NVIDIA Donates OpenShell to CNCF and Adds Open-Source AI Factory Tools

NVIDIA announced on November 10, 2026, at KubeCon + CloudNativeCon that it is contributing its OpenShell agent-security runtime to the Cloud Native Computing Foundation (CNCF) Sandbox and releasing three open-source components for its DSX AI Factory Platform.

The announcements connect agent governance with the infrastructure needed to run agents efficiently. NVIDIA is also contributing to the Google-originated Agent Substrate project and adding Kubernetes Engine, Kubernetes Recipes and Snapshot to DSX, covering session execution, cluster management and inference recovery.

OpenShell Moves Toward Community Governance

OpenShell applies deterministic controls as autonomous agents use tools, access inference services and execute workloads. It runs agents in kernel-isolated sandboxes with declarative YAML policies covering filesystem, network, process and provider-credential access. Credentials are inserted only into requests bound for approved endpoints, and formal verification checks whether a proposed policy change would grant risky new access before approval.

The runtime is licensed under Apache 2.0. NVIDIA reports that hundreds of organizations have used it, that tens of thousands of contributions have arrived in less than a year, and that Sandbox governance will involve organizations building it into products. The transition is still underway: a project notice says development is moving to the ai-openshell organization, with code, issues and pull requests remaining at NVIDIA/OpenShell during the move.

Agent Substrate Targets Idle Compute

Agent Substrate addresses the cost of keeping agent sessions alive. Agents often wait for prompts, tool results or model responses; a dedicated warm Kubernetes Pod holds resources during those gaps, while recreating the Pod loses state and incurs another cold start. NVIDIA and Google are also collaborating on an OpenShell integration for agents across clouds and on-premises systems.

The Agent Substrate design maps many stateful sessions onto a smaller pool of warm workers. It checkpoints idle sessions, including memory and filesystem state, frees their workers and restores them onto available ones without repeating the normal Kubernetes Pod-creation path. The workers remain ordinary Kubernetes Pods, so cluster scheduling, quotas and placement policies continue to apply. Target workloads include coding assistants, reinforcement-learning environments and short-lived GPU research sandboxes.

NVIDIA is developing interoperability with Dynamo for inference and KAI Scheduler for shared cluster resources. Dynamo can supply projected time to first token and GPU-pool saturation so Agent Substrate can decide whether to keep an agent resident, suspend it or resume it. Its APIs are still changing, GPU support is being rebuilt around Kubernetes Dynamic Resource Allocation, and parts of the Dynamo integration are experimental.

DSX Adds Cluster Management and Faster Restores

NVIDIA Kubernetes Engine and NVIDIA Kubernetes Recipes (NVKE and NVKR) are available in public preview under Apache 2.0. NVIDIA says their APIs, configuration and behavior may change and does not yet recommend them for production workloads. NVKR builds reproducible node images, container images, binaries and Helm charts from version-pinned sources and records the inputs. NVKE uses those artifacts to provision and operate clusters through a REST API and controllers, though the projects can be adopted independently.

NVKE creates customer workload clusters with separate Kubernetes control planes, etcd instances and node pools. It obtains bare-metal capacity through NVIDIA Infra Controller and its Cluster API provider, CAPNICo; a node must present an attested SPIFFE identity before receiving join credentials. Firmus and SK Telecom are integrating the projects into their AI factories, while Mirantis, Netris, OpenNebula Systems, Rafay, Spectro Cloud and vCluster have integration plans involving their infrastructure platforms, managed Kubernetes offerings or network automation.

NVIDIA Snapshot addresses inference cold starts by checkpointing a fully initialized workload’s CPU and GPU memory. Restores require the same GPU model and driver and skip repeated weight loading, compilation and CUDA graph capture.

On B200 GPUs with VAST NFS storage, NVIDIA reports restores of 3.6 to 42.7 seconds across vLLM, SGLang and TensorRT LLM configurations, with speedups of 8x to 36x over cold starts. Tests ranged from a 600-million-parameter model to eight-GPU configurations with checkpoints approaching 1 TB. Checkpoint creation took 15 seconds to 5.5 minutes, and checkpoint-plus-restore time was shorter than one cold start in every tested configuration.

Those figures do not measure an entire machine startup: infrastructure provisioning and container-image loading are outside the timed restore path. The key-value cache is also released before each checkpoint rather than retained in the artifact, so the results concern restoring an initialized workload on compatible infrastructure.

Crusoe’s own GLM-5.3 test on NVIDIA HGX B300 used a checkpoint containing 594 GB of GPU state. Crusoe measured GPU-state restoration at 15.0 seconds from local NVMe versus 33.3 seconds from NFS. With the artifact on NVMe, pod creation to readiness took 31 seconds, compared with roughly eight minutes for a cold start, identifying storage as a major factor in restore performance. Crusoe has also contributed performance and diagnostic changes upstream.

Taken together, the projects put more of the AI factory control plane and recovery path into open repositories, but at different maturity levels: OpenShell’s governance move is incomplete, Agent Substrate is evolving, and NVKE and NVKR remain previews. Snapshot’s benchmarks provide the clearest measured operational gain, while its compatibility requirements and Crusoe’s storage results show that faster recovery depends on both reusable workload state and the infrastructure around it.