_rule.json
- http_request.json
- http_response.json
- metadata.json
- network_endpoint.json
- network_proxy.json
- process.json
- product.json
- remediation.json
- url.json
- VERSION
- api_activity.json
- application_lifecycle.json
- base_event.json
- detection_finding.json
- device_config_state_change.json
- http_activity.json
- network_activity.json
- process_activity.json
- ssh_activity.json
- actor.json
- ai_model.json
- api.json
- attack.json
- connection_info.json
- container.json
- device.json
- evidences.json
- finding_info.json
- firewall_rule.json
- http_request.json
- http_response.json
- metadata.json
- network_endpoint.json
- network_proxy.json
- process.json
- product.json
- remediation.json
- url.json
- ai_operation.json
- VERSION
- README.md
- api_activity.rs
- base.rs
- config.rs
- finding.rs
- http.rs
- lifecycle.rs
- mod.rs
- network.rs
- process.rs
- ssh.rs
- action.rs
- activity.rs
- auth.rs
- disposition.rs
- http_method.rs
- launch.rs
- mod.rs
- security.rs
- severity.rs
- status.rs
- api_activity.rs
- app_lifecycle.rs
- base_event.rs
- config_state_change.rs
- detection_finding.rs
- http_activity.rs
- mod.rs
- network_activity.rs
- process_activity.rs
- serde_helpers.rs
- ssh_activity.rs
- jsonl.rs
- mod.rs
- shorthand.rs
- ai_model.rs
- api.rs
- attack.rs
- connection.rs
- container.rs
- device.rs
- endpoint.rs
- finding.rs
- firewall_rule.rs
- http.rs
- metadata.rs
- mod.rs
- process.rs
- event_bridge.rs
- jsonl_layer.rs
- mod.rs
- shorthand_layer.rs
- mod.rs
- schema.rs
- ctx.rs
- lib.rs
- Cargo.toml
- grpc.rs
- lib.rs
- propagation.rs
- Cargo.toml
- ambiguity.rs
- compose.rs
- l7_validate.rs
- lib.rs
- merge.rs
- middleware.rs
- Cargo.toml
- github.yaml
- claude.yaml
- curl.yaml
- gh.yaml
- git.yaml
- nc.yaml
- node.yaml
- python3.yaml
- ssh.yaml
- wget.yaml
- accepted_risks.rs
- credentials.rs
- finding.rs
- lib.rs
- model.rs
- policy.rs
- queries.rs
- registry.rs
- report.rs
- accepted-risks.yaml
- credentials.yaml
- empty-policy.yaml
- policy.yaml
- Cargo.toml
- README.md
- anthropic.rs
- claude.rs
- codex.rs
- copilot.rs
- deepinfra.rs
- generic.rs
- github.rs
- gitlab.rs
- google_cloud.rs
- mod.rs
- nvidia.rs
- openai.rs
- opencode.rs
- outlook.rs
- vertex.rs
- context.rs
- discovery.rs
- lib.rs
- profiles.rs
- test_helpers.rs
- Cargo.toml
- README.md
- backend.rs
- config.rs
- lib.rs
- mock.rs
- backend_integration.rs
- Cargo.toml
- README.md
- activity_aggregator.rs
- denial_aggregator.rs
- google_cloud_metadata.rs
- lib.rs
- main.rs
- mechanistic_mapper.rs
- metadata_server.rs
- sidecar_control.rs
- stdout_logging.rs
- Cargo.toml
- auth.rs
- client.rs
- config.rs
- edge_tunnel.rs
- error.rs
- lib.rs
- oidc.rs
- raw.rs
- refresh.rs
- transport.rs
- types.rs
- client_mock.rs
- Cargo.toml
- README.md
- 001_create_objects.sql
- 004_add_object_metadata.sql
- 005_add_resource_version.sql
- 006_add_workspace_column.sql
- 001_create_objects.sql
- 004_add_object_metadata.sql
- 005_add_resource_version.sql
- 006_add_workspace_column.sql
- authenticator.rs
- authz.rs
- descriptor_authz.rs
- extension_mint_limit.rs
- guard.rs
- http.rs
- identity.rs
- k8s_sa.rs
- method_authz.rs
- mod.rs
- oidc.rs
- principal.rs
- sandbox_jwt.rs
- sandbox_methods.rs
- workspace_authz.rs
- builtin.rs
- driver_config.rs
