What it is
OpenShell runs autonomous agents in isolated sandboxes and enforces a policy at the kernel level on every file access, system call and network connection. Agents never see real credentials: the gateway adds them only to requests bound for approved endpoints. Before a policy change takes effect, a prover uses formal verification to flag risky new access, such as a new host that would receive credentials, so a person reviews it first.
It runs on Linux, macOS on Apple Silicon and, experimentally, Windows through WSL 2, and needs Docker, Podman or host virtualisation plus a local gateway. There is a Kubernetes setup, and SDKs for TypeScript and Rust. v0.1.5 shipped on 20 October 2026.
Our review
Letting an agent run overnight is a different risk from letting one help while you watch. Nobody is there to click "deny". OpenShell is built for that situation.
Each agent gets its own sandbox, and every file it opens and every connection it makes is checked against a policy you wrote. Two ideas set it apart. The agent never holds your real API keys; OpenShell adds them only to requests going to hosts you approved. And when someone changes the policy, a formal checker points out what new access the change would grant before it applies, so you are not approving a YAML diff blind.
The catch: it is heavier than a plain sandbox. You need Docker, Podman or a VM plus a gateway, and the 0.1 version number is honest, so expect changes. Anonymous telemetry is on by default; the README lists what it does not collect, and you turn it off with OPENSHELL_TELEMETRY_ENABLED=false.
Our take: for a developer at a laptop, Anthropic's srt does most of this with a tenth of the setup. OpenShell earns its weight when agents run untrusted code, run unattended or need per-API rules, and running both on one workload only adds a second set of rules to debug.
Where it earns its place
A platform team running nightly agent jobs on a CI fleet
Let agents call internal APIs without handing them the keys
Each job runs in an OpenShell sandbox; the gateway injects credentials only for approved hosts and the prover flags any policy change that widens access.
A security engineer reviewing agent permissions
Allow an agent to read an API but never write to it
Write network rules per HTTP method, so GET passes and POST is refused, and review proposed policy changes through the prover before they apply.
Before you commit
- Setup
- curl -LsSf the install.sh script, then openshell sandbox create -- claude. The default image is minimal Ubuntu with no agent installed.
- Integrations
- Documents Claude Code, Codex, Copilot CLI and OpenCode; Kubernetes with NetworkPolicy; TypeScript and Rust SDKs.
- Data and privacy
- Anonymous operational telemetry on by default (no prompts, paths, credentials or content, per the README); disable with OPENSHELL_TELEMETRY_ENABLED=false. Apache 2.0.
- Cost at scale
- Free; the cost is the container or VM capacity each sandbox needs.
- Limits
- 0.1.x, so expect breaking changes; WSL 2 support is experimental.
What's good
- Kernel-level checks on files, system calls and network
- Agents never see real credentials
- Formal verification flags risky policy changes
- Kubernetes support and SDKs
What's not
- Needs Docker, Podman or a VM plus a gateway
- Young 0.1.x releases
- Anonymous telemetry on by default
- Windows only through experimental WSL 2
Best for
Teams running agents unattended or on untrusted code who need per-host and per-method network rules.
Alternatives
NVIDIA OpenShell: common questions
- Is NVIDIA OpenShell worth it?
- A heavyweight agent sandbox built for agents you leave running unattended, not ones you sit and watch. We rate it 4.1 out of 5.
- How much does NVIDIA OpenShell cost?
- Free and open source under Apache 2.0.
- What are the downsides of NVIDIA OpenShell?
- Needs Docker, Podman or a VM plus a gateway; young 0.1.x releases; anonymous telemetry on by default; windows only through experimental WSL 2.
- Who is NVIDIA OpenShell best for?
- Teams running agents unattended or on untrusted code who need per-host and per-method network rules.
- How much does NVIDIA OpenShell cost for a team or in production?
- Free; the cost is the container or VM capacity each sandbox needs.
- Is NVIDIA OpenShell safe for company data?
- Anonymous operational telemetry on by default (no prompts, paths, credentials or content, per the README); disable with OPENSHELL_TELEMETRY_ENABLED=false. Apache 2.0.
- What are the best NVIDIA OpenShell alternatives?
- The closest alternatives we have reviewed are Anthropic Sandbox Runtime (srt) and ToolHive.
Answers checked Oct 24, 2026.
Make NVIDIA OpenShell? Show this rating on your site
