NVIDIA has released a new version of OpenShell, which runs autonomous AI agents in isolation. It makes explicit where authentication data goes in outbound requests and requires separate allow rules for WebSocket connections, which support real-time two-way communication. Developers and operators connecting agents to services need to review existing authentication settings and communication policies.

1. Specify credential placement in requests

Static provider credentials without placement metadata now resolve only to the Authorization header or explicitly enabled body or WebSocket rewrite policies. Inserting authentication data by rewriting requests requires enabling the corresponding policy.

Placing credentials in custom headers such as x-api-key, URL query parameters, or designated path positions requires a placement declaration. The auth_style setting selects the placement method actually used, and fields for other methods are ignored. Configuration now selects not only the credential contents but also where they are attached to requests.

2. WebSockets require allow rules

REST endpoints that accept HTTP requests return 403 for HTTP upgrade requests in both enforcement and audit modes. Requests to switch a regular HTTP connection to WebSocket must use WebSocket policies rather than existing REST rules.

Using WebSockets requires specifying WebSocket as the protocol and configuring rules for the initial connection handshake and subsequent messages. WebSocket credential rewriting can also be enabled only when a WebSocket endpoint is configured. Operators must explicitly define what is allowed when opening connections and processing messages.

3. Changes to file and network boundaries and audit paths

Sandbox startup fails if a file policy path traverses a symbolic link in a writable workspace that points elsewhere. This also applies in best-effort mode, which performs only the enforcement actions available. Policies must specify the actual path targeted by the link.

Transparent TCP connections, which relay traffic while preserving its original destination, evaluate IPv6 destinations containing IPv4 addresses as IPv4. Network rules using this destination format must switch to IPv4 addresses. This aligns address notation with policy evaluation, even when the destination is unchanged.

The location identifying the sandbox responsible for activity in audit records has also changed. The supervisor, the sandbox-side management component, writes identifying information to the device's container entry. The gateway, which relays requests, records it in the resource list or a separate sandbox entry, depending on the event type. Security log parsers that read the old top-level container field must update their mappings.

Diagnostics for AWS SigV4, an authentication method that signs AWS requests, are no longer written to the supervisor's detailed trace logs. This reduces a path through which temporary session tokens could be exposed in logs.

4. Memory and failure handling improvements

According to the company, a fix addresses gateway memory retained after sandbox deletion, which could exhaust memory through repeated creation and deletion. The gateway also no longer preallocates about 3.4 MiB of stream buffers per sandbox, memory areas that temporarily store data flows. This reduces memory overhead in operations that frequently create and delete sandboxes.

According to the company, gateway requests end with a retryable UNAVAILABLE error within about 5 seconds when PostgreSQL is unreachable. A gateway started during an outage also becomes ready when the database returns, rather than entering a repeated shutdown and restart cycle.

The company says deleting sandboxes in Kubernetes no longer waits for the 30-second termination grace period for pods, units that run containers together. This figure refers to the grace period previously waited out, not the total deletion time.

5. What should operators check?

The release notes instruct operators to upgrade the gateway before the supervisor. Previously imported profiles also need updating where necessary. Editing only the reference YAML does not update the gateway's catalog.

The release notes provide this quick installation command:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.8 sh

This release clarifies credential placement and network access boundaries while improving repeated gateway operation and failure recovery. The corresponding work involves configuration changes, checking upgrade order, and updating existing audit parsers and network policies.

v0.1.8 refines both sandbox security boundaries and operational resilience, and operators using existing configurations must align their policies and deployment order.