NVIDIA OpenShell — secure runtime for autonomous AI agent fleets

What it claims

OpenShell lets agents read files, install packages, call APIs and use credentials while confining each one to a declared policy. Two details are not in the summary. First, agents never hold real credentials: OpenShell attaches them only to outbound requests bound for approved endpoints, inference endpoints included. Second, the 0.1.x line introduced a stable release cadence plus new isolation primitives, extension surface and APIs. Existing users are pointed to a 0.1.0 upgrade guide.

How it works

Each agent runs in its own sandbox. Kernel controls restrict file access and system calls, and every network connection is checked against policy before it leaves the sandbox. Policies cover filesystem, network and process rules. An "advisor" and a "prover" review proposed changes. The prover flags new access such as reaching a new host with credentials or calling a new API method, and holds those changes for human review. The architecture splits into a gateway (control plane), a supervisor and the sandbox. Extension points are middleware, interceptors and compute drivers.

flowchart LR
  A[Agent in sandbox] --> P{Policy check}
  P -->|endpoint approved| I[Provider injects credential]
  I --> E[External API / inference]
  P -->|not approved| X[Blocked]

How to use it

Requirements: Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental). You also need Docker, Podman or host virtualization.

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed. The "Run Your First Agent" tutorial runs OpenCode against a free OpenRouter model and walks through approving new access as the agent asks for it. A Brev Launchable is available for trying it in the cloud.

To install the skills that teach a coding agent to drive the CLI, write policies and debug gateways and inference routing (no source checkout needed):

npx skills add NVIDIA/OpenShell

SDKs connect applications to a gateway but do not install the CLI. Keep the SDK and gateway on the same release where possible.

For Kubernetes, the gateway deploys via Helm, and your CNI must enforce NetworkPolicy.

Limits

• Windows support is experimental and macOS is limited to Apple Silicon.
• On Kubernetes, network isolation depends on the CNI enforcing NetworkPolicy. Check this before trusting egress controls.
• Anonymous telemetry is on by default. The page says it is limited to operational categories and counts, and excludes sandbox names, hostnames, file paths, prompts, credentials, provider/model names and user content. To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway or server.telemetryEnabled=false for Helm, or compile it out.
• The software fetches external materials, which carry their own licences. You are responsible for checking their terms and security. The software is provided as-is.
• Licence: Apache 2.0.
• Report security vulnerabilities through SECURITY.md, not GitHub issues.