OpenShell

Overview

OpenShell is NVIDIA's open-source runtime for autonomous agents; its README describes it as a sandbox that enforces a policy you declare per agent. A gateway (control plane) manages sandbox lifecycles and policy, a supervisor on the trusted side of the boundary makes every policy decision and holds credentials, and the sandbox itself runs the agent as a non-root identity with no Linux capabilities, confined by Landlock for files and seccomp for process and network operations. Every outbound TCP open and DNS query is intercepted and forwarded to the supervisor, which checks it against policy and adds credentials only for approved endpoints, so the agent never sees a real key. Runtimes are Docker or Podman containers with networking disabled, Kubernetes pods with NetworkPolicy, or a VM guest with no network device over vsock.

Policy is declarative YAML covering filesystem, process and network rules; agent-proposed network changes pass through a formal policy prover and anything that adds risky reach is held for human review. You create sandboxes with the CLI (openshell sandbox create --name demo) or SDKs for Python, TypeScript, Go and Rust; the default image is minimal Ubuntu with no agent installed, and the docs name Claude Code, OpenCode, Codex and GitHub Copilot CLI as supported agents. The 0.1.x line (v0.1.7 at the time of verification) is described as having a stable release cadence. OpenShell qualifies as a sandbox because it provisions and confines the environment the agent runs in; its distinguishing feature is the policy and credential layer rather than a new isolation primitive, and it supports pluggable isolation backends including microVMs.

Notable

• Apache-2.0 with roughly 21k GitHub stars; documentation covers v0.1.7 and describes the 0.1.x line as a stable release cadence
• Agents never receive real credentials: the supervisor injects them only into requests bound for policy-approved endpoints
• Proposed policy changes are checked by a formal policy prover (openshell-prover) before auto-approval

OpenShell specifications

Facts from OpenShell’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

• You want coding agents to run with least-privilege file, process and network access that is enforced in the kernel
• You need credentials kept out of the agent's reach while it still calls approved APIs
• You run on Linux or Apple Silicon locally and on Kubernetes in production, with the same policy model
• You want policy as version-controlled YAML for audit and compliance

Trade-offs

• Default runtime is a container; VM-level isolation depends on the VM or microVM backend
• No snapshots, pause/resume or persistence features; sandboxes are recreated to change filesystem or process policy
• Windows support is experimental via WSL 2
• Primarily a policy and runtime layer for agents, not a sandbox API for arbitrary code execution from your application

Good fit for: Running coding agents such as Claude Code, Codex and OpenCode under an auditable, version-controlled policy for files, processes, network and credentials.

How OpenShell compares

See all OpenShell alternatives →

Frequently asked questions

Sources

1. github.com/NVIDIA/OpenShell
2. docs.nvidia.com/openshell/latest/index.html
3. docs.nvidia.com/openshell/latest/about/architecture
4. docs.nvidia.com/openshell/latest/about/how-it-works
5. docs.nvidia.com/openshell/latest/extensibility/isolation-backends