OpenShell is a sandboxed runtime from NVIDIA for running fleets of autonomous AI agents. Agents can read files, install packages, call APIs, and use credentials, and OpenShell grants that capability without giving them unrestricted access to data, secrets, or the network. You declare what each agent may touch in a policy, and the runtime enforces it.
Enforcement works at the kernel level. Each agent runs in an isolated sandbox where kernel controls confine which files it can access and which system calls it can make, and every outbound network connection passes a policy check before it leaves. Agents never see real credentials: OpenShell attaches them only to requests bound for approved endpoints. Policy changes go through formal verification that flags risky new access, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review.
A gateway acts as the control plane for sandboxes, policy, and access, and the gateway deploys to Kubernetes with Helm. Policies cover filesystem, network, and process rules, with network rules hot-reloadable at runtime while filesystem and process rules lock at sandbox creation. SDKs for Python, TypeScript, Go, and Rust connect applications to a gateway, and public agent skills teach a coding agent to drive the CLI and write policies.
Features
- Policy declaration: a YAML policy states what each agent may access, enforced on every file access, system call, and network connection
- Kernel isolation: sandboxes use Landlock filesystem restrictions and seccomp to confine file access and block dangerous syscalls
- Credential shielding: agents never see real secrets, which are added only to requests bound for approved endpoints
- Formal verification: a prover checks what a policy change would allow and holds risky new access for human review
- Network control: outbound connections are denied unless the destination is approved, and network rules reload at runtime
- Gateway control plane: a gateway manages sandboxes, policy, and access, deployable to Kubernetes with Helm
- SDKs: client libraries for Python, TypeScript, Go, and Rust connect applications to a gateway
- Agent skills: public skills teach a coding agent to drive the CLI, write policies, and debug inference routing
