NVIDIA’s OpenShell Puts Agent Sandboxes Under Kernel Control

NVIDIA’s OpenShell, the agent-sandboxing runtime the company announced on September 28, 2026, reached version 0.1.5 on October 20 — the fifth release in a 0.1.x line that added a stable cadence, new isolation primitives and a wider extension surface. The project’s premise is that an agent which can read files, install packages and call APIs needs a boundary enforced below the application layer, not inside it.

What It Is

OpenShell runs each agent in its own sandbox and lets the operator declare, in YAML, what that agent may touch: filesystem paths, network destinations, process behaviour and where credentials may be sent. The runtime then enforces those rules on every file access, system call and outbound connection. It installs as a CLI plus a local gateway, and supports Linux, macOS on Apple Silicon and Windows through WSL 2, on top of Docker, Podman or host virtualisation.

The design assumes the agent is untrusted. On the Linux backend the workload runs under a single non-root identity with no capabilities, filesystem access is confined with Landlock, and network operations are staged through seccomp user notification. Rather than trusting the agent’s own report of what it is doing, the sandbox identifies the calling executable from kernel-level process observations.

The Trust Boundary

Everything hinges on a split between a supervisor on the trusted side and a sandbox that shares a boundary with the agent. The supervisor makes policy decisions, resolves DNS, opens approved connections and hands out credentials; the sandbox never decides anything, it reports intent and waits. The workload’s only permitted egress is the connection back to the supervisor, and everything else is denied by rule.

The two speak over a single mutually authenticated HTTP/2 connection carrying many independent streams, each TCP connection with its own backpressure so a slow download cannot block DNS or process control. The compute driver picks the transport — a Unix socket for Docker and Podman, TCP for Kubernetes, vsock for microVMs — while authentication and protocol behaviour stay the same.

Credentials are handled the same way. Agents never hold real secrets; a provider profile maps a service name to a stored credential, and the supervisor injects it only into requests bound for endpoints the policy approves. Rotation and revocation apply at runtime, though new environment variables require a new process.

Policies That Prove Themselves

The most unusual component is the policy prover. Agents can propose their own network rules — a normal pattern when a tool discovers it needs a new host — so OpenShell runs the proposed change through formal verification before applying it. The prover flags additions such as new credentialed reach, a new HTTP method on an approved API, or access to cloud metadata endpoints. Any finding blocks automatic approval and sends the change to a human. The same logic ships as a standalone openshell-prover command for checking a policy in CI.

That is a meaningfully different posture from a static allowlist. The common failure in agent sandboxes is policy drift: an operator approves access once, the agent keeps the grant, and the effective boundary widens without anyone deciding it should. Making each widening an explicit, machine-checked event is the part of this design worth watching.

What This Means

OpenShell arrives in a crowded field. Container sandboxes, seccomp profiles and network egress proxies all exist; what NVIDIA is selling is the combination — a declared policy, kernel enforcement, credential brokering and a prover — with the supervising process separated from the agent by construction. The documentation names coding agents explicitly, including Claude Code, OpenCode, Codex and GitHub Copilot CLI, which is an admission that the people running agents locally are the ones who need this first.

Two caveats are worth stating. The project is at 0.1.x, its Windows support is marked experimental, and its enforcement story is deepest on Linux, which is where Landlock and seccomp live. And OpenShell is the software half of a larger pitch: NVIDIA’s Sentry reference design puts an out-of-band watchdog on BlueField-4 DPUs to quarantine misbehaving agents in hardware, which is a compelling architecture and also a reason the platform framing exists at all. The runtime is usable on its own; the hardware half is not something most readers can test.

This post was drafted with AI assistance and reviewed by RITS staff.

Sources

• GitHub: NVIDIA/OpenShell repository and README (Apache 2.0)
• NVIDIA OpenShell documentation: overview (v0.1.5)
• NVIDIA OpenShell documentation: architecture
• NVIDIA: “NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment” (September 28, 2026)
• GitHub: OpenShell release history