NVIDIA Donates OpenShell to CNCF, Ships Open-Source AI Factory Tools

NVIDIA announced on November 10, 2026, at KubeCon + CloudNativeCon that it is contributing its OpenShell agent-security runtime to the Cloud Native Computing Foundation (CNCF) Sandbox and releasing three open-source components for its DSX AI Factory Platform.

The package pairs agent governance with the infrastructure required to run agents cheaply and reliably. Alongside the OpenShell donation, NVIDIA said it is contributing to the Google-originated Agent Substrate project and adding Kubernetes Engine, Kubernetes Recipes and Snapshot to DSX. Together the three additions cover session execution, cluster management and inference recovery.

The stakes are operational, not cosmetic. Agents that wait idle on warm infrastructure burn compute budgets, and inference services that restart from scratch pay a cold-start tax measured in minutes. The announcements move more of the AI factory control plane and recovery path into open repositories — at very different maturity levels, which NVIDIA itself acknowledges.

What does OpenShell do under CNCF governance?

OpenShell applies deterministic controls as autonomous agents use tools, access inference services and execute workloads. It runs agents in kernel-isolated sandboxes governed by declarative YAML policies covering filesystem, network, process and provider-credential access. Credentials are inserted only into requests bound for approved endpoints, and formal verification checks whether a proposed policy change would grant risky new access before that change is approved.

The runtime is licensed under Apache 2.0. NVIDIA reports that hundreds of organizations have used it and that tens of thousands of contributions have arrived in less than a year. Under Sandbox governance, organizations building OpenShell into their products will take part in running the project.

The transition is incomplete. A project notice says development is moving to the ai-openshell organization, and code, issues and pull requests remain at NVIDIA/OpenShell during the move.

How does Agent Substrate cut idle compute costs?

Agent Substrate attacks the cost of keeping agent sessions alive. Agents spend much of their time waiting — for prompts, tool results or model responses — while a dedicated warm Kubernetes Pod holds resources during those gaps. Recreating the Pod loses state and triggers another cold start.

The Agent Substrate design maps many stateful sessions onto a smaller pool of warm workers. It checkpoints idle sessions, including memory and filesystem state, frees their workers, and restores the sessions onto available workers without repeating the normal Kubernetes Pod-creation path. The workers remain ordinary Kubernetes Pods, so cluster scheduling, quotas and placement policies continue to apply. Target workloads include coding assistants, reinforcement-learning environments and short-lived GPU research sandboxes.

NVIDIA and Google are also collaborating on an OpenShell integration for agents running across clouds and on-premises systems.

The project is young and NVIDIA says so. Its APIs are still changing, GPU support is being rebuilt around Kubernetes Dynamic Resource Allocation, and parts of the Dynamo integration are experimental. NVIDIA is developing interoperability with Dynamo for inference and KAI Scheduler for shared cluster resources. Dynamo can supply projected time to first token and GPU-pool saturation, giving Agent Substrate the signals it needs to decide whether to keep an agent resident, suspend it or resume it.

What do NVKE and NVKR change for cluster operators?

NVIDIA Kubernetes Engine and NVIDIA Kubernetes Recipes — NVKE and NVKR — are available in public preview under Apache 2.0. NVIDIA states plainly that their APIs, configuration and behavior may change, and it does not yet recommend either for production workloads.

The two projects split the work. NVKR builds reproducible node images, container images, binaries and Helm charts from version-pinned sources and records the inputs used. NVKE consumes those artifacts to provision and operate clusters through a REST API and controllers. The projects can also be adopted independently.

NVKE creates customer workload clusters with separate Kubernetes control planes, etcd instances and node pools. It obtains bare-metal capacity through NVIDIA Infra Controller and its Cluster API provider, CAPNICo. Security is enforced at the node: a node must present an attested SPIFFE identity before it receives join credentials.

Adoption is already scheduled. Firmus and SK Telecom are integrating the projects into their AI factories. Mirantis, Netris, OpenNebula Systems, Rafay, Spectro Cloud and vCluster have integration plans involving their infrastructure platforms, managed Kubernetes offerings or network automation.

How fast is NVIDIA Snapshot at restoring inference?

NVIDIA Snapshot delivers the clearest measured gain in the announcement: checkpointing a fully initialized workload's CPU and GPU memory so restores skip repeated weight loading, compilation and CUDA graph capture. Restores require the same GPU model and driver as the checkpointed workload.

On B200 GPUs with VAST NFS storage, NVIDIA reports restores of 3.6 to 42.7 seconds across vLLM, SGLang and TensorRT LLM configurations — speedups of 8x to 36x over cold starts. The tests ranged from a 600-million-parameter model to eight-GPU configurations with checkpoints approaching 1 TB. Checkpoint creation took 15 seconds to 5.5 minutes, and in every tested configuration the combined checkpoint-plus-restore time came in shorter than a single cold start.

The benchmark has boundaries. The figures do not measure an entire machine startup; infrastructure provisioning and container-image loading sit outside the timed restore path. The key-value cache is released before each checkpoint rather than retained in the artifact, so the results apply to restoring an initialized workload on compatible infrastructure — not to resuming a live serving session with its cache intact.

What did Crusoe measure on its own hardware?

Crusoe ran its own test of the same mechanism. Using a GLM-5.3 model on NVIDIA HGX B300 hardware, Crusoe restored a checkpoint containing 594 GB of GPU state. GPU-state restoration took 15.0 seconds from local NVMe versus 33.3 seconds from NFS.

Storage emerges as the dominant factor. With the artifact on NVMe, pod creation to readiness took 31 seconds, compared with roughly eight minutes for a cold start. Crusoe has also contributed performance and diagnostic changes upstream to the project.

Why the maturity caveats matter more than the logos

Read together, the four projects shift session isolation, cluster provisioning and inference recovery toward community-governed open source — but none of them is finished. OpenShell's governance move is still underway, Agent Substrate's APIs are in flux, and NVKE and NVKR carry explicit no-production warnings.

Snapshot's benchmarks provide the strongest operational evidence in the batch, yet its same-GPU, same-driver compatibility requirement and Crusoe's storage results show that faster recovery depends on both reusable workload state and the infrastructure around it. The partner list — Google, Firmus, SK Telecom, Mirantis and the rest — signals intent; the code and the CNCF process will determine what ships and when.