OpenShell
NVIDIA's open-source runtime that runs AI agents in kernel-isolated sandboxes with policy-enforced file, network, and credential access.
Open source alternative to:
OpenShell is NVIDIA's open-source runtime for running fleets of autonomous AI agents inside kernel-enforced sandboxes. Each agent runs in a container, microVM, or Kubernetes pod, and a declarative YAML policy decides which files it can read or write, which binaries may open network connections, and which endpoints those connections can reach. Filesystem and process rules are enforced by Landlock and seccomp, while every outbound connection passes through a supervisor that checks it against the policy before it leaves the sandbox.
Credentials are treated as first-class objects. Provider profiles store API keys and tokens on the gateway, and the sandbox only ever sees opaque placeholders: the supervisor swaps in the real credential for requests bound to endpoints the profile authorizes. Policy edits can be checked by a formal-verification prover before they are approved, so a change that would grant a new host or API method waits for human review. Network rules reload at runtime, while filesystem and process rules are locked when a sandbox starts.
The project installs as a CLI plus a gateway on Linux, macOS on Apple Silicon, or Windows through WSL 2, and runs sandboxes on Docker, Podman, microVMs, or Kubernetes. It ships SDKs for Python, TypeScript, Go, and Rust, emits OpenTelemetry traces, Prometheus metrics, and OCSF security events, and is aimed at teams that want to run Claude Code, OpenCode, Codex, or custom agents with least-privilege access instead of a shared developer machine or a hosted sandbox cloud.
Categories:
Build with:
Frequently Asked Questions
Which platforms does OpenShell run on?
OpenShell supports Linux on x86_64 and arm64, macOS on Apple Silicon through Docker Desktop, and Windows through WSL 2, which is still experimental. The installer sets up the CLI and a local gateway, and sandboxes are provisioned on Docker, Podman, a microVM runtime, or Kubernetes. Native Windows without WSL 2 is not supported.
Which AI agents can run inside OpenShell?
Any agent that runs on Linux can be placed in an OpenShell sandbox once you provide an OCI image containing it. The documentation and examples cover Claude Code, OpenCode, Codex, and GitHub Copilot CLI, and the default Ubuntu image ships without an agent so you add the one you need. A typical start command is openshell sandbox create --from your-agent-image -- claude.
How are API keys and tokens kept away from the agent?
Credentials live in gateway-side providers rather than in the sandbox. The agent only sees opaque placeholders, and the supervisor substitutes the real credential on requests bound for endpoints allowed by the attached provider profile, so dumping the sandbox environment does not reveal a usable key. Providers can be attached, rotated, or revoked while a sandbox runs, and failed token grants are reported with a request ID for troubleshooting.
Does OpenShell have an API, SDKs, or a terminal UI?
The gateway exposes a gRPC API with reflection, and official SDKs are published for Python, TypeScript, Go, and Rust. Day-to-day work happens through the openshell CLI, which covers sandbox lifecycle, port forwarding, file upload and download, provider management, and policy checks. openshell term adds a terminal dashboard that combines sandbox status with live policy events.
What are the kernel and host requirements for OpenShell?
The sandbox boundary needs a Linux kernel with Landlock ABI 3 or newer, meaning 6.2 or later or a qualified backport, along with seccomp user notification support and the ability to bind sockets to the loopback device. Docker 28.0 or later, Podman 5.x, or Kubernetes 1.29 with the Agent Sandbox controller are the supported compute runtimes, and the gateway needs glibc 2.28 on Linux. On macOS those kernel facilities come from the Docker Desktop Linux VM rather than the host kernel.
OpenAltFinder Score
Project Details
Repository details
Updated 10/23/2026, 12:00:18 PM
View Repository