OpenShell — safe, private runtime for autonomous AI agent fleets

What it claims

OpenShell (Apache License 2.0, now on a 0.1.x stable release cadence) runs autonomous agents in isolated sandboxes. The agents can read files, install packages, call APIs and use credentials, but cannot reach data, secrets or network that a per-agent policy does not allow. The 0.1.x line adds new isolation primitives, a larger extension surface and new APIs, and ships with a 0.1.0 upgrade guide. Anyone on a pre-0.1 build should read that guide before upgrading.

How it works

The page names three components: the gateway, the supervisor and the sandbox. Kernel controls confine each sandbox's file access and system calls. Every outbound connection gets a policy check before it leaves the sandbox. Real credentials never enter the sandbox; they are attached only to requests bound for approved endpoints, including inference endpoints. Policy changes go through an "advisor" and a "prover". Changes that grant new risky access, such as reaching a new host with credentials or calling a new API method, are held for human review.

flowchart LR
  A[Agent in sandbox] --> P{Policy check}
  P -->|approved endpoint| C[Credential injected] --> E[External API]
  P -->|not allowed| X[Blocked]
  R[Policy change] --> V{Prover flags new access?}
  V -->|yes| H[Human review]
  V -->|no| Ap[Applied]

How to use it

Supported hosts:

• Linux.
• macOS on Apple Silicon.
• Windows with WSL 2 (experimental).

You also need Docker, Podman or host virtualization.

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed. The "Run Your First Agent" tutorial runs OpenCode against a free OpenRouter model and walks through approving access as the agent asks for it. There is also a Brev Launchable for trying it in the cloud.

Coding-agent skills for driving the CLI, writing policies, and debugging gateways and inference routing install with the command below. They do not need a source checkout.

npx skills add NVIDIA/OpenShell

SDKs connect applications to a gateway but do not install the CLI. Use the same OpenShell release for the SDK and the gateway where possible.

Limits

• Kubernetes: the Helm-deployed gateway requires a CNI that enforces NetworkPolicy. Check your cluster's CNI before relying on network isolation there.
• Windows: WSL 2 support is experimental.
• Telemetry: anonymous telemetry is on by default. It is limited to operational categories and counts, and excludes sandbox names, hostnames, paths, prompts, credentials, provider or model names, and content. To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway or server.telemetryEnabled=false for Helm. It can also be compiled out entirely.
• Disclaimer: the software is provided "AS IS". The user is responsible for the licences and security of any external materials it retrieves.
• Evidence: the page gives no performance overhead figures and no evaluation of how well the enforcement or verification holds up.
• Security reports: vulnerabilities go through SECURITY.md, not GitHub issues.