- lease.rs
- mod.rs
- vm.rs
- auth_rpc.rs
- mod.rs
- policy.rs
- provider.rs
- sandbox.rs
- service.rs
- validation.rs
- workspace.rs
- mod.rs
- postgres.rs
- sqlite.rs
- tests.rs
- certgen.rs
- cli.rs
- config_file.rs
- credentials.rs
- defaults.rs
- gateway_listener.rs
- http.rs
- inference.rs
- lib.rs
- main.rs
- middleware.rs
- multiplex.rs
- otel_tracing.rs
- policy_store.rs
- provider_profile_sources.rs
- provider_refresh.rs
- readiness.rs
- sandbox_index.rs
- sandbox_watch.rs
- service_routing.rs
- ssh_sessions.rs
- supervisor_session.rs
- telemetry.rs
- test_support.rs
- tls.rs
- tls_test_utils.rs
- tracing_bus.rs
- tracing_setup.rs
- ws_tunnel.rs
- mod.rs
- auth_endpoint_integration.rs
- edge_tunnel_auth.rs
- health_endpoint_integration.rs
- multiplex_integration.rs
- multiplex_tls_integration.rs
- supervisor_relay_integration.rs
- ws_tunnel_integration.rs
- Cargo.toml
- lib.rs
- Cargo.toml
- headers.rs
- lib.rs
- remote.rs
- websocket.rs
- Cargo.toml
- lib.rs
- regex.rs
- Cargo.toml
- sandbox-policy.rego
- graphql.rs
- http.rs
- inference.rs
- jsonrpc.rs
- middleware.rs
- mod.rs
- path.rs
- provider.rs
- relay.rs
- rest.rs
- tls.rs
- token_grant_injection.rs
- websocket.rs
- mod.rs
- name.rs
- resolver.rs
- runtime.rs
- store.rs
- wire.rs
- compatibility.rs
- destination.rs
- egress.rs
- relay.rs
- identity.rs
- inference_routes.rs
- lib.rs
- opa.rs
- policy_local.rs
- procfs.rs
- proxy.rs
- run.rs
- sigv4.rs
- spiffe_endpoint.rs
- token_grant.rs
- upstream_proxy.rs
- sandbox-policy.yaml
- accept_fd_exhaustion.rs
- sigv4_localstack.rs
- system_inference.rs
- websocket_upgrade.rs
- Cargo.toml
- mod.rs
- procfs.rs
- mod.rs
- nft_ruleset.rs
- landlock.rs
- mod.rs
- seccomp.rs
- mod.rs
- SKILL.md
- policy_advisor.md
- child_env.rs
- debug_rpc.rs
- identity.rs
- lib.rs
- log_push.rs
- main_session.rs
- managed_children.rs
- process.rs
- run.rs
- skills.rs
- ssh.rs
- supervisor_session.rs
- unix_socket.rs
- Cargo.toml
- create_provider.rs
- create_sandbox.rs
- dashboard.rs
- global_settings.rs
- mod.rs
- providers.rs
- sandbox_detail.rs
- sandbox_draft.rs
- sandbox_logs.rs
- sandbox_policy.rs
- sandbox_settings.rs
- sandboxes.rs
- splash.rs
- app.rs
- clipboard.rs
- event.rs
- lib.rs
- theme.rs
- Cargo.toml
- bind.rs
- error.rs
- gpu.rs
- lib.rs
- pci.rs
- reconcile.rs
- sysfs.rs
- test_support.rs
- Cargo.toml
- control.in
- openshell-gateway.service
- postinst.sh
- postrm.sh
- prerm.sh
- .dockerignore
- cross-build.sh
- docker-compose.yml
- Dockerfile.ci
- Dockerfile.cli-macos
- Dockerfile.driver-vm-macos
- Dockerfile.gateway
- Dockerfile.gateway-macos
- Dockerfile.python-wheels
- Dockerfile.python-wheels-macos
- Dockerfile.supervisor
- gateway.toml
- values-cert-manager.yaml
- values-corporate-proxy-e2e.yaml
- values-credential-driver-kubernetes-secrets.yaml
- values-credential-driver-vault.yaml
- values-gateway-tls.yaml
- values-gateway.yaml
- values-high-availability.yaml
- values-keycloak.yaml
- values-openshift-route-cert-manager.yaml
- values-sidecar-kata.yaml
- values-sidecar.yaml
- values-skaffold.yaml
- values-spire-stack.yaml
- values-spire.yaml
- values-tls-disabled.yaml
- values-workspace-managed.yaml
- values-workspace-operator.yaml
- _gateway-workload.tpl
- _helpers.tpl
- agent-sandbox-preflight.yaml
