# OpenShell OpenShell is a safe, private runtime for autonomous [[AI Agents]] built by NVIDIA. It provides sandboxed execution environments using [[Docker]] and [[Kubernetes]] (K3s) to isolate AI agents while protecting user data, credentials, and infrastructure through declarative policy enforcement. ## How it works Each agent runs in an isolated container governed by YAML-based policies. OpenShell follows the [[Least Privilege Principle|principle of least privilege]]: agents start with minimal permissions, and access is explicitly allowlisted. The system enforces four policy layers: - **Filesystem**: prevents unauthorized file access - **Network**: blocks unauthorized outbound connections via policy-enforced egress routing - **Process**: prevents privilege escalation - **Inference**: reroutes LLM API calls to controlled backends, keeping sensitive context local Static policies (filesystem, process) lock at sandbox creation. Dynamic policies (network, inference) can be hot-reloaded on running sandboxes without restart. [[Microsoft eXecution Container (MXC)|MXC]] uses a similar layered policy model (filesystem, network, UI), but it ships as an SDK that maps the policy onto each OS's own sandbox on Windows, Linux and macOS. On Hacker News, a developer building on OpenShell asked why everyone writes their own sandbox runtime; another answered that MXC's multi-platform requirement is one OpenShell doesn't meet. ## Architecture Everything runs within a single Docker container using K3s for orchestration: - **Gateway**: control-plane API managing sandbox lifecycle and authentication - **Policy Engine**: enforces constraints from application layer to kernel - **Privacy Router**: reroutes model API calls while keeping sensitive context local - **Sandbox**: isolated runtime with container supervision ## Credential management OpenShell uses "providers", which are named credential bundles injected as environment variables at runtime. Credentials never appear in the sandbox filesystem, so an agent can't leak a secret it never holds. It can still leak any data it's allowed to read (see the Hacker News section below). ## Supported agents - [[Claude Code]] - [[OpenCode]] - [[GitHub Copilot CLI]] - [[OpenClaw]] - [[Ollama]] - Community-contributed agents ## Tech stack Core is written in [[Rust]] with [[Python]] for the CLI and tooling. Default sandbox includes Python 3.13, Node.js 22, Git, GitHub CLI, and Vim. Experimental GPU passthrough supports local inference and fine-tuning. ## Development philosophy The project is "built agent-first": the codebase includes agent skills for debugging, policy generation, security review, and triage. Development follows a human-gated workflow where agents propose plans, humans approve, and agents implement. ## Reception on Hacker News The repo hit the Hacker News front page around 2026-10-23 (507 points, 218 comments). Most of the thread was about what a sandbox can't stop. - prennert relayed NVIDIA's GTC pitch: OpenShell restricts each agent and also watches the combined permissions of the whole fleet, so agents can't pool their access. A "separation of powers" setup (one agent extracts, one processes, one publishes) is still open to collusion - Exfiltration was the main objection. marcosscriven showed that any public-facing action, even a view counter, can carry data out under strict URL and method rules. adastra22 called stopping it "difficult in theory, impossible in practice", then added that "perfect is the enemy of better". fennecbutt runs the same pattern OpenShell uses (network allowlists plus credential swapping) and admitted that a [[Prompt injection|prompt-injected]] agent could still leak data slowly - smashed argued for the [[Lethal Trifecta for AI Agents|lethal trifecta]] rule instead: no single agent should combine untrusted input, private data and network access. ghm2180 suggested giving agents only a constrained code-execution API inside a [[Web Assembly (WASM)|WebAssembly]] sandbox - knicholes described the enforcement: Seccomp and Landlock, filesystem and network calls checked against an externally applied policy, and credentials injected by a man-in-the-middle proxy so the model never sees them - Many asked why this needs to exist. 3abiton: "You can do the same with bubblewrap on linux, on any shell". Havoc: "Why are we reinventing virtualization & containerisation with AI flavour?" smashed built the same thing with plain [[Docker]] (internal-only network, sidecar credential proxy) and thought OpenShell mostly fits large organizations with legacy access setups. Others cited Lima, Colima, OrbStack, smolvm, nono, [[Docker Sandboxes]] and Anthropic's sandbox-runtime - Telemetry is on by default ("OpenShell collects anonymous telemetry"). lcampbell: "There's no such thing as anonymity in 2026". Environment variables turn it off - Morkeeth asked where a human actually sees and approves a policy expansion (permission fatigue again, see [[AI Agent Permissions]]). esafak doubted long-term maintenance ("nvidia is not a software company"); RevEng answered that NVIDIA writes plenty of software to sell more hardware smallnix summed up the tension: "the more access you give the agent the more capable it becomes." OpenShell shrinks the blast radius, and that's worth having. But I'd treat its policies as a guard against accidents and credential theft, not as a guarantee against exfiltration. ## Status Alpha (single-player mode). Licensed under Apache 2.0. ## References - https://github.com/NVIDIA/OpenShell - https://docs.nvidia.com/openshell/latest/ - Hacker News discussion of MXC, comparing it with OpenShell (2026-10-09): https://news.ycombinator.com/item?id=50016489 - Hacker News discussion of OpenShell (2026-10): https://news.ycombinator.com/item?id=50198675 ## Related - [[AI Agents]] - [[AI Agent Permissions]] - [[AI Agent Harness]] - [[AI Safety]] - [[Containerization]] - [[Docker]] - [[Kubernetes]] - [[Rust]] - [[Claude Code]] - [[NVIDIA Agent Toolkit]] - [[NemoClaw]] - [[NVIDIA Nemotron]] - [[Microsoft eXecution Container (MXC)]] - [[Docker Sandboxes]] - [[microVM]] - [[OpenSandbox]] - [[Lethal Trifecta for AI Agents]]