OpenShell – A safe, private runtime for fleets of autonomous AI agents
TL;DR Highlight
OpenShell uses policy files to control agent file, network, and credential access at kernel level.
Who Should Read
Backend or platform developer who must give coding agents file, API, and credential access and is worried about isolation
Core Mechanics
- Declare what agents can touch in policy
- Every file access, system call, and network connection goes through a policy check.
- You write the allowed scope into a policy and OpenShell enforces it.
- Kernel-level isolated sandboxes
- Each agent runs in its own isolated sandbox.
- Kernel controls limit which files it can access and which system calls it can make.
- Every network connection passes a policy check before leaving the sandbox.
- Agents never see real credentials
- OpenShell adds credentials only to requests bound for approved endpoints.
- The Providers feature handles inference credentials the same way.
- Policy changes are formally verified, then human-approved
- Before a policy change, formal verification (mathematically checking what access it grants) runs.
- Changes like reaching a new host with credentials or calling a new API method wait for human review.
- Wide range of install and integration options
- It runs on Linux, Apple Silicon macOS, and WSL 2 (experimental) with Docker, Podman, or host virtualization.
- It offers Python, TypeScript, Go, and Rust SDKs plus Helm deployment.
- On Kubernetes, your CNI must enforce NetworkPolicy.
- Telemetry is on by default
- It collects anonymous operational categories and counts.
- It says it does not collect sandbox names, file paths, prompts, credentials, or model names.
- Set OPENSHELL_TELEMETRY_ENABLED=false on the gateway to turn it off.
Community Reactions
- Commenter used iron proxy for domain limits and credential swapping
- The remaining problem is data exfiltration to allowed domains a few characters at a time.
- They proxy gh access to control forks, PRs, and issues.
- Anthropic sandbox-runtime also called a good balance
- Simple config, filesystem and network limits, and credential masking are cited.
- The commenter feels safe running Pi in YOLO mode with it.
- It blocks common workflows like xcode/swift and Docker access.
- Criticism of default telemetry and excess granularity
- Commenters objected to telemetry being on by default.
- One said the control is so granular it mostly suits demanding enterprise needs.
- Skepticism about marketing claims and containers
- One commenter said more access makes agents more capable, so safe and does-it-all sounds contradictory.
- Others asked why not just use containers and how it differs from other sandboxes.
How to Apply
- Create a sandbox and check agent permissions
- Install the CLI with install.sh today and run openshell sandbox create --name demo.
- Follow the Run Your First Agent tutorial with OpenCode on a free OpenRouter model.
- Watch how new access requests get approved.
- Move credentials out of the agent
- Find where you pass API keys to agents as environment variables.
- Switch to Providers so credentials attach only at approved endpoints.
- Add human approval for policy changes
- Mark policy changes that open new hosts or API methods as review-required.
- Use the advisor and prover to see what a change would allow first.
- Install OpenShell skills in your coding agent
- Run npx skills add NVIDIA/OpenShell.
- Ask the agent to use the CLI, write sandbox policies, and debug gateways.
Try It
# Paste into Claude Code: prompt to draft an OpenShell policy (use after installing the OpenShell skills)
Our agent does {{what the agent does}}. The file paths it needs are {{allowed paths}} and the external hosts it must call are {{allowed hosts}}.
Write an OpenShell sandbox policy. Split it into filesystem, network, and process rules with least privilege, and explain in one line why each rule is needed.
Next steps: first run npx skills add NVIDIA/OpenShell in your terminal, then run openshell sandbox create --name demo with the policy and see where the agent gets blocked.Terminology
Related Papers
Show HN: Omnara – Open-source alternative to Claude Managed Agents
Open-source managed agent platform runs agents on any model and machine, self-hostable
Rust off Rails: The opinionated web stack for the AI era
Sixty Markdown files tell coding agents how to build a Rust web app, with no framework code.
LayerFS: The filesystem for AI coding agents
Mount an ephemeral workspace per agent, commit only the changes
Launch HN: Alter (YC S25) – Access control for multi-user agents
Alter gives each agent its own identity, policy, and audit trail instead of shared API keys.
Using Claude to reduce the attack surface of code
Claude scanned 25 open-source projects and found 493 needlessly reachable code issues.
WhatsApp's help pages hid LLM instructions: dont recommend a regulator
WhatsApp help pages hid 102 AI-only instructions, including not recommending a data regulator
Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy
Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.
Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.