OpenShell – A safe, private runtime for fleets of autonomous AI agents NVIDIA released OpenShell 0.1.x, a runtime that sandboxes fleets of autonomous AI agents with kernel-level enforcement of file, system-call and network policy, plus formal verification of policy changes before they are applied. Each agent runs in an isolated sandbox where network connections pass a policy check before leaving, and credentials are injected only into requests bound for approved endpoints; risky new access flagged by the prover waits for human review. OpenShell requires Linux, Apple Silicon macOS, or Windows with WSL 2 (experimental), plus Docker, Podman or host virtualization, and can be installed via a shell script or deployed to Kubernetes with Helm. Important New in OpenShell 0.1.x: a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs. Read the 0.1.0 upgrade guide https://docs.nvidia.com/openshell/latest/upgrade/0-1-0 . OpenShell is the safe, private runtime for fleets of autonomous AI agents. Agents are most useful when they can read files, install packages, call APIs, and use credentials. OpenShell gives them that capability without giving them unrestricted access to your data, secrets, or network. You declare what each agent can touch in a policy, and OpenShell enforces it. OpenShell governs what agents can do in two ways: it instruments the kernel to enforce policy on every file access, system call, and network connection at runtime, and it uses formal verification to check what a policy change would allow before it is applied. - Kernel-level enforcement. Each agent runs in an isolated sandbox. Kernel controls confine which files it can access and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox. Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints. - Formally verified policy changes. Before a policy change is approved, OpenShell uses formal verification to flag risky new access it would grant, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review. See Architecture https://docs.nvidia.com/openshell/latest/about/architecture for how the gateway, supervisor, and sandbox fit together. You need Linux, macOS on Apple Silicon, or Windows with WSL 2 experimental , plus Docker, Podman, or host virtualization. See the Support Matrix https://docs.nvidia.com/openshell/latest/about/support-matrix for details. curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh openshell sandbox create --name demo The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed. To run a real agent, follow Run Your First Agent https://docs.nvidia.com/openshell/latest/about/run-your-first-agent : it runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it. - Sandboxes https://docs.nvidia.com/openshell/latest/how-it-works/sandboxes/overview : images, runtimes, GPUs, and lifecycle. - Policies https://docs.nvidia.com/openshell/latest/how-it-works/policies/overview : filesystem, network, and process rules, with the advisor https://docs.nvidia.com/openshell/latest/how-it-works/policies/advisor and prover https://docs.nvidia.com/openshell/latest/how-it-works/policies/prover for reviewing changes. - Providers https://docs.nvidia.com/openshell/latest/how-it-works/providers/overview : credentials that work only at approved endpoints, including inference https://docs.nvidia.com/openshell/latest/how-it-works/inference . - Gateways https://docs.nvidia.com/openshell/latest/how-it-works/gateways/overview : the control plane for sandboxes, policy, and access. - Kubernetes https://docs.nvidia.com/openshell/latest/kubernetes/setup : deploy the gateway with Helm. Your CNI must enforce NetworkPolicy . - Extensibility https://docs.nvidia.com/openshell/latest/extensibility/overview : middleware, interceptors, and compute drivers. - Tutorials https://docs.nvidia.com/openshell/latest/tutorials/first-network-policy : step-by-step policy and agent walkthroughs. - Prerelease and development builds https://docs.nvidia.com/openshell/latest/about/installation prerelease-and-development-builds : try an upcoming release or the latest commit on main . Install the public OpenShell skills for your coding agent: npx skills add NVIDIA/OpenShell The skills teach your agent to drive the OpenShell CLI, write sandbox policies, and debug gateways and inference routing. They live in skills/ https://github.com/NVIDIA/OpenShell/blob/main/skills and work without an OpenShell source checkout. SDKs connect applications to an OpenShell gateway. They do not install the CLI. Use the same OpenShell release for the SDK and the gateway when possible. | Language | Install | Docs | |---|---|---| | Python | uv add openshell | README https://github.com/NVIDIA/OpenShell/blob/main/python/openshell | | TypeScript | npm install @nvidia/openshell-sdk GitHub Packages | README https://github.com/NVIDIA/OpenShell/blob/main/sdk/typescript/README.md | | Go | go get github.com/NVIDIA/OpenShell/sdk/go@latest | README https://github.com/NVIDIA/OpenShell/blob/main/sdk/go/README.md | | Rust | cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag