OpenShell ships as NVIDIA's sandboxed runtime for AI agents

OpenShell ships as NVIDIA's sandboxed runtime for AI agents

NVIDIA released OpenShell, an open source runtime that sandboxes what autonomous AI agents can touch on a machine. The project's GitHub submission reached 328 points and 169 comments on Hacker News on 22 October 2026, describing OpenShell as a safe, private runtime for fleets of autonomous AI agents. It is licensed under Apache-2.0 and ships with SDKs for Python, TypeScript, Go and Rust.

OpenShell is an open source runtime from NVIDIA that sandboxes autonomous AI agents, giving them file, API and credential access without unrestricted reach into a machine's data, secrets or network. A supervisor enforces policy at the kernel level on every file access, system call and network connection, and formal verification checks each policy change before approval.

What changed

• NVIDIA published OpenShell under the Apache-2.0 license on GitHub. It installs with a single shell script, curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh, followed by openshell sandbox create --name demo to create a sandbox running a minimal Ubuntu image with no agent installed by default.
• Each agent runs inside an isolated sandbox. On the Linux backend, the workload uses one non-root identity with no Linux capabilities; Landlock limits filesystem access, and seccomp user notifications stage every network operation before it can proceed.
• A trusted supervisor process sits outside the sandbox boundary and never makes policy decisions inside it. It talks to the sandbox over the "OpenShell Sandbox Protocol," one mutually authenticated HTTP/2 connection carrying many independent streams; the transport is a Unix socket on Docker and Podman, TCP on Kubernetes, or vsock on a MicroVM.
• Every outbound connection or DNS lookup from the sandbox is relayed to the supervisor, checked against a declared policy, and only then opened. OpenShell attaches real credentials to the approved request itself, so the agent process never holds the credential.
• A policy prover uses formal verification to check a proposed policy change before it is approved, flagging risks such as new credentialed reach to a host, a new HTTP method, or access to a cloud metadata endpoint; any finding blocks auto-approval and the change waits for human review. It also ships as a standalone openshell-prover command for checking a policy in CI.
• OpenShell runs sandboxes on Docker, Podman, Kubernetes (deployed with Helm, requiring a CNI that enforces NetworkPolicy) and virtual machines.
• A companion skills package, installed with npx skills add NVIDIA/OpenShell, teaches a coding agent to drive the OpenShell CLI, write sandbox policies, and debug gateways and inference routing.
• The 0.1.0 release carried breaking changes across deployments, sandboxes, policies, APIs and SDKs. NVIDIA's upgrade guide says a local 0.0.x install cannot be upgraded in place and must be uninstalled first, and that MCP clients now must send a single MCP-Protocol-Version header on every request after initialization.

Why it matters for agent builders

Giving an agent real file, API and credential access is the same surface that goes wrong when the agent is compromised or simply mistaken. OpenShell's design puts that decision outside the agent's own reach: the sandbox cannot approve its own network requests, and the supervisor that holds a credential never hands it to the agent directly, only attaches it to a request it has already checked. For a team shipping MCP servers or agent skills that call paid APIs or touch real data, that is a concrete pattern for separating what an agent can ask for from what it is actually given. The formal verification step on policy changes also gives a team a checkable gate before it widens what an agent can reach, rather than relying on someone remembering to review a diff by hand.

What to watch

OpenShell is still early. At the time of writing, its repository carries 373 open issues and 192 open pull requests, and the documentation lists five point releases since 0.1.0, up to v0.1.5, each layered on breaking changes from the last. Teams adopting it now should expect the protocol, policy schema and SDKs to keep moving rather than treat 0.1.x as a frozen interface, and should watch whether the project's formal verification step keeps pace as more compute drivers, credential providers and extensions get added.

Key takeaways

• NVIDIA open sourced OpenShell, an Apache-2.0 runtime that sandboxes an autonomous AI agent's file, network and credential access.
• Two enforcement layers do the work: kernel-level control (Landlock and seccomp) on every agent action, and a formal-verification "policy prover" gate on any policy change before it takes effect.
• A trusted supervisor process, not the agent, holds and attaches credentials; the agent's only path off the sandbox is a connection the supervisor has already checked against policy.
• OpenShell runs on Docker, Podman, Kubernetes and virtual machines, with SDKs in Python, TypeScript, Go and Rust and an installable skills package for coding agents.
• The GitHub submission reached 328 points and 169 comments on Hacker News on 22 October 2026, and the project's 0.1.0 release broke compatibility with earlier 0.0.x installs.

FAQ

What is NVIDIA OpenShell?

OpenShell is an open source, Apache-2.0-licensed runtime from NVIDIA for running autonomous AI agents inside a sandbox. It lets an agent read files, install packages, call APIs and use credentials while a kernel-enforced policy and a formally verified approval step control what it can actually reach, so a compromised or mistaken agent cannot reach a host's real data, secrets or network on its own.

How does OpenShell stop an agent from reaching unapproved data or endpoints?

Each agent runs inside a sandbox with no direct network path out. Every file access, system call and outbound connection goes through a trusted supervisor process that checks it against a declared policy before anything leaves the sandbox; the supervisor attaches credentials to approved requests itself, so the agent never holds the real credential.

What runtimes and languages does OpenShell support?

OpenShell runs sandboxes on Docker, Podman, Kubernetes (deployed with Helm, with a CNI that enforces NetworkPolicy) and virtual machines. SDKs are available for Python, TypeScript, Go and Rust, and the CLI installs with a single shell script from the project's GitHub repository.

Can an existing OpenShell 0.0.x install be upgraded to 0.1.0?

No. NVIDIA's upgrade guide says local 0.0.x installations cannot be upgraded in place: operators must clean up the old runtime and uninstall the existing package before installing 0.1.0, because the release changed the protocol, field names and time types in ways that do not support mixed-version peers.

Source: NVIDIA/OpenShell Discussion: Hacker News

Builders comparing sandboxing and agent runtime tools can browse the developer tools category on AI Agents Listing.