NVIDIA OpenShell
by NVIDIA
Open-source, kernel-isolated sandbox runtime for autonomous AI agents
NVIDIA OpenShell is an Apache-2.0 runtime that executes autonomous AI coding agents inside a kernel-isolated sandbox governed by declarative YAML policy. It lets platform and security teams give agents real filesystem, network and tool access without handing over unrestricted reach into developer credentials, source trees and outbound networks.
NVIDIA OpenShell is an open-source runtime, released under Apache 2.0 at GTC on 16 March 2026, that runs autonomous AI agents inside a sandbox whose permissions are declared in YAML rather than trusted to the agent. It targets the central tension in agentic development: agents need file access, package installation, network calls and credentials to be useful, and those same capabilities are what makes an untrusted or prompt-injected agent dangerous. OpenShell enforces defence in depth across four layers — filesystem access is restricted to explicitly declared paths using the Linux Landlock LSM, dangerous syscalls and privilege escalation are blocked with seccomp, outbound network connections are denied unless allowlisted, and model API calls are routed through controlled inference backends so an agent can be pinned to a self-hosted endpoint. Policies split into static sections that lock at sandbox creation and dynamic sections that hot-reload at runtime without restarting the sandbox, which lets security teams version-control and review agent permissions as code rather than auditing behaviour after the fact. Written primarily in Rust, it runs as a lightweight K3s Kubernetes cluster inside a single Docker container with no separate Kubernetes install, and installs via a shell script, uv tool install from PyPI, or a Helm chart from GHCR. It ships built-in support for Claude Code, Codex, OpenCode, GitHub Copilot CLI, OpenClaw, Hermes Agent, Ollama and Pi. The repository carries roughly 8,100 stars, 1,200 forks and 330 open issues with a near-daily release cadence reaching v0.0.104 on 12 August 2026, and NVIDIA also uses it as the execution layer beneath ServiceNow's Project Arc enterprise desktop agent. NVIDIA itself labels the project alpha 'single-player mode' software.
The platform-engineering or AppSec lead who has to let developers run Claude Code, Codex or Copilot CLI against real repositories and needs the blast radius written down as reviewable policy rather than trusted to the agent.
Agent permissions become a version-controlled YAML file enforced by Linux kernel primitives, so what an agent can read, run and reach is auditable in a pull request instead of assumed.
At a Glance
- Category
- Governance & Security
- Pricing
- Free
- Target Market
- Platform Engineers, Security Engineers, CTOs, Enterprise Developers, DevOps Teams
- Deployment
- Open-source, Self-hosted
- Founded
- 1993
- Headquarters
- Santa Clara, United States
- Team Size
- 500+
Key Features
- ✓Kernel-level filesystem isolation
Landlock LSM restricts an agent to explicitly declared paths, so it cannot read credentials or source trees that fall outside its policy.
- ✓Seccomp process containment
Blocks privilege escalation and dangerous syscalls, preventing a compromised agent from breaking out of its process boundary.
- ✓Default-deny network egress
Outbound connections are blocked unless allowlisted, and network policy hot-reloads at runtime without restarting the sandbox.
- ✓Controlled inference layer
Model API calls route through approved backends, letting teams pin an agent to a self-hosted endpoint so prompts never leave the organisation.
- ✓Declarative YAML policy
Static sections lock at sandbox creation while dynamic sections reload live, making agent permissions reviewable, diffable and version-controlled.
- ✓Single-container K3s runtime
Runs as a lightweight K3s cluster inside one Docker container, giving Kubernetes semantics without requiring a separate Kubernetes install.
- ✓Built-in agent profiles
Ships working support for Claude Code, Codex, OpenCode, GitHub Copilot CLI, OpenClaw, Hermes Agent, Ollama and Pi out of the box.
- ✓Environment-variable credential injection
Secrets are injected as environment variables rather than written to disk, removing a common path for agents to leak them through logs.
Capabilities
Use Cases
- •Containing a coding agent on a developer laptop
A team runs Claude Code against a production repository with filesystem and network policy stopping it reaching unrelated services or secrets.
- •Private inference for regulated development
The inference layer pins agents to a self-hosted model so source code and prompts never leave the organisation's own infrastructure.
- •Policy-as-code compliance review
Security reviews the YAML policy in a pull request instead of auditing agent behaviour afterwards, giving genuine change control over permissions.
