NVIDIA Hands OpenShell to CNCF, Open-Sources AI Factory Tools

By Nathan Brooks

NVIDIA announced on November 10, 2026, at KubeCon + CloudNativeCon that it is contributing its OpenShell agent-security runtime to the Cloud Native Computing Foundation (CNCF) Sandbox and releasing three open-source components for its DSX AI Factory Platform.

The package deals with two problems practitioners know well: governing autonomous agents safely, and running them without burning budget on idle compute and cold starts. NVIDIA is also contributing to Google's Agent Substrate project and adding Kubernetes Engine, Kubernetes Recipes and Snapshot to DSX, covering session execution, cluster management and inference recovery.

What does OpenShell's move to CNCF actually change?

OpenShell applies deterministic controls as autonomous agents use tools, access inference services and execute workloads. It runs agents in kernel-isolated sandboxes with declarative YAML policies covering filesystem, network, process and provider-credential access. Credentials are injected only into requests bound for approved endpoints, and formal verification checks whether a proposed policy change would grant risky new access before approval.

The runtime ships under Apache 2.0. NVIDIA reports that hundreds of organizations have used it and that tens of thousands of contributions have arrived in less than a year. Sandbox governance will involve organizations building the runtime into their products.

The transition isn't finished. A project notice says development is moving to the ai-openshell organization, with code, issues and pull requests remaining at NVIDIA/OpenShell during the move.

How does Agent Substrate attack idle compute costs?

Agents spend much of their lives waiting — for prompts, tool results or model responses. A dedicated warm Kubernetes Pod holds resources during those gaps, while recreating it loses state and triggers another cold start. NVIDIA and Google are also collaborating on an OpenShell integration for agents across clouds and on-premises systems.

Agent Substrate maps many stateful sessions onto a smaller pool of warm workers. It checkpoints idle sessions — memory and filesystem state included — frees their workers, and restores them onto available ones without repeating the normal Pod-creation path. Workers remain ordinary Kubernetes Pods, so cluster scheduling, quotas and placement policies still apply. Target workloads include coding assistants, reinforcement-learning environments and short-lived GPU research sandboxes.

NVIDIA is building interoperability with Dynamo for inference and KAI Scheduler for shared cluster resources. Dynamo can supply projected time to first token and GPU-pool saturation so Agent Substrate can decide whether to keep an agent resident, suspend it or resume it. Caveats matter here: the APIs are still changing, GPU support is being rebuilt around Kubernetes Dynamic Resource Allocation, and parts of the Dynamo integration are experimental.

What do NVKE, NVKR and Snapshot deliver?

NVIDIA Kubernetes Engine and NVIDIA Kubernetes Recipes (NVKE and NVKR) are in public preview under Apache 2.0. NVIDIA says their APIs, configuration and behavior may change and does not yet recommend them for production.

NVKR builds reproducible node images, container images, binaries and Helm charts from version-pinned sources and records the inputs. NVKE uses those artifacts to provision and operate clusters through a REST API and controllers, though the projects can be adopted independently.

NVKE creates customer workload clusters with separate Kubernetes control planes, etcd instances and node pools. It obtains bare-metal capacity through NVIDIA Infra Controller and its Cluster API provider, CAPNICo; a node must present an attested SPIFFE identity before receiving join credentials. Firmus and SK Telecom are integrating the projects into their AI factories. Mirantis, Netris, OpenNebula Systems, Rafay, Spectro Cloud and vCluster have integration plans spanning infrastructure platforms, managed Kubernetes offerings and network automation.

NVIDIA Snapshot addresses inference cold starts by checkpointing a fully initialized workload's CPU and GPU memory. Restores require the same GPU model and driver, and skip repeated weight loading, compilation and CUDA graph capture.

The numbers are the strongest part of the announcement. On B200 GPUs with VAST NFS storage, NVIDIA reports restores of 3.6 to 42.7 seconds across vLLM, SGLang and TensorRT LLM configurations — speedups of 8x to 36x over cold starts. Tests ranged from a 600-million-parameter model to eight-GPU configurations with checkpoints approaching 1 TB. Checkpoint creation took 15 seconds to 5.5 minutes, and checkpoint-plus-restore beat a single cold start in every tested configuration.

Two footnotes temper those figures. Infrastructure provisioning and container-image loading sit outside the timed restore path. And the key-value cache is released before each checkpoint rather than retained in the artifact, so the results apply to restoring an initialized workload on compatible infrastructure.

Independent data backs the storage angle. Crusoe ran its own GLM-5.3 test on NVIDIA HGX B300 with a checkpoint containing 594 GB of GPU state. It measured GPU-state restoration at 15.0 seconds from local NVMe versus 33.3 seconds from NFS. With the artifact on NVMe, pod creation to readiness took 31 seconds, compared with roughly eight minutes for a cold start. Crusoe has also contributed performance and diagnostic changes upstream.

The takeaway for operators: more of the AI factory control plane and recovery path now lives in open repositories, but at very different maturity levels. OpenShell's governance move is incomplete, Agent Substrate is evolving, and NVKE and NVKR remain previews. Snapshot's benchmarks show the clearest measured gain — and Crusoe's storage results make clear that fast recovery depends as much on the infrastructure around the checkpoint as on the checkpoint itself.