OpenShell

Summary

OpenShell is an open-source runtime, from NVIDIA, that sandboxes autonomous AI agents so they run with only the permissions they need, enforced by declarative policies that block unauthorized file access, data exfiltration, and uncontrolled network activity. It is a command-line tool, installed with a shell script or via PyPI, with the sandboxes themselves backed by Docker, Podman, Kubernetes, or experimental MicroVMs, and it also ships a Helm chart for cluster deployment. It's aimed at teams building or operating AI agents who need to constrain what those agents can touch, rather than at traditional SOC or red-team work, fitting into the broader ai-security category of controlling agent behavior at runtime. With 116 contributors, over 2,300 commits and 68 releases in the past year, and a release just 16 days ago, it is under active, fast-moving development, though its own status badge still marks it alpha.

OpenShell is the safe, private runtime for autonomous AI agents.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v0.0.115 Aug 27, 2026 · issue 009

   OpenShell v0.0.115 adds native Windows MXC compute driver, OTLP trace export for Kubernetes, and OCI SBOM/provenance attestations.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.115 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.115

   • ›Adds native Windows MXC compute driver with full server wiring, expanding supported compute platforms to include Windows-native MXC environments.
   • ›Exports driver traces over OTLP from the Kubernetes deployment path, enabling observability pipelines to ingest OpenShell gateway telemetry.
   • ›Identifies gateways by name/identity in exported traces, making multi-gateway deployments distinguishable in trace data.
   • ›Publishes OCI SBOM and provenance attestations alongside release artifacts, supporting supply-chain verification workflows.
   • ›Unifies the local Kubernetes gateway development workflow, reducing setup friction for contributors running the gateway on Kubernetes.
2. v0.0.113 Aug 25, 2026 · issue 008

   OpenShell v0.0.113 adds OTLP driver trace export for Docker and corporate CA trust for Podman HTTPS proxies.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.113 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.113

   • ›Exports Docker driver traces over OTLP, enabling observability pipelines to ingest sandbox container activity.
   • ›Trusts corporate CA certificates for HTTPS proxies and intercepted TLS traffic in Podman-backed sandboxes.
3. v0.0.111 Aug 21, 2026 · issue 005

   OpenShell v0.0.111 adds transparent TCP egress, policy DNS correlation, OTLP trace export, and Docker/Podman network policy enforcement.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.111 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.111

   • ›Adds OTLP trace export for Podman driver, enabling observability pipelines to receive driver traces from sandboxes.
   • ›Adds a policy DNS correlation store, linking DNS lookups to outbound TCP connections for richer network policy decisions.
   • ›Enables Docker and Podman runtimes to enforce policy DNS and transparent TCP, extending L7 network controls to both container backends.
   • ›Adds a canonical main process to the sandbox supervisor, providing a stable process anchor for sandbox lifecycle management.
   • ›Adds standalone first-party compute drivers, allowing the gateway to use built-in drivers without external dependencies.
4. v0.0.110 Aug 20, 2026 · issue 005

   OpenShell v0.0.110 adds OIDC device authorization grant for headless login and non-root sandbox identity support.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.110 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.110

   • ›Supports OIDC device authorization grant flow for headless (browserless) login, enabling CLI authentication in CI/CD and server environments.
   • ›Allows non-root identities inside sandbox environments, expanding the range of workloads and privilege models that sandboxes can run.
   • ›Stores refresh credentials in credential drivers so providers can renew tokens without user intervention.
5. v0.0.109 Aug 19, 2026 · issue 005

   OpenShell v0.0.109 emits AI inference events via the OCSF ai_operation profile on ApiActivity, bumping OCSF schema to v1.8.0.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.109 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.109

   • ›Emits AI inference events using the OCSF ai_operation profile on ApiActivity events, with schema bumped to v1.8.0 (OCSF class ID 6003).
6. v0.0.106 Aug 14, 2026 · issue 005

   OpenShell v0.0.106 adds a Go SDK with domain clients and auth, a TypeScript SDK (@nvidia/openshell-sdk), and cert-manager external issuer plus OpenShift passthrough Route support in HelmHelmA package manager for Kubernetes, maintained by the CNCF, that bundles application manifests into versioned archives called charts so that cyber tools can be deployed, configured, and upgraded on a cluster with a single command..