- cert-manager-pki.yaml
- certgen.yaml
- clusterrole.yaml
- clusterrolebinding.yaml
- credential-secrets-role.yaml
- credential-secrets-rolebinding.yaml
- credential-storage-key-encryption-key-secret.yaml
- deployment.yaml
- gateway-config.yaml
- gateway.yaml
- grpcroute.yaml
- networkpolicy.yaml
- role.yaml
- rolebinding.yaml
- route.yaml
- service.yaml
- serviceaccount.yaml
- statefulset.yaml
- agent_sandbox_preflight_test.yaml
- cert_manager_pki_test.yaml
- certgen_test.yaml
- clusterrole_test.yaml
- credential_drivers_test.yaml
- gateway_config_test.yaml
- route_test.yaml
- sandbox_namespace_test.yaml
- sandbox_service_account_test.yaml
- statefulset_client_ca_test.yaml
- .helmignore
- Chart.yaml
- README.md
- README.md.gotmpl
- skaffold.yaml
- values.yaml
- nvidia-device-plugin-helmchart.yaml
- envoy-gateway-openshell.yaml
- openshell-helmchart.yaml
- openshell-gateway.8.md
- openshell.1.md
- CONFIGURATION.md
- gateway.toml.default
- QUICKSTART.md
- TROUBLESHOOTING.md
- resolve_licenses.py
- resolve_licenses_test.py
- sbom_to_csv.py
- BadgeLinks.tsx
- CommandTerminal.tsx
- jsx.d.ts
- container-gateway.mdx
- how-it-works.mdx
- installation.mdx
- overview.mdx
- release-notes.mdx
- supported-agents.mdx
- favicon-16.png
- favicon-180.png
- favicon-32.png
- favicon-48.png
- favicon-512.png
- favicon.svg
- openshell-avatar-1024.png
- openshell-avatar-512.png
- openshell-avatar-dark-1024.png
- openshell-avatar-dark-512.png
- openshell-banner-dark.png
- openshell-banner-light.png
- openshell-lockup-horizontal-dark.png
- openshell-lockup-horizontal-reversed.svg
- openshell-lockup-horizontal.png
- openshell-lockup-horizontal.svg
- openshell-lockup-stacked-dark.png
- openshell-lockup-stacked-reversed.svg
- openshell-lockup-stacked.png
- openshell-lockup-stacked.svg
- openshell-mark-mono-black.svg
- openshell-mark-mono-white.svg
- openshell-mark-reversed.svg
- openshell-mark.svg
- gateway-interceptors.mdx
- supervisor-middleware.mdx
- docker-compose.mdx
- first-network-policy.mdx
- github-sandbox.mdx
- index.mdx
- inference-ollama.mdx
- local-inference-lmstudio.mdx
- microsoft-graph-provider-refresh.mdx
- quickstart.mdx
- access-control.mdx
- ingress.mdx
- managing-certificates.mdx
- openshift.mdx
- setup.mdx
- topology.mdx
- accessing-logs.mdx
- logging.mdx
- ocsf-json-export.mdx
- aws-sigv4.mdx
- google-cloud.mdx
- google-vertex-ai.mdx
- default-policy.mdx
- gateway-auth.mdx
- gateway-config.mdx
- policy-schema.mdx
- sandbox-compute-drivers.mdx
- support-matrix.mdx
- license.mdx
- inference-routing.mdx
- manage-gateways.mdx
- manage-providers.mdx
- manage-sandboxes.mdx
- manage-workspaces.mdx
- policies.mdx
- policy-advisor.mdx
- providers-v2.mdx
- best-practices.mdx
- .markdownlint-cli2.jsonc
- CONTRIBUTING.mdx
- index.mdx
- index.yml
- docker.toml
- podman.toml
- Dockerfile.external-kubernetes-gateway
- Dockerfile
- README.md
- workload.sh
- Dockerfile
- README.md
- workload.sh
- Dockerfile
- README.md
- workload.sh
- README.md
- kustomization.yaml
- plugin.yaml
- post-renderer.sh
- workload-patch.yaml
- postgres-fixture.yaml
- client-through-openshell.sh
- Dockerfile.client
- Dockerfile.client.dockerignore
- expected-failures.yml
- host-bridge.py
- policy-template.yaml
- README.md
- render-policy.py
- runner-shim.mjs
