Hugging Face Kernels Major Updates

Hugging Face Kernels Major Updates

Kernels as a New Repository Type

Hugging Face added a new "kernel" repository type on the Hub to make custom kernels first‑class, discoverable, and to show which accelerators, operating systems, and backend versions are supported.

Users can browse all kernels at https://huggingface.co/kernels and see example pages such as the Flash Attention 3 kernel at https://huggingface.co/kernels/kernels-community/flash-attn3.

Making kernels first‑class citizens lets users see trends across kernels, models, and applications.

Improved Security

Hugging Face strengthened kernel security with trusted publishers and code signing to prevent malicious kernels from running with the same privileges as the Python process.

Trusted kernel publishers

By default, the kernels package loads only kernels from trusted publishers; loading from other sources requires the trust_remote_code=True argument.

from kernels import get_kernel

kernel_module = get_kernel(
   "Atlas-Inference/gdn", version=1, trust_remote_code=True
)

Users and organizations must request publisher access from their account settings, allowing case‑by‑case review.

Kernel signing

An additional layer uses Sigstore’s cosign with ephemeral private keys, so a leaked key cannot be reused after its short validity period.

The kernel is signed by a trusted GitHub workflow from a trusted GitHub repository.

kernel-builder supports signing and the kernels verify-signature CLI can verify a signature; verification on load is pending further testing.

Preliminary setup notes are in the kernels 0.16.0 release notes: https://github.com/huggingface/kernels/releases/tag/v0.16.0.

Revamped CLIs

The responsibilities of kernels and kernel-builder were separated to make each CLI leaner and more specific.

  • kernels CLI handles loading and preparing kernels for use.
  • kernel-builder CLI handles building kernels.

Documentation is available at the kernels CLI and kernel‑builder CLI pages.

This separation also improves the experience for agentic kernel development.

Expanded Framework and Backend Support

Support was extended for frameworks and backends to widen kernel compatibility.

  • Torch Stable ABI: kernels can target a specific Torch version or any later version for roughly two years. For example, a kernel targeting the Torch 2.9 Stable ABI works with Torch >= 2.9.
  • Apache TVM FFI: the first framework besides Torch to be supported, providing a standardized ABI that interoperates with PyTorch, Jax, and CuPy, enabling kernels that run across frameworks.

Foundation for Agentic Kernel Development

The tooling now provides a structured, agent‑friendly workflow for scaffolding, building, benchmarking, and iteratively optimizing kernels.

kernel-builder enforces a predictable project layout and repeatable builds, offers an agent‑optimized CLI (non‑interactive commands, straightforward outputs), and includes backend‑specific skills that capture toolchains, compilation paths, and performance considerations.

Integration with HF Jobs lets agents run benchmark suites across different hardware configurations, collect performance results, and compare them to a defined baseline.

Example kernels developed through this workflow:

Miscellaneous Improvements

Usability and reliability received several upgrades.

Environment setup

A one‑click installation script simplifies setting up a kernel‑builder environment; a Terraform setup guide is also available for ephemeral instances.

System card for kernels

After a build, a system card is generated that shows usage instructions and exposed interfaces; when pushed to the Hub it becomes the kernel’s front matter.

Example: system card for kernels‑community/flash-attn3.

Is a kernel compatible on my system?

The has_kernel() function returns a boolean indicating compatibility.

from kernels import has_kernel

print(has_kernel("kernels-community/activation", version=1))

For detailed reasons, get_kernel_variants() lists each variant and its acceptance or rejection reason.

from kernels import get_kernel_variants, VariantAccepted

for decision in get_kernel_variants("kernels-community/activation", version=1):
    name = decision.variant.variant_str
    if isinstance(decision, VariantAccepted):
        print(f"{name}: compatible
    else:
        print(f"{name}: rejected ({decision.reason})

Improved manylinux_2_28 support

Previously, kernels statically linked libstdc++ to avoid older libstdc++ issues, but this caused segfaults when dynamic and static versions interacted.

Now kernels link libstdc++ dynamically and are compiled with the official manylinux_2_28 toolchain to maintain compatibility with older libstdc++ versions.

Conclusion

The updates aim to serve both kernel developers and users by making kernels more secure, discoverable, easier to build, and better suited for automated, agent‑driven workflows.

Feedback from the community is welcome.

Acknowledgements: Thanks to Aritra for reviewing the post.

Sources