Skip to content

Back to the catalog

NVIDIA OpenShell — secure runtime for autonomous AI agent fleets
github.comrepo

NVIDIA OpenShell — secure runtime for autonomous AI agent fleets

OpenShell is NVIDIA's open-source runtime for running fleets of autonomous AI agents in isolated sandboxes, enforcing per-agent policies on filesystem, syscall, and network access at the kernel level and injecting credentials only for approved endpoints. Policy changes go through a formal-verification step (an 'advisor'/'prover') that flags newly granted risky access, such as a new host reachable with credentials, before it's applied, and it deploys via Docker/Podman/host virtualization or Kubernetes with Helm.

TL;DR NVIDIA's kernel-enforced sandbox and policy engine for containing what autonomous AI agents can touch (files, syscalls, network, credentials).
Open original ↗
Also seen from another angle🧠 AI →
Document

What it is

NVIDIA OpenShell 0.1.x, the runtime described in the summary. Version 0.1.0 is a fresh release — it adds a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs, with a dedicated 0.1.0 upgrade guide. The architecture has three named parts: a gateway (control plane for sandboxes, policy, and access), a supervisor, and the sandbox itself.

Preconditions / Affected

Runs on Linux, macOS on Apple Silicon, or Windows with WSL 2 (marked experimental), plus one of Docker, Podman, or host virtualization. For Kubernetes deployment via Helm, there is a hard requirement the summary omits: your CNI must enforce NetworkPolicy — otherwise the network isolation OpenShell relies on won't hold. The default sandbox image is minimal Ubuntu with no agent installed, so a fresh install does nothing on its own until you provision an agent.

What to do

Install the CLI and a local gateway, then create a sandbox:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

To teach a coding agent to drive the CLI, write policies, and debug gateways/inference routing:

npx skills add NVIDIA/OpenShell

Telemetry is on by default. It's scoped to operational categories and counts and explicitly excludes sandbox names, hostnames, file paths, prompts, credentials, provider/model names, and user content — but if you want it off, set on the gateway:

OPENSHELL_TELEMETRY_ENABLED=false

or server.telemetryEnabled=false for Helm installs. It can also be compiled out entirely.

Report security vulnerabilities via SECURITY.md, not GitHub Issues.

Caveats

  • WSL 2 support is experimental; don't rely on it for production.
  • The K8s NetworkPolicy requirement is a silent failure mode: Helm will deploy, but network policy enforcement depends entirely on the CNI honoring NetworkPolicy.
  • This is 0.1.x — a first stable release, not a mature one. The install uses curl | sh, so review the script before piping to a shell.
  • The disclaimer notes OpenShell auto-retrieves external materials governed by separate licenses, and the software is provided AS IS with no warranty on anything it fetches.

Technologies named here

Techniques named here

Related in AI Security