- mechanistic-smoke.sh
- policy.template.yaml
- README.md
- sandbox-runner.sh
- test.sh
- wait-smoke.sh
- __init__.py
- conftest.py
- helpers.py
- oidc_auth_test.py
- workspace_authz_test.py
- conftest.py
- test_inference_routing.py
- test_policy_validation.py
- test_sandbox_api.py
- test_sandbox_exec_python.py
- test_sandbox_landlock.py
- test_sandbox_policy.py
- test_sandbox_providers.py
- test_sandbox_venv.py
- test_security_tls.py
- test_workspace_api.py
- binary.rs
- cli.rs
- container.rs
- gateway.rs
- mod.rs
- output.rs
- port.rs
- sandbox.rs
- lib.rs
- device_selection.rs
- workloads.rs
- bypass_detection.rs
- cf_auth_smoke.rs
- cli_smoke.rs
- community_image.rs
- core_dump_hardening.rs
- credential_drivers.rs
- credential_gating.rs
- custom_image.rs
- docker_preflight.rs
- driver_config_volume.rs
- edge_tunnel_e2e.rs
- forward_proxy_graphql_l7.rs
- forward_proxy_jsonrpc_l7.rs
- forward_proxy_l7_bypass.rs
- gateway_start.rs
- gpu.rs
- host_gateway_alias.rs
- kubernetes_corporate_proxy.rs
- landlock.rs
- live_policy_update.rs
- local_driver_token_restart.rs
- no_proxy.rs
- oidc_pkce.rs
- podman_corporate_proxy.rs
- podman_gateway_start.rs
- podman_oci_identity.rs
- podman_userns.rs
- port_forward.rs
- provider_auto_create.rs
- provider_refresh_handles.rs
- proxy_egress_pipeline.rs
- readyz_health.rs
- sandbox_labels.rs
- sandbox_lifecycle.rs
- settings_management.rs
- smoke.rs
- sync.rs
- transparent_tcp.rs
- upload_create.rs
- user_namespaces.rs
- vm_gateway_start.rs
- websocket_conformance.rs
- workspace_lifecycle.rs
- workspace_namespace_managed.rs
- workspace_namespace_operator.rs
- Cargo.lock
- Cargo.toml
- e2e-docker.sh
- e2e-kubernetes.sh
- e2e-openshift.sh
- e2e-podman-rootless.sh
- e2e-podman.sh
- e2e-vm.sh
- capbset-probe.c
- gateway-common.sh
- install-agent-sandbox.sh
- musl-dns-probe.c
- mcp-conformance.sh
- no-compute-driver-gateway.sh
- run.sh
- with-docker-gateway.sh
- with-keycloak.sh
- with-kube-gateway.sh
- with-podman-gateway.sh
- agent-task.md
- demo.sh
- policy.template.yaml
- README.md
- sandbox-agent.sh
- app.py
- Dockerfile
- README.md
- github.yaml
- slack.yaml
- main.rs
- policy_hash.rs
- proto_json.rs
- smoke_client.rs
- tests.rs
- Cargo.lock
- Cargo.toml
- policy.yaml
- README.md
- smoke.sh
- inference.py
- README.md
- routes.yaml
- sandbox-policy.yaml
- synthesis.md
- worker.md
- .gitignore
- demo.sh
- policy.template.yaml
- README.md
- runner.sh
- ctf.py
- README.md
- sandbox-policy.yaml
- Dockerfile
- README.md
- server.py
- demo.sh
- policy.yaml
- README.md
- kustomization.yaml
- protected-service.js
- token-issuer.js
- workloads.yaml
- demo.sh
- provider-profile.yaml
- README.md
- main.rs
- Cargo.lock
- Cargo.toml
- policy.yaml
- README.md
- smoke.sh
- demo.sh
- policy.yaml
- README.md
- redis_client.py
- aws-s3-sts.md
- gateway-deploy-connect.md
- sync-files.md
- vscode-remote-sandbox.md
- architecture.svg
- openshell-terminal.png
- NVIDIA_dark.svg
- NVIDIA_light.svg
- NVIDIA_symbol.svg
- CustomFooter.tsx
- docs.yml
- fern.config.json
- main.css
- docker.yml
- podman.yml
- selinux.yml
- centos.nix
- fedora.nix
- rocky.nix
- ubuntu.nix
- cache-lib.sh
- cache-seal.sh
- cache.sh
- default.nix
- README.md
- run.sh
- compute_driver.proto
- credential_driver.proto
- datamodel.proto