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.106 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.106

   • ›Adds @nvidia/openshell-sdk TypeScript SDK for programmatic OpenShell integration.
   • ›Adds a complete Go SDK with domain clients, authentication, and hardening.
   • ›Adds cert-manager external issuer support and OpenShift passthrough Route to the Helm chart deployment.
7. v0.0.105 Aug 13, 2026 · issue 005

   OpenShell v0.0.105 adds stop and start operations for sandboxes.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.105 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.105

   └──▷ TRY IT
   Suspend a running sandbox to free resources, then restart it later without losing the environment.
   copy

   $ openshell sandbox stop my-sandbox
   # ... later ...
   openshell sandbox start my-sandbox

   • ›Adds stop and start operations to the sandbox subcommand, enabling sandboxes to be suspended and resumed without deletion.
8. v0.0.104 Aug 12, 2026 · issue 005

   OpenShell v0.0.104 adds Windows compilation support, a glibc-static supervisor variant, and credential leak warnings on --env.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.104 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.104

   └──▷ TRY IT
   Catch accidental credential exposure before a sandbox starts — the CLI warns when an --env value resembles a secret.
   copy

   $ openshell sandbox create --env API_KEY=sk-abc123secret -- claude

   • ›Adds a warning when values passed to --env look like credentials, helping prevent accidental secret exposure at sandbox creation.
   • ›Adds a glibc-static supervisor libc variant for environments where dynamic glibc linking is unavailable.
   • ›Enables Windows native compilation support for the gateway and CLI.
9. v0.0.103 Aug 11, 2026 · issue 005

   OpenShell v0.0.103 adds static credential binding to provider endpoints in the proxy.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.0.103 https://github.com/NVIDIA/OpenShell.git
   # already have the repo? check out this version:
   $ git checkout v0.0.103

   • ›Adds the ability to bind static credentials to provider endpoints in the proxy, enabling gateway-managed credential injection at the network layer.
10. v0.0.101 Aug 7, 2026 · issue 005

    OpenShell v0.0.101 adds credential driver build targets and pulls the VM driver and runtime from GitHub via Bazel.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.0.101 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.101

    • ›Adds Bazel build targets for credential drivers, enabling the credential driver components to be built as part of the standard Bazel build graph.
11. v0.0.99 Aug 5, 2026 · issue 005

    OpenShell v0.0.99 adds system CA root mode, honors OCI image working directories in sandboxes, and reduces latency via TCP_NODELAY.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.0.99 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.99

    • ›Adds system CA root mode, allowing sandboxes to trust the host's CA certificate bundle for TLS verification.
    • ›Sandboxes now honor the working directory declared in OCI container images, so containers start in the path their image specifies.
12. v0.0.98 Aug 4, 2026 · issue 005

    OpenShell v0.0.98 adds OTLP driver trace export from VM sandboxes.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.0.98 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.98

    • ›Exports VM driver traces over OTLP, enabling observability pipelines to ingest sandbox execution telemetry.
13. v0.0.97 Aug 3, 2026 · issue 005

    OpenShell v0.0.97 adds gateway callback listener negotiation for compute and prototypes a Bazel build system.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.0.97 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.97

    • ›Adds gateway callback listener negotiation in the compute layer, enabling the gateway to coordinate callback endpoints with sandbox compute drivers.
    • ›Prototypes a Bazel build system for the project, laying groundwork for reproducible, hermetic builds.
    • ›Adds OpenTelemetry crate targets to the Bazel build, extending observability support under the new build system.
14. v0.0.96 Jul 31, 2026 · issue 005

    v0.0.96 adds supervisor middleware content guard, Kubernetes PVC storageClassName config, policy-first OCI image identity, and OTLP gateway trace export.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.0.96 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.96

    • ›Adds storageClassName configuration for workspace PVCs in Kubernetes deployments, enabling control over storage class selection.
    • ›Exports gateway traces over OTLP, enabling integration with OpenTelemetry-compatible observability backends.
    • ›Introduces a supervisor middleware content guard example, providing a reference implementation for enforcing content policies at the supervisor layer.
    • ›Adopts policy-first OCI image identity for sandboxes, making policy the authoritative source for image identification.
    • ›Wires authorization into the workspace model, extending access control enforcement to workspace operations.
15. v0.0.92 Jul 27, 2026 · issue 005

    Adds --output json/yaml to sandbox get, sandbox status, and sandbox create, plus corporate HTTP proxy egress routing for sandboxes.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.0.92 https://github.com/NVIDIA/OpenShell.git
    # already have the repo? check out this version:
    $ git checkout v0.0.92

    └──▷ TRY IT
    Parse sandbox creation output in CI pipelines or scripts that need the sandbox ID or status without scraping human-readable text.
    copy

    $ openshell sandbox create --output json -- claude

    Poll sandbox status in a script and process the result as structured data.
    copy

    $ openshell sandbox status --output yaml

    • ›Adds --output json and --output yaml flags to openshell sandbox get, openshell sandbox status, and openshell sandbox create for machine-readable output.
    • ›Routes sandbox egress traffic through a corporate HTTP proxy via the gateway, enabling use in enterprise network environments.