OpenShell
NVIDIA's open-source runtime that runs AI agents in kernel-isolated sandboxes with policy-enforced file, network, and credential access.
OpenShell is NVIDIA's open-source runtime for running fleets of autonomous AI agents inside kernel-enforced sandboxes. Each agent runs in a container, microVM, or Kubernetes pod, and a declarative YAML policy decides which files it can read or write, which binaries may open network connections, and which endpoints those connections can reach. Filesystem and process rules are enforced by Landlock and seccomp, while every outbound connection passes through a supervisor that checks it against the policy before it leaves the sandbox.
Credentials are treated as first-class objects. Provider profiles store API keys and tokens on the gateway, and the sandbox only ever sees opaque placeholders: the supervisor swaps in the real credential for requests bound to endpoints the profile authorizes. Policy edits can be checked by a formal-verification prover before they are approved, so a change that would grant a new host or API method waits for human review. Network rules reload at runtime, while filesystem and process rules are locked when a sandbox starts.
The project installs as a CLI plus a gateway on Linux, macOS on Apple Silicon, or Windows through WSL 2, and runs sandboxes on Docker, Podman, microVMs, or Kubernetes. It ships SDKs for Python, TypeScript, Go, and Rust, emits OpenTelemetry traces, Prometheus metrics, and OCSF security events, and is aimed at teams that want to run Claude Code, OpenCode, Codex, or custom agents with least-privilege access instead of a shared developer machine or a hosted sandbox cloud.
