OpenShell

NVIDIA OpenShell runs autonomous AI agents inside sandboxed environments with kernel-level isolation, so an agent keeps the file, package, API, and credential access that makes it useful without unrestricted reach into your machine or network. What each sandbox may touch is described in declarative YAML policy, which can be version-controlled and reviewed like any other security control.

A gateway control plane manages sandbox lifecycle through a compute driver — Docker, Podman, MicroVM, or Kubernetes — and every outbound connection passes through the policy engine, which allows it, routes it for inference by stripping caller credentials and injecting backend credentials, or denies and logs it. A sandbox starts with minimal outbound access; a short policy opens more, enforced by the proxy at the HTTP method and path level without a restart.

Policy covers four domains. Filesystem and process rules are locked when the sandbox is created; network and inference rules can be hot-reloaded on a running sandbox.

Layer	What it protects	When it applies
Filesystem	Prevents reads and writes outside allowed paths	Locked at sandbox creation
Network	Blocks unauthorised outbound connections	Hot-reloadable at runtime
Process	Blocks privilege escalation and dangerous syscalls	Locked at sandbox creation
Inference	Reroutes model API calls to controlled backends	Hot-reloadable at runtime

Credentials are handled as named providers — bundles injected into a sandbox as environment variables at creation rather than written to the sandbox filesystem — and the command-line tool can discover them for recognised agents from your shell environment. The default sandbox image ships several coding agents plus Python 3.14, Node 22, and common developer and networking tools, and --from creates a sandbox from the community catalogue, a local Dockerfile, or any container image. GPU passthrough for local inference is available on supported hosts and marked experimental, as are the Kubernetes deployment path and Windows support through WSL 2.

Features

• Declarative policy: YAML policy files define filesystem, network, process, and inference constraints
• Layer-7 network enforcement: the proxy allows or denies by HTTP method and path, hot-reloaded without a restart
• Privacy routing: inference calls are rerouted to controlled backends, keeping sensitive context on sandbox compute
• Credential providers: named credential bundles injected as environment variables, never written to the sandbox filesystem
• Compute drivers: Docker, Podman, MicroVM, and Kubernetes back the gateway control plane
• Bring your own container: create sandboxes from the community catalogue, a local Dockerfile, or a container image
• Terminal UI: openshell term gives a keyboard-driven live view of gateways, sandboxes, and providers
• Agent skills: four installable skills cover CLI workflows, gateway and inference troubleshooting, and policy generation
• GPU passthrough (experimental): host GPUs can be passed into a sandbox for local inference or training workloads
• Telemetry controls: anonymous telemetry can be disabled at runtime or compiled out entirely with a Cargo feature