NVIDIA OpenShell

• Running Claude Code or OpenCode on a project with access limited to the workspace and the model provider's API
• Giving an agent a GitHub token that resolves only on GitHub's own endpoints, so the agent never sees the real value and cannot send it elsewhere
• Reviewing and approving the network access an agent asks for as it works, instead of granting broad access up front
• Checking in CI that a sandbox policy stays within an organization's maximum allowed boundary with `openshell-prover`
• Hosting shared, policy-controlled agent sandboxes for a team on Kubernetes with the Helm chart
• Pointing sandboxed agents at a self-hosted or private model endpoint while blocking all other model providers

OpenShell addresses a gap that most coding agents leave to their users: permission prompts inside the agent are not a security boundary, and agents run with whatever access their user account has. OpenShell moves enforcement to the kernel and a supervisor the agent cannot reach, and its best idea is keeping real credentials out of the sandbox entirely. The policy advisor and prover make least-privilege workable, because access can grow as the agent needs it and each change is checked first. The costs are operational. You own the images, the policies, and the kernel requirements, and on Kubernetes the guarantees are only as strong as your CNI. For teams already letting agents touch real code and secrets, it is a strong option to evaluate, and solo developers can try it with Docker on a laptop.

About NVIDIA OpenShell

OpenShell is not an agent. It is the boundary you run an agent inside. A gateway acts as the control plane, and for each sandbox a compute driver starts the agent's workload next to a separate, trusted supervisor. Inside the workload the agent runs as a non-root user with no Linux capabilities, Landlock limits which paths it can read or write, and seccomp hands every TCP connection and DNS lookup to the supervisor, which checks it against policy before opening the real connection. Network access is denied by default. Policies allow specific destinations per program and can restrict the requests sent, for example read-only access to an API. Credentials are stored as providers, and the agent only sees placeholders, which the supervisor swaps for the real key on requests to endpoints the provider profile allows. When the agent hits a blocked destination, OpenShell drafts a narrow rule, and a policy prover that uses an SMT solver checks it for risky new access, such as credentialed reach to a new host or cloud metadata endpoints, before a human approves it. Approved rules hot-reload without restarting the sandbox. Sandboxes run on Docker, Podman, Kubernetes (Helm), or microVMs, can request NVIDIA GPUs, and use standard Linux OCI images, so you bring an image that already contains your agent. OpenShell 0.1.0 (September 25, 2026) moved the project to a stable release cadence, with tagged stable releases generally every week. Three days later NVIDIA declared OpenShell broadly available as the open-source software part of its Open Agent Safety Platform, which also includes the Sentry watchdog reference design for BlueField-4 DPUs. The tradeoffs are setup and scope. You write or adapt policies and images yourself, Linux hosts need a recent kernel with Landlock and specific seccomp features, Kubernetes needs a CNI that enforces NetworkPolicy, and the prover does not yet cover every policy feature.