- •Evaluating an untrusted third-party agent
An unfamiliar open-source agent runs inside a default-deny sandbox so its real filesystem and network behaviour can be observed safely.
- •Governed enterprise desktop agents
ServiceNow's Project Arc uses OpenShell as its execution layer so an autonomous desktop agent's file, command and API activity stays contained and auditable.
Ideal For
Best For
- ✓Containing coding agents such as Claude Code, Codex or GitHub Copilot CLI that run against real source trees and live credentials
- ✓Air-gapped or private development where the inference layer must be pinned to a self-hosted model endpoint so prompts never leave the estate
- ✓Compliance workflows that need agent permissions reviewed, diffed and version-controlled as declarative policy
- ✓Building reusable, reproducible sandbox images so every developer's agent runs under identical constraints
- ✓Evaluating untrusted or third-party agents safely before they are allowed anywhere near production systems
Not Ideal For
- ✗Production or multi-tenant deployments — NVIDIA explicitly labels it alpha 'single-player mode' and 'proof-of-life: one developer, one environment, one gateway', and it is still on 0.0.x releases
- ✗Teams needing GPU workloads or the Kubernetes deployment path today, since both are marked experimental with breaking changes expected
- ✗Non-Linux hosts or older kernels, because enforcement depends on Landlock LSM and seccomp and Landlock availability varies by kernel version
- ✗Buyers who want vendor support and an audited security posture: the only published performance figures are NVIDIA's own and no third-party security assessment has been released
- ✗Agents that expect file-based credential authentication, since OpenShell deliberately injects credentials as environment variables instead
Integrations
Deployment
Market Analysis
Pros
- ✓Real kernel-level enforcement using the same Landlock and seccomp primitives container runtimes rely on, rather than convention-based containment
- ✓Genuinely open source under Apache 2.0 with no paid tier, and very actively developed — roughly 8,100 stars, 1,200 forks and near-daily releases through v0.0.104 on 12 August 2026
- ✓Policy as version-controlled YAML makes agent permissions reviewable in a pull request, which is what compliance functions actually need
- ✓Credentials are injected as environment variables rather than written to disk, closing a common leak path through agent logs
- ✓Already load-bearing in a shipping enterprise product — it is the sandbox beneath ServiceNow's Project Arc desktop agent
Cons
- ✗NVIDIA itself calls it alpha 'single-player mode' software — 'proof-of-life: one developer, one environment, one gateway' — and it has not left 0.0.x versioning
- ✗GPU support and the Kubernetes deployment path are both marked experimental with breaking changes expected, which is awkward for an NVIDIA project
- ✗330 open issues alongside near-daily releases implies churn that an adopting team has to absorb
- ✗The only performance figure is NVIDIA's own single-digit-percentage overhead claim; no third-party benchmark, security audit or published comparison against gVisor, Docker, Firejail or Bubblewrap exists
- ✗Enforcement depends on Linux kernel features and Landlock availability varies by kernel version, so coverage is uneven across a real fleet
- ✗It prevents disallowed actions but does not address information-inference or side-channel extraction through operations the policy permits
- ✗Despite 8,100 stars, Hacker News discussion has been almost nil — launch posts drew 2 to 4 points and at most one comment — so there is little public production experience to learn from
Pricing
Open source (Apache 2.0)
$0
- ✓Full runtime under Apache License 2.0
- ✓Install via shell script, PyPI (uv tool install openshell) or Helm chart from GHCR
- ✓Filesystem, network, process and inference policy enforcement
- ✓Built-in profiles for Claude Code, Codex, OpenCode, Copilot CLI, OpenClaw, Ollama and Pi
OpenShell is entirely free and Apache 2.0 licensed, with no commercial edition, paid support tier or enterprise SKU published as of August 2026. The real cost is operational: it is alpha software on 0.0.x releases shipping almost daily, so the expense is engineering time to track breaking changes, author and maintain policies, and absorb the single-digit-percentage runtime overhead NVIDIA reports — a figure no third party has independently measured.
Security & Compliance
Connect
Sources
This page was written from 6 sources, 4 on domains other than github.com.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
OpenAI Daybreak
Vetted-access frontier AI for cyber defenders, with a purpose-built offensive-security model
Zenity
Runtime AI agent security that blocks a harmful agent action before it executes
Saviynt Zuma
Identity control plane for AI agents and non-human identities, with runtime authorization
Bigeye AI Trust Platform
Governance, observability and runtime enforcement for the data your AI agents are allowed to touch