OpenShell is a sandbox runtime for autonomous AI agents, giving each agent an isolated execution environment governed by declarative YAML policies. It aims to protect a developer's data, credentials, and infrastructure from unauthorized file access, data exfiltration, and uncontrolled network activity. The project is in alpha and currently oriented around single-developer, single-gateway setups, with multi-tenant enterprise deployment a stated future goal.
It applies defense in depth across four policy domains:
| Layer | What it protects | When it applies |
|---|---|---|
| Filesystem | Reads/writes outside allowed paths | Locked at sandbox creation |
| Network | Unauthorized outbound connections | Hot-reloadable at runtime |
| Process | Privilege escalation and dangerous syscalls | Locked at sandbox creation |
| Inference | Reroutes model API calls to controlled backends | Hot-reloadable at runtime |
A gateway control plane manages sandbox lifecycle across compute drivers (Docker, Podman, MicroVM, Kubernetes). Every outbound connection passes through a policy engine that allows it, denies and logs it, or routes it for inference — stripping caller credentials and injecting backend credentials via a privacy-aware router that keeps sensitive context on sandbox compute. Credentials are managed as named provider bundles injected as environment variables rather than written to the sandbox filesystem.
OpenShell ships pre-integrated with coding agents including Claude Code, OpenCode, Codex, and GitHub Copilot CLI, plus community sandboxes and bring-your-own-container images. It also supports experimental GPU passthrough for local inference and fine-tuning, and includes a k9s-inspired terminal UI for monitoring gateways, sandboxes, and providers.
