NVIDIA OpenShell puts each AI agent in a kernel-enforced sandbox and makes policy changes wait for review

A policy file decides what each agent may touch, and the kernel enforces it

The core idea in OpenShell is that you write down what an agent is allowed to do and the runtime refuses everything else. Each agent runs in its own isolated sandbox. Kernel controls confine which files the agent can open and which system calls it can make, and every outbound network connection passes a policy check before it leaves the sandbox. Policies cover three areas: filesystem, network and process rules.

Credentials are handled separately from the agent. The agent never sees the real secret; OpenShell attaches it only to requests headed for endpoints the policy approves. The project calls these credential holders providers, and inference endpoints are one kind of provider. The consequence for you is that an agent tricked into exfiltrating a token has no token to send, but it also means every API the agent legitimately needs has to be listed as an approved endpoint first, or its calls will be blocked.

The prover flags new access, but a person still has to approve it

OpenShell does not treat a policy edit as a simple config reload. Before a change is approved, it runs formal verification over the new policy to find access the change would grant that the old one did not. The examples NVIDIA gives are reaching a new host with credentials or calling a new API method. Changes like that are held for human review instead of being applied automatically. Two tools sit around this step: an advisor and a prover, both described in the Policies section of the documentation, and the examples/policy-advisor/ directory in the repository shows the flow.

What the prover cannot do is decide for you. It flags risky additions; it does not judge whether your business needs them. If nobody is assigned to review flagged changes, agents that ask for new access will sit blocked. Teams running fleets of agents should plan for that review queue the same way they plan for code review.

The installer sets up a gateway and an empty Ubuntu sandbox, not an agent

The quickstart is two commands:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

The script installs the openshell CLI and a local gateway. The gateway is the control plane for sandboxes, policy and access; the sandbox is where the agent runs. Running sandbox create gives you a sandbox built from the default image, which is minimal Ubuntu with no agent installed. People expecting a ready coding agent after the second command will find an empty shell.

To get something useful running, NVIDIA points to the Run Your First Agent guide, which runs OpenCode against a free OpenRouter model and walks through approving new access as the agent asks for it. Prerelease and development builds, including the latest commit on main, are installed through a separate path in the installation docs.

Windows runs through experimental WSL 2 or a separate MXC branch

The supported hosts are Linux, macOS on Apple Silicon, and Windows with WSL 2, which is marked experimental. On top of the OS you need Docker, Podman, or host virtualization to run sandboxes. macOS on Intel is not in that list. The Python package classifiers name only POSIX Linux and macOS as operating systems.

Native Windows support goes through Microsoft MXC and lives on a separate windows branch, documented in WINDOWS.md, which covers setup and its current limitations. For a reader on Windows 10 or Windows 11 the consequence is plain: there is no Windows installer in the quickstart, the main path is WSL 2 and it is experimental, and the native route sits off the main branch. Anyone searching for OpenShell skins, Start menu settings or EFI use is looking at a different kind of software; NVIDIA's OpenShell is a sandbox runtime for agents and has none of those.

SDKs connect to a gateway and do not install the CLI

OpenShell ships client SDKs in four languages. They let an application talk to an existing gateway; none of them installs the CLI or a gateway, so you still need the installer or a Kubernetes deployment somewhere.

uv add openshell
npm install @nvidia/openshell-sdk
go get github.com/NVIDIA/OpenShell/sdk/go@latest
cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag <release-tag>

The TypeScript package is published through GitHub Packages. The Rust crate is pulled from the Git repository at a release tag you supply. The Python package needs Python 3.11 or newer, with classifiers for 3.11 through 3.14, and depends on grpcio, protobuf, httpx and cloudpickle. NVIDIA asks you to use the same OpenShell release for the SDK and the gateway when possible, so the Go command's @latest is a poor fit for a pinned gateway; pin it to your gateway's tag instead.

Kubernetes deployments depend on a CNI that enforces NetworkPolicy

Beyond the local gateway, OpenShell can deploy its gateway to Kubernetes with Helm. The stated requirement is that your CNI must enforce NetworkPolicy. Clusters whose network plugin does not enforce it fail that requirement, so check the CNI before planning a cluster rollout rather than after.

The gateway also exposes an extension surface: middleware, interceptors and compute drivers. The repository's examples directory shows what that looks like in practice, with folders such as governance-interceptor, supervisor-middleware-content-guard, isolation-backend-v8, spiffe-token-exchange-demo, private-ip-routing and transparent-tcp-redis. For contributors running several gateways side by side, the .env.example file sets OPENSHELL_DOCKER_GATEWAY_NAME, OPENSHELL_GATEWAY and OPENSHELL_SERVER_PORT (18080 in the example), and warns that names and ports must be unique per worktree when using mise run gateway:docker.

Telemetry stays on until you disable it at the gateway

OpenShell collects anonymous telemetry by default, limited to operational categories and counts. NVIDIA states it does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. Published usage trends sit under telemetry/ in the repository.

The switch lives on the gateway, not on each sandbox. Set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs. You can also compile telemetry out entirely when building from source. For an organization whose policy forbids outbound usage reporting from developer machines, this means the default install reports until someone changes the gateway setting, so add it to your install script rather than relying on users to remember.

Alpha status on a weekly 0.1.x release train

The Python package is classified as Development Status 3, Alpha. The 0.1.x line introduced a stable release cadence, new isolation primitives, an expanded extension surface and new APIs, and there is a dedicated 0.1.0 upgrade guide for moving from earlier versions. Recent tags are v0.1.5 on 2026-10-20 and v0.1.6 on 2026-10-27, a week apart, plus a rolling dev build. The last push to main was on 2026-11-02, so the project is under active development.

That pace has a cost. Because SDKs should match the gateway release, every gateway upgrade is also an SDK upgrade across your Python, TypeScript, Go or Rust clients. The workspace builds with Rust 1.94 on the 2024 edition, which matters if you plan to compile it yourself. Coding agents can learn the CLI through a public skills package, installed with:

npx skills add NVIDIA/OpenShell

Those skills cover driving the CLI, writing sandbox policies and debugging gateways and inference routing, and they work without a source checkout.

Editorial conclusion

OpenShell fits teams that already let agents read files, install packages and call APIs with real credentials, and want those actions bounded by a written policy plus a review step for anything new. It does not fit someone looking for a finished agent, a native Windows desktop tool, or a Kubernetes cluster whose CNI ignores NetworkPolicy. Before adopting it, confirm your platform is on the Support Matrix, decide who will approve flagged policy changes, pin the SDK to the same release as the gateway, and decide whether to switch off telemetry.

Frequently asked questions

Official sources

1. License: Apache-2.0
2. NVIDIA/OpenShell on GitHub
3. Project website
4. README
5. Releases