[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1t9qhh7nnt2cm":3},{"code":4,"message":5,"data":6,"timestamp":53},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":41,"summary_md":42,"topic":43,"github_topics":46,"license":47,"homepage":48,"updated_at":49,"history":50},"NVIDIA\u002FOpenShell",1,"OpenShell is the safe, private runtime for autonomous AI agents.","Rust",19293,1920,893,241,[16,22,27,33,37],{"id":17,"title":18,"points":19,"comments":20,"posted_at":21},50198675,"OpenShell – A safe, private runtime for fleets of autonomous AI agents",496,217,"2026-10-22",{"id":23,"title":24,"points":25,"comments":8,"posted_at":26},47404566,"OpenShell: Nvidia's sandbox for AI agents like OpenClaw",4,"2026-03-16",{"id":28,"title":29,"points":30,"comments":31,"posted_at":32},49933338,"Nvidia\u002FOpenShell: Safe, private runtime for autonomous AI agents",2,0,"2026-10-02",{"id":34,"title":35,"points":30,"comments":31,"posted_at":36},47851034,"Nvidia OpenShell: safe, private runtime for autonomous AI agents","2026-04-21",{"id":38,"title":39,"points":30,"comments":31,"posted_at":40},47415185,"OpenShell – private runtime for autonomous AI agents","2026-03-17","给自主 Agent 一个能读文件、调 API、用凭证但受策略约束的沙箱运行时。","## 解决什么问题\n\nAgent 一旦能读文件、装包、调 API、使用凭证，才算真正干活；也正是在这一刻，它变得危险。常见做法是把 Agent 丢进一个容器、发一个 service account，然后祈祷它不往外网发数据。OpenShell 补的是「Agent 能做实事」和「Agent 不能把数据带出去」之间的缺口：每个 Agent 跑在独立沙箱里，文件访问、系统调用和对外连接都按声明的策略在运行时拦截。\n\n## 有什么不同\n\n多数 Agent 沙箱本质是受限镜像加一个网络代理，策略写在配置里，构建时检查一次或者干脆不检查。OpenShell 在 kernel 层逐次拦截，更少见的是对策略变更做形式化验证——在生效前标出「这个改动会让某个新主机可以带着凭证访问」这类风险，等人工确认。第二个差异点是凭证：Agent 看不到真实 secret，只有发往批准端点的请求才会被注入。相对 Docker、Kubernetes NetworkPolicy 这类通用隔离，它是 Agent 感知的；相对托管型 Agent 平台，控制面留在自己手里，可以 Helm 部署 gateway。\n\n## 适合谁\n\n适合真正在跑一批有文件系统和网络权限的编码\u002F运维 Agent 的平台工程师和安全工程师——那些被问「这个 Agent 到底能碰到什么」却答不上来的团队。也适合在合规或多租户环境下必须自托管 gateway 的部署。只想拿单个 Agent 做实验的个人开发者不必上这套：一个普通容器加一个限权 API key 就够，策略编写和审批流程纯属额外负担。\n\n## 上手成本\n\n需要 Linux、Apple Silicon 的 macOS 或 WSL 2 下的 Windows（实验性），外加 Docker、Podman 或宿主机虚拟化。走 Kubernetes 路线时 CNI 必须真正执行 `NetworkPolicy`，这是实