{"slug": "what-is-nvidia-openshell-the-agent-sandbox-explained", "title": "What is NVIDIA OpenShell? The agent sandbox, explained", "summary": "NVIDIA OpenShell, an open-source runtime that sandboxes AI agents under file, network and credential policy, reached stable release v0.1.8 on 10 Nov 2026 and is now part of the CNCF, with development moving to the ai-openshell GitHub organisation, according to the project's README. The README states that \"every network connection passes through a policy check before it leaves the sandbox,\" with Landlock confining the filesystem, seccomp and an unprivileged process identity blocking privilege escalation, and credentials injected only into requests bound for approved endpoints. The NVIDIA/OpenShell repository held 21,443 GitHub stars at 16:12 UTC on 11 Nov 2026 and is licensed under Apache License 2.0.", "body_md": "# What is NVIDIA OpenShell? The agent sandbox, explained\n\nNVIDIA OpenShell runs AI agents in a sandbox with file, network and credential policy. What it is, how to install it, what v0.1.8 changed, alternatives.\n\nNVIDIA OpenShell is an open source runtime that runs each AI agent in a sandbox and lets it touch only the files, hosts and credentials your policy allows. Its docs aim it at teams running agents on Linux, Apple Silicon Macs or Kubernetes. The latest stable release is v0.1.8, published 10 Nov 2026. Checked 11 Nov 2026.\n\nIf you came here from Pi: its README names OpenShell as one of three ways to box Pi in, which our [what is Pi agent](https://munderdiffl.in/blog/what-is-pi-agent/) explainer and [Pi vs Claude Code](https://munderdiffl.in/blog/pi-vs-claude-code/) cover. We covered OpenShell in [Agent Tools Today, 23 Oct](https://munderdiffl.in/blog/agent-tools-today-2026-10-23/), when it was at v0.1.5. Unattended runs, one topic in our [Claude Code Max plan tips](https://munderdiffl.in/blog/claude-code-max-plan-tips/), are where we think a sandbox earns its keep. More explainers live under [Concepts](https://munderdiffl.in/blog/topics/concepts/).\n\n## What is NVIDIA OpenShell? [#](#what-is-nvidia-openshell)\n\nOpenShell is a runtime that wraps each agent in its own sandbox and enforces a policy on what it can reach. The [OpenShell README](https://github.com/NVIDIA/OpenShell) calls it “the safe, private runtime for fleets of autonomous AI agents” and puts the idea in one line: “You declare what each agent can touch in a policy, and OpenShell enforces it.”\n\nThe README splits it into a gateway, a supervisor and the sandbox, and gives the licence as the Apache License 2.0. The GitHub API showed 21,443 stars at 16:12 UTC on 11 Nov 2026, with the repo not archived.\n\nThe README also says “OpenShell is now part of the CNCF”, with development moving to the [ai-openshell](https://github.com/ai-openshell) organisation; until then, code and issues stay at NVIDIA/OpenShell.\n\n## How does OpenShell sandbox an agent? [#](#how-does-openshell-sandbox-an-agent)\n\nPer its README, kernel controls confine the agent, and every file access, system call and network connection is checked against your policy. The README says “every network connection passes through a policy check before it leaves the sandbox.” Policy changes get formal verification first, which flags risky new access “such as reaching a new host with credentials or calling a new API method” for a person to review.\n\nNVIDIA’s [overview docs](https://docs.nvidia.com/openshell/latest/about/overview) name the parts: Landlock confines the filesystem to declared paths, seccomp and an unprivileged process identity block privilege escalation, and network policies deny any destination you have not approved. The same page says filesystem and process rules lock when the sandbox is created, while network rules reload as it runs.\n\nCredentials stay out of the agent’s reach. The README says “Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints.” In the [Run Your First Agent](https://docs.nvidia.com/openshell/latest/about/run-your-first-agent) guide, an OpenRouter key goes into a provider, and OpenShell keeps it “in the credential store and sends it only to” `openrouter.ai`.\n\nWhen an agent hits a blocked host, the guide says OpenShell denies the request and drafts a rule. You review drafts with `openshell rule get my-agent --status pending`, and, per the guide, approved rules “hot-reload into the running sandbox without a restart”.\n\n## Which agents does it support? [#](#which-agents-does-it-support)\n\nAny agent you can put in a container image. The Run Your First Agent guide says “OpenShell can run any agent that is available in a sandbox image.” The overview docs list Claude Code, OpenCode, Codex and GitHub Copilot CLI as secure coding agent examples, and the guide’s worked example runs OpenCode against a free OpenRouter model. NVIDIA’s docs also carry a tutorial, [Run Pi with OpenRouter](https://docs.nvidia.com/openshell/latest/tutorials/run-pi-with-openrouter).\n\nThe default sandbox image is minimal Ubuntu with no agent installed, per the README. A fresh sandbox therefore runs no agent until you add one.\n\n## How do you install it? [#](#how-do-you-install-it)\n\nRun the install script, then create a sandbox. This is the README’s quickstart:\n\n```\ncurl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh\nopenshell sandbox create --name demo\n```\n\nThe README lists what you need: “Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization.” The [support matrix](https://docs.nvidia.com/openshell/latest/about/support-matrix) sets minimums of Docker 28.0, Podman 5.x and Kubernetes 1.29.