- gateway_interceptor.proto
- inference.proto
- openshell.proto
- options.proto
- sandbox.proto
- supervisor_middleware.proto
- test.proto
- aws-bedrock.yaml
- aws-s3.yaml
- aws.yaml
- claude-code.yaml
- codex.yaml
- copilot.yaml
- cursor.yaml
- deepinfra.yaml
- github.yaml
- google-cloud.yaml
- google-vertex-ai.yaml
- nvidia.yaml
- pypi.yaml
- __init__.py
- __init__.py
- openshell_test.py
- py.typed
- release_formula_test.py
- sandbox.py
- sandbox_test.py
- release_tooling_test.py
- README.md
- README.md
- README.md
- README.md
- README.md
- current-shape.md
- implementation-plan.md
- README.md
- technical-design.md
- README.md
- deployment-options.md
- extension-authentication.md
- protocol-extensions.md
- README.md
- extension-authentication.md
- README.md
- README.md
- README.md
- build-matrix.md
- README.md
- release-qualification.md
- release-version-selection.md
- README.md
- gh
- gh_guard_test.sh
- review-feedback-ledger
- review_feedback_ledger_test.sh
- validate-review-findings
- validate_review_findings_test.sh
- gator.md
- codex-gator.yaml
- github-gator.yaml
- review-findings-schema.md
- SKILL.md
- .gitignore
- agent.yaml
- Dockerfile
- policy.yaml
- README.md
- exec.sh
- install-codex.sh
- subagent.sh
- entrypoint.sh
- subagent.sh
- supervisor.sh
- supervisor_test.sh
- README.md
- run.sh
- openshell
- lint-mermaid.mjs
- package-lock.json
- package.json
- baseline_workflow_metrics.py
- docker-cleanup.sh
- generate_third_party_notices.py
- keycloak-dev.sh
- keycloak-realm.json
- smoke-test-network-policy.sh
- test-release-tag.sh
- update_license_headers.py
- client.md
- config.md
- edge.md
- exec.md
- fake.md
- files.md
- gateway.md
- health.md
- oidc.md
- overview.md
- policy.md
- profiles.md
- providers.md
- refresh.md
- sandboxes.md
- services.md
- ssh.md
- tcp.md
- architecture.md
- error-handling.md
- getting-started.md
- introduction.md
- SUMMARY.md
- testing.md
- custom.css
- book.toml
- cloudflare.go
- cloudflare_test.go
- doc.go
- tunnel.go
- tunnel_test.go
- broadcaster.go
- broadcaster_test.go
- config.go
- config_test.go
- doc.go
- exec.go
- exec_test.go
- fake.go
- fake_test.go
- file.go
- file_test.go
- health.go
- health_test.go
- inference.go
- inference_test.go
- policy.go
- policy_test.go
- profile.go
- profile_test.go
- provider.go
- provider_test.go
- refresh.go
- refresh_test.go
- sandbox.go
- sandbox_test.go
- service.go
- service_test.go
- ssh.go
- ssh_test.go
- store.go
- store_test.go
- tcp.go
- tcp_test.go
- workspace.go
- workspace_test.go
- config.go
- config_test.go
- doc.go
- errors.go
- errors_test.go
- gateway.go
- gateway_test.go
- options.go
- paths.go
- paths_test.go
- token.go
- token_test.go
- copy.go
- coverage_test.go
- errors.go
- errors_test.go
- exec.go
- exec_test.go
- health.go
- health_test.go
- inference.go
- inference_test.go
- log.go
- log_test.go
- network_policy.go
- network_policy_test.go
- policy.go
- policy_test.go
- profile.go
- profile_test.go
- provider.go
- provider_test.go
- refresh.go
- refresh_test.go
- sandbox.go
- sandbox_test.go
- service.go
- service_test.go
- setting.go
- setting_test.go
- ssh.go
- ssh_test.go
- time.go
- time_test.go
- workspace.go
- workspace_test.go
- conn.go
- conn_test.go
- authcode.go
- authcode_test.go
- browser.go
- browser_test.go
