OpenShell: NVIDIA's agent runtime enforces policy in the kernel

The README's framing is that agents are most useful when they can read files, install packages, call APIs and use credentials, and that OpenShell gives them that capability without unrestricted access to your data, secrets or network. You declare what each agent can touch in a policy, and OpenShell enforces it. The two mechanisms named are kernel instrumentation at runtime and formal verification of policy changes; the Architecture doc is cited for how the gateway, supervisor and sandbox fit together.

Each agent runs in an isolated sandbox. Kernel controls confine which files it can access and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox. Credentials are handled separately: agents never see real credentials, and OpenShell adds them only to requests bound for approved endpoints, including inference.

The README does not say which kernel mechanisms do the work. There is no mention of seccomp, eBPF, Landlock or any LSM by name, no statement of syscall-filter granularity, and no figure for the overhead that per-call and per-connection checks add. For anyone weighing OpenShell against a hand-rolled container sandbox, that overhead number is the missing input, and it is not on the repository front page.

The platform requirements are explicit, and the README points to a Support Matrix for details. Commenters on Hacker News read the dependency the same way, with one noting that this is not even the sandbox - it needs Docker or other virtualization, and sits a level up to orchestrate sandboxes and access to network and resources, which they called a pretty heavy setup. The README's own description of the gateway is consistent with that: it is the control plane for sandboxes, policy and access, and the container or VM boundary is whatever your host already runs.

The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed, so the first sandbox runs nothing on its own. The Run Your First Agent walkthrough runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it. Sandbox images, runtimes, GPUs and lifecycle are documented separately under Sandboxes.

The setup practitioners describe building by hand maps onto what OpenShell ships. One commenter on Hacker News described locking agents down at work so that everything goes through a proxy with whitelisted domains only, plus credential swapping and re-signing so the agent never has the real credentials. OpenShell's Providers cover the credential half - credentials that work only at approved endpoints - and the per-connection policy check covers the egress half. For teams currently stitching that together from a proxy and a container, the trade is one control plane against a dependency on NVIDIA's gateway, supervisor and policy model.

The problem that commenter said they had not cracked - what if the agent decides to drop parts of your codebase somewhere it should not - is also the one the README does not resolve. Approved endpoints are still endpoints an agent can write to. Domain allowlisting plus credential brokering narrows the set of destinations; nothing in the source material claims payload inspection or content-level exfiltration controls. Another commenter argued the opposite risk, that the level of control is almost too pedantic and useful mainly for very nuanced enterprise requirements, since most companies can be much more coarse with their permissions.

The repository exposes this as the advisor and prover under Policies, listed alongside the filesystem, network and process rules they review. The README names no solver or verification backend, states no bound on how long a check takes, and says nothing about which policy constructs are decidable. The cost of putting the prover in a CI path is therefore unknown from the source material.

The gateway deploys to Kubernetes with Helm, and the README attaches one prerequisite: your CNI must enforce NetworkPolicy. A cluster whose CNI accepts NetworkPolicy objects without enforcing them would leave the egress half of the policy model unbacked, and the README does not list which CNIs qualify. Commenters on Hacker News disagreed about whether Kubernetes is the right target at all: one claimed the agentic industry is moving away from k8s as a deployment platform, two asked that commenter for specifics on why and where to, and one pushed back that the organisations they see are consolidating on OpenShift or bare k8s, with KubeVirt for VMs. Both deployment paths exist in the repository - a local gateway from install.sh, or Helm - and Gateways is documented as the control plane for sandboxes, policy and access.

OpenShell collects anonymous telemetry limited to operational categories and counts. The README states it does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content, and points to published community telemetry reports for usage trends. Disable it by setting OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs; the project also says you can compile telemetry out entirely. That default drew the sharpest pushback in the Hacker News thread, with one commenter calling taking default telemetry insane, another pointing to building from source without the telemetry feature, and a third asking what, concretely, anyone turning off anonymous telemetry is worried about.

The SDKs talk to an OpenShell gateway and do not install the CLI: Python with uv add openshell, TypeScript with npm install @nvidia/openshell-sdk from GitHub Packages, Go with go get github.com/NVIDIA/OpenShell/sdk/go@latest, and Rust with cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag <release-tag>. The README advises using the same OpenShell release for the SDK and the gateway where possible, which matters now that 0.1.x brings a stable release cadence, new isolation primitives, an expanded extension surface and new APIs, documented in a 0.1.0 upgrade guide.

Agent skills install with npx skills add NVIDIA/OpenShell, live in skills/, work without a source checkout, and teach a coding agent to drive the OpenShell CLI, write sandbox policies, and debug gateways and inference routing. Extensibility covers middleware, interceptors and compute drivers for anyone adding their own enforcement or backend. The repository also publishes prerelease and development builds, a Brev Launchable for trying it in the cloud, a roadmap and an RFC board.

Commenters on Hacker News reported that a significant part of the demos at GTC Europe used OpenShell, with the same commenter saying they had never heard of it before; another framed NVIDIA's demo partnerships as the normal route to a GTC showcase. Those are reactions, not adoption data - the README publishes no user, deployment or production-fleet counts. Security vulnerabilities go through SECURITY.md rather than GitHub issues, and the README's notice warns that the software automatically retrieves and interacts with external materials that are governed by separate terms and are not distributed with it, provided AS IS without warranty.