Summary: At KubeCon + CloudNativeCon, NVIDIA contributed OpenShell, an open source runtime for securing and governing autonomous agents, to the Cloud Native Computing Foundation as a Sandbox project. Alongside it, NVIDIA announced NVKE, NVKR and Snapshot — open source components of its DSX AI Factory Platform that make GPU Kubernetes easier to run and inference faster to scale. For teams building on Kubernetes, this puts agent security governance in community hands and offers measured, if early-stage, paths to cutting both idle compute and startup latency.
What OpenShell actually does
The interesting part of OpenShell is not that it’s open source — it’s the mechanism. It applies deterministic controls to agent activity, so teams can enforce policies at the exact moments an agent uses a tool, calls an inference service, or executes a workload. Deterministic here matters: instead of relying on a model to behave, you get enforceable rules at the boundary between the agent and the things it can touch.
The architecture is also built for integration rather than replacement. Teams can plug in their own compute, inference providers, credential storage, and monitoring tools, which means one governance layer can stretch across different deployment environments and existing enterprise systems. That’s usually the hard part — security tooling that only works inside one vendor’s stack tends to die in procurement.
Since launch, the project claims hundreds of organizations using it and tens of thousands of contributions in less than a year, per NVIDIA’s announcement. I’ve covered NVIDIA’s earlier push into governed agent stacks with LangChain’s NemoClaw work, and OpenShell feels like the infrastructure-level version of the same problem: agents need guardrails that live below the framework.
Moving OpenShell into the CNCF Sandbox changes who steers it. Governance shifts to the organizations building it into their products, plus security professionals who can audit and harden it in the open. Jim Zemlin, CEO of the Linux Foundation, framed it as the cloud-native community’s new infrastructure challenge: giving agents secure environments in which to operate. Sandbox status also means it’s early — Sandbox projects are explicitly pre-graduation, so treat API stability accordingly.
Agent Substrate: the idle-compute problem
NVIDIA also contributed to Agent Substrate, a Google-led framework in the CNCF Sandbox for running long-running agent workloads at scale on Kubernetes. Its core trick: suspend and resume agent environments across a shared pool, releasing compute when agents are idle while preserving their state between tasks. That means you stop paying for dedicated machines per session.
NVIDIA is wiring Agent Substrate into its own stack — NVIDIA Dynamo for model inference and KAI Scheduler for shared cluster resource allocation — pulling agent execution, inference serving, and scheduling onto one Kubernetes foundation. NVIDIA and Google are also collaborating on an OpenShell–Agent Substrate integration so enterprises can secure and govern agents across clouds and on-premises systems.
Note the tense: that integration is a collaboration, not a shipped feature. If cross-cloud agent governance is your reason for paying attention, there’s nothing public yet about timelines or supported configurations.
Snapshot and the cost of cold inference
The third announcement targets a scaling pain anyone running inference knows: loading models and warming up workloads delays both elastic scaling and failure recovery. NVIDIA Snapshot, an open source modular component, restores checkpointed replicas in seconds without model reload or warmup.
The numbers come from design partners on NVIDIA HGX B300 systems, so read them as vendor-arranged benchmarks rather than independent results:
- Crusoe, an upstream Snapshot contributor, tested GLM-5.3 on Crusoe Cloud and cut workload-ready time from roughly eight minutes to 31 seconds.
- Saturn Cloud, a token factory platform, benchmarked scale-from-zero inference and reduced vLLM startup from between two and 8.5 minutes to between six and 34 seconds.
For agentic workloads that burst and idle, shaving minutes off every scale-from-zero event compounds quickly — it’s the difference between autoscaling that actually keeps up and autoscaling you preemptively overprovision against.
NVKE and NVKR: managed Kubernetes as open building blocks
NVIDIA Kubernetes Engine (NVKE) and NVIDIA Kubernetes Recipes (NVKR) are now in public preview. They give AI factories open source building blocks for delivering managed Kubernetes on GPU infrastructure — automated cluster lifecycle management and signed, version-pinned images. The pitch to providers is that they can offer managed Kubernetes without surrendering control of their infrastructure, software, and customer experience.
The ecosystem roster at launch includes Mirantis, Netris, OpenNebula Systems, Rafay, Spectro Cloud, and vCluster, plus Firmus and SK Telecom, all with stated integration plans. Plans, not shipped integrations — the partners have aligned on intent, and none of the sources report production deployments of NVKE or NVKR yet.
What to check next
A few honest limits. None of the sources include performance benchmarks for OpenShell itself or its security track record beyond contribution counts — adoption numbers tell you about momentum, not safety. The Snapshot figures come from two named design partners on specific workloads (GLM-5.3 and vLLM), so your own model and serving stack may behave differently. And everything in the DSX announcement beyond OpenShell is preview-stage.
If you’re running agents on Kubernetes, the practical next steps are concrete. Audit OpenShell’s actual repository and its deterministic control points against your current tool-use and inference paths — since it’s CNCF Sandbox, you can read the code and the governance discussions rather than trust a datasheet. Second, if cold-start inference costs you real money or latency, benchmark Snapshot against your own checkpointing setup; the Crusoe and Saturn Cloud deltas are promising but workload-specific. And watch whether the OpenShell–Agent Substrate integration moves from collaboration to code — that pairing, governance plus suspended-state execution, is the piece that could most change how you architect long-running agents.