- credentials.go
- credentials_test.go
- device.go
- device_test.go
- discovery.go
- discovery_test.go
- doc.go
- errors.go
- errors_test.go
- example_test.go
- keyboard.go
- keyboard_test.go
- oidc.go
- oidc_test.go
- options.go
- options_test.go
- token.go
- token_test.go
- auth.go
- config.go
- doc.go
- errors.go
- exec.go
- health.go
- inference.go
- log.go
- logger.go
- network_policy.go
- options.go
- policy.go
- profile.go
- provider.go
- refresh.go
- sandbox.go
- service.go
- setting.go
- ssh.go
- types.go
- watch.go
- workspace.go
- auth.go
- auth_extra.go
- auth_extra_test.go
- auth_refresh.go
- auth_refresh_test.go
- auth_test.go
- client.go
- client_test.go
- config.go
- config_client.go
- config_client_test.go
- context_errors.go
- context_errors_test.go
- doc.go
- errors.go
- errors_test.go
- example_fake_test.go
- example_test.go
- exec.go
- exec_client.go
- exec_client_test.go
- file.go
- file_client.go
- file_client_test.go
- health.go
- health_client.go
- health_client_test.go
- inference.go
- inference_client.go
- inference_client_test.go
- integration_test.go
- logger.go
- options.go
- policy.go
- policy_client.go
- policy_client_test.go
- profile.go
- profile_client.go
- profile_client_test.go
- provider.go
- provider_client.go
- provider_client_test.go
- refresh.go
- refresh_client.go
- refresh_client_test.go
- sandbox.go
- sandbox_client.go
- sandbox_client_test.go
- service.go
- service_client.go
- service_client_test.go
- ssh.go
- ssh_client.go
- ssh_client_test.go
- tcp.go
- tcp_client.go
- tcp_client_test.go
- types.go
- types_reexport.go
- watch.go
- watch_test.go
- workspace.go
- workspace_client.go
- workspace_test.go
- datamodel.pb.go
- inference.pb.go
- inference_grpc.pb.go
- openshell.pb.go
- openshell_grpc.pb.go
- options.pb.go
- sandbox.pb.go
- .golangci.yml
- buf.gen.yaml
- go.mod
- go.sum
- mise.toml
- README.md
- client.test.ts
- client.ts
- errors.test.ts
- errors.ts
- index.ts
- raw.ts
- ssh-validate.ts
- transport.test.ts
- transport.ts
- .gitignore
- biome.json
- buf.gen.yaml
- package-lock.json
- package.json
- README.md
- tsconfig.build.json
- tsconfig.json
- vitest.config.ts
- icon.png
- term.desktop
- _lib.sh
- build-libkrun-macos.sh
- build-libkrun.sh
- build-supervisor-bundle.sh
- compress-vm-runtime.sh
- download-kernel-runtime.sh
- package-vm-runtime.sh
- smoke-orphan-cleanup.sh
- vm-setup.sh
- build-env.sh
- container-engine.sh
- docker-build-ci.sh
- docker-build-image.sh
- docker-publish-multiarch.sh
- e2e-gpu-build-images.sh
- gateway-docker.sh
- gateway-vm.sh
- gateway.sh
- generate_python_proto.py
- helm-k3s-local.sh
- keycloak-k8s-setup.sh
- package-deb-install.sh
- package-deb.sh
- release.py
- sandbox.sh
- setup-zig-cc-wrapper.sh
- snap-gateway-wrapper.sh
- stage-prebuilt-binaries.sh
- sync_docs_website.py
- sync_docs_website_test.py
- test-build-env.sh
- test-install-sh.sh
- test-packaging-assets.sh
- verify-glibc-symbols.sh
- verify-static-binary.sh
- verify-telemetry-compiled-out.sh
- windows-msvc.ps1
- ci.toml
- docker.toml
- docs.toml
- gateway.toml
- go.toml
- helm.toml
- keycloak.toml
- license.toml
- markdown.toml
- notices.toml
- package.toml
- python.toml
- rust.toml
- sandbox.toml
- sbom.toml
- term.toml
- test.toml
- typescript.toml
- version.toml
- vm.toml