\n\n## What changed in v0.1.8? [#](#what-changed-in-v018)\n\nMostly fixes, plus stricter credential and policy rules. The [v0.1.8 release notes](https://github.com/NVIDIA/OpenShell/releases/tag/v0.1.8), published 10 Nov 2026, carry nine upgrade notes. Two upgrade notes and one bug fix stand out:\n\n- “Static provider credentials without placement metadata now resolve only in the `Authorization` header or through explicitly enabled body/WebSocket rewrite policies”, so custom headers need an explicit placement.\n- “Sandboxes now fail to launch when a filesystem policy path goes through a symlink inside a writable workspace”.\n- “Deleted sandboxes no longer leave memory behind on the gateway”.\n\nOn status: the README carries no alpha label. It says 0.1.x brings “a stable release cadence”, and the support matrix says stable releases “generally go out every week”. Our view: with nine upgrade notes in one patch, pin a version with `OPENSHELL_VERSION=v0.1.8` as the release notes show.\n\n## What are the alternatives? [#](#what-are-the-alternatives)\n\nFour other ways to box an agent in, each read on 11 Nov 2026:\n\n| Option | What it isolates | Where it runs | \n|---|---|---|\n| Plain Docker | The whole agent process | A local container | \n| Gondolin for Pi | Pi’s built in tools and `!` commands | A local Linux micro VM | \n| Claude Code sandbox | Shell commands only | Your machine, enforced by the OS | \n| E2B | The whole agent session | A cloud microVM | \n\n**Plain Docker.** Docker’s [overview](https://docs.docker.com/get-started/docker-overview/) calls a container “a loosely isolated environment” and says it is “relatively well isolated from other containers and its host machine” by default.\n\n**Gondolin for Pi.** Pi’s [containerization guide](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/containerization.md) describes [Gondolin](https://github.com/earendil-works/gondolin) as “a local Linux micro-VM”: Pi stays on the host and its built in tools run in the VM. It warns that commands there “inherit the host process environment”, so it is no credential boundary by default. Gondolin’s GitHub repo calls it experimental, and the GitHub API lists its last release as v0.14.0 on 22 Oct 2026.\n\n**Claude Code’s sandbox.** Anthropic’s [sandboxing docs](https://code.claude.com/docs/en/sandboxing) describe “a boundary that the operating system enforces around the shell commands Claude runs on your machine”. The docs say it is off by default, runs on macOS, Linux and WSL2, and leaves file tools, MCP servers and hooks outside it.\n\n**E2B.** The [E2B](https://e2b.dev/) site promises “An isolated machine for every AI agent”, one microVM per session, in its cloud or your own AWS, GCP or Azure account.\n\nOur view: OpenShell if you need per host rules and keys the agent never sees, Docker if a plain fence will do, Claude Code’s sandbox if Claude Code is your only agent.\n\nIf you run several agents side by side, [Munder Difflin](https://harnessmd.com/download) is free and open source: a desktop app that runs a team of AI agents for all kinds of knowledge work, coding included, on your own computer. The [install guide](https://munderdiffl.in/blog/how-to-install-and-use-munder-difflin/) covers setup.\n\n## FAQ\n\nIs NVIDIA OpenShell free?\n\nYes. The GitHub repo is licensed under the Apache License 2.0, checked 11 Nov 2026, and the README lists no price. Model calls can still cost money, though the guide's example uses a free OpenRouter model.\n\nDoes OpenShell work with Claude Code?\n\nYes. NVIDIA's overview docs list Claude Code, OpenCode, Codex and GitHub Copilot CLI as secure coding agent use cases. OpenShell runs any agent that is available in a sandbox image, so you put the agent in the image and attach a provider for its key.\n\nDoes OpenShell run on macOS or Windows?\n\nmacOS on Apple Silicon is supported with Docker Desktop. Windows with WSL 2 and Docker Desktop is marked Experimental in the support matrix, and native Windows through Microsoft MXC lives on a separate windows branch.\n\nDoes OpenShell collect telemetry?\n\nYes, by default. The README says it collects anonymous telemetry limited to operational categories and counts, and not prompts, credentials, file paths or user content. Set OPENSHELL_TELEMETRY_ENABLED=false on the gateway to turn it off.\n\nIs OpenShell still an NVIDIA project?\n\nThe code still lives at NVIDIA/OpenShell, but the README says OpenShell is now part of the CNCF. Development is moving to the ai-openshell organisation and governance to the CNCF, and the v0.1.8 docs drop \"NVIDIA\" from the name.", "url": "https://wpnews.pro/news/what-is-nvidia-openshell-the-agent-sandbox-explained", "canonical_source": "https://munderdiffl.in/blog/what-is-nvidia-openshell/", "published_at": "2026-11-11 00:00:00+00:00", "updated_at": "2026-11-12 19:25:49.410295+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["NVIDIA", "NVIDIA OpenShell", "CNCF", "GitHub", "Landlock", "seccomp", "OpenRouter", "Claude Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/what-is-nvidia-openshell-the-agent-sandbox-explained", "markdown": "https://wpnews.pro/news/what-is-nvidia-openshell-the-agent-sandbox-explained.md", "text": "https://wpnews.pro/news/what-is-nvidia-openshell-the-agent-sandbox-explained.txt", "jsonld": "https://wpnews.pro/news/what-is-nvidia-openshell-the-agent-sandbox-explained.jsonld"}}