OpenShell

Overview

NVIDIA OpenShell is an open-source runtime for executing fleets of autonomous AI agents in sandboxed environments with kernel-level isolation. It combines sandbox runtime controls with declarative YAML policy so teams can give agents access to files, packages, APIs, and credentials without granting unrestricted access to local files, credentials, or external networks.

Key Features

• Kernel-level enforcement confines file access and system calls and checks every network connection against policy before it leaves the sandbox.
• Declarative YAML policies define filesystem, network, process, and provider credential controls for each sandbox.
• Filesystem restrictions use Landlock to limit reads and writes to declared paths only.
• Network policies allow only approved destinations and deny other outbound traffic.
• Provider credential handling resolves opaque placeholders only at profile-authorized endpoints and adds credentials only to requests bound for approved endpoints.
• Formal verification flags risky new access before a policy change is approved, so changes such as reaching a new host with credentials can wait for human review.

Use Cases

• Secure coding agents: run Claude Code, OpenCode, Codex, or GitHub Copilot CLI with constrained file and network access.
• Private enterprise development: grant selected sandboxes access to self-hosted or private model endpoints while keeping sensitive context under control.
• Compliance and audit: treat policy YAML as version-controlled security controls that can be reviewed and audited.
• Reusable environments: use the default Ubuntu workload or bring your own containerized runtime.

Getting Started

• Install the CLI and a local gateway with the install script, then create a sandbox such as demo. The default sandbox image is minimal Ubuntu with no agent installed. To run a real agent, follow the Run Your First Agent guide, which runs OpenCode against a free OpenRouter model

Deployment & Requirements

• You need Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization. For Kubernetes, deploy the gateway with Helm, and the CNI must enforce NetworkPolicy.

Before You Adopt

• License: Apache-2.0. Review its terms before using, modifying, or distributing the project.
• Windows support is labeled experimental and requires WSL 2.
• Anonymous operational telemetry is collected and can be disabled through gateway or Helm settings.
• Retrieved external materials are not distributed with OpenShell and are governed by separate terms, conditions, and licenses.