- windows.toml
- 2026-07-08.md
- 2026-07-26.md
- 2026-08-10.md
- README.md
- .dockerignore
- .env.example
- .gitattributes
- .gitignore
- .markdownlint-cli2.jsonc
- .packit.yaml
- .python-version
- about.toml
- AGENTS.md
- buf.yaml
- Cargo.lock
- Cargo.toml
- CI.md
- CLAUDE.md
- CONTRIBUTING.md
- DCO
- deny.toml
- flake.lock
- flake.nix
- install.sh
- LICENSE
- mise.lock
- mise.toml
- openshell.spec
- pyproject.toml
- README.md
- rust-toolchain.toml
- SECURITY.md
- snapcraft.yaml
- STYLEGUIDE.md
- TESTING.md
- THIRD-PARTY-NOTICES
- uv.lock
# Installation Guide
1. Get the code
git clone https://github.com/NVIDIA/OpenShell
Downloads the entire project code from GitHub to your computer.
cd OpenShell
Moves into the project folder you just downloaded.
2. Official Install Script
Easy Recommendedcurl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
Downloads and runs the official install script in one line β this handles the full setup automatically.
After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.
Pulled directly from this repo's README.
3. Docker
EasyPrerequisites
- Git Needed to download the project code from GitHub.
- Docker Desktop Needed to build and run containers. Install it and keep it running in the background.
β οΈ This is a large repository, so this method may point to an internal sub-package rather than the actual core product. Check the full README as well.
docker compose -f deploy/docker/docker-compose.yml up -d --build
Runs the command against the services defined in the compose file.
Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.
4. Node.js
EasyPrerequisites
β οΈ This is a large repository, so this method may point to an internal sub-package rather than the actual core product. Check the full README as well.
cd scripts/lint-mermaid
This project's files live in a subfolder, so move into it first.
npm install
Downloads and installs the libraries listed in package.json.
npm start
Starts the development/run server.
After running the command, open the address shown in the terminal (usually something like http://localhost:3000) in your browser.
5. Python
EasyPrerequisites
pip install .
Installs the package published on PyPI directly β no need to clone the source.
python <μ€νν νμΌλͺ
>.py # READMEμμ μ νν μ€ν νμΌλͺ
μ νμΈνμΈμ
Runs the Python script (or module).
If it runs without errors and prints output in the terminal, it worked.
6. Go
MediumPrerequisites
β οΈ This is a large repository, so this method may point to an internal sub-package rather than the actual core product. Check the full README as well.
cd sdk/go
This project's files live in a subfolder, so move into it first.
go build ./...
Compiles the Go program into an executable.
go run .
Runs the Go program directly without a separate build step.
If the build finishes without errors, it worked. If you used go run ., check the terminal output.
7. Rust
MediumPrerequisites
- Git Needed to download the project code from GitHub.
- Rust (rustup) Installing via rustup also installs cargo.
cargo build --release
Compiles the Rust project.
cargo run
Builds and then immediately runs the program.
If cargo build finishes without errors, it worked. The executable is created under target/.
// repository documentation
Was this content helpful?
(0 ratings)