Skip to content

Back to the catalog

NVIDIA/OpenShell — sandboxed runtime for autonomous AI agents
github.comrepo

NVIDIA/OpenShell — sandboxed runtime for autonomous AI agents

OpenShell is NVIDIA's open-source runtime for safely running fleets of autonomous AI agents: each agent runs in an isolated sandbox where kernel-level controls enforce a declared policy over file access, syscalls, and network connections, and credentials are injected only for approved endpoints rather than exposed to the agent directly. Policy changes are checked with formal verification to flag risky new access (new hosts, new API methods) before they're approved, and the project ships a CLI, gateway, Kubernetes/Helm deployment, and a tutorial running OpenCode against an OpenRouter model.

TL;DR NVIDIA's OpenShell sandboxes autonomous AI agents with kernel-enforced policies and formally verified policy changes.
Open original ↗
Also seen from another angle🧠 AI →
Document

What it is

OpenShell is currently at version 0.1.x, with a stable release cadence newly introduced at this point — prior to 0.1.0 the project had no such guarantee. The 0.1.0 release adds new isolation primitives, an expanded extension surface, and new APIs, and ships an upgrade guide for teams moving from earlier builds.

Preconditions / Affected

Requires Linux, macOS on Apple Silicon, or Windows with WSL 2 (listed as experimental), plus a container/virtualization backend: Docker, Podman, or host virtualization. Kubernetes deployment via Helm requires a CNI that enforces NetworkPolicy — without that, the gateway's network-layer policy guarantees don't hold.

What to do

Install via the published script, then create a sandbox:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

The default sandbox image is minimal Ubuntu with no agent preinstalled; the "Run Your First Agent" tutorial walks through running OpenCode against a free OpenRouter model, including how to approve new access as the agent requests it.

Coding-agent skills (CLI usage, policy authoring, gateway/routing debugging) can be added without a source checkout:

npx skills add NVIDIA/OpenShell

Teams already running pre-0.1 builds should consult the 0.1.0 upgrade guide before updating, given the new isolation primitives and API changes.

For telemetry-sensitive environments: the gateway collects anonymous operational counts by default (explicitly excluding sandbox names, hostnames, file paths, prompts, credentials, and model/provider names). Disable with:

OPENSHELL_TELEMETRY_ENABLED=false

on the gateway, or server.telemetryEnabled=false for Helm installs. Telemetry can also be compiled out entirely.

Caveats

WSL 2 support is explicitly marked experimental. Security vulnerabilities in OpenShell itself must be reported per SECURITY.md rather than as a GitHub issue — no further detail on that process is given on this page. The page also notes it retrieves external materials (e.g., via providers/inference) not distributed with the software, which carry separate, unreviewed licensing/security terms the operator is responsible for vetting.

Technologies named here

Techniques named here

Related in AI Security