NVIDIA/OpenShell

The problem

Agents are only useful once they can read files, install packages, call APIs and use credentials — and that is exactly when they become dangerous. Teams currently handle this by giving an agent a container and a service account, then hoping nothing leaves the network. OpenShell addresses the gap between "agent can do real work" and "agent cannot exfiltrate your data": each agent runs in an isolated sandbox, and a declared policy governs file access, syscalls and outbound connections at runtime.

What's different

Most agent sandboxes are containers with a restricted image and a network proxy bolted on; policy lives in configuration that is checked at build time or not at all. OpenShell enforces at the kernel level per access, and — the more unusual part — runs formal verification over proposed policy changes before they are applied, flagging things like a new host reachable with credentials. A second differentiator is credential handling: agents never see the real secret, which is injected only into requests bound for approved endpoints. Compared with general container isolation (Docker, Kubernetes NetworkPolicy) this is agent-aware; compared with hosted agent platforms it keeps the control plane on your own infrastructure, including a Helm-deployed gateway.

Who it's for

Platform and security engineers at organizations actually running fleets of coding or ops agents with real filesystem and network reach — the ones who get asked "what can this agent reach?" and currently have no good answer. It also suits teams deploying agents in regulated or multi-tenant environments where the gateway needs to be self-hosted. Solo developers experimenting with a single agent should look elsewhere: a plain container plus a scoped API key covers that case with far less machinery, and the policy authoring and approval workflow would just be overhead.

Cost of adoption

Linux, Apple Silicon macOS, or Windows via WSL 2 (experimental), plus Docker, Podman or host virtualization. The Kubernetes path requires a CNI that actually enforces NetworkPolicy — a real infrastructure constraint, not a checkbox. Installation is a single shell script from the repo. The project is young (created February 2026) and the README itself calls 0.1.x the start of a stable release cadence, so expect API and policy-schema movement; it also collects anonymous telemetry by default, which some environments will want disabled. License is Apache-2.0, which is permissive, but you are adopting a pre-1.0 control plane.

Verdict

This is a brand-new project with unusually large early attention: ~19.2k stars at 241 days old, +9,666 in the past month (#6 on the monthly board), and a 496-point Hacker News thread — interest is concentrated in a single spike rather than a long track record, so treat popularity as a signal of relevance, not of maturity. The kernel-level enforcement plus verified policy diffing is a genuinely differentiated angle, and NVIDIA's backing makes sustained maintenance plausible. The risk is that the interesting half — formal verification of policy changes — is the part most likely to be thin or opinionated at 0.1.x, and the whole design assumes you are willing to run a gateway. Worth a serious evaluation if you are putting agents near production data; not worth it if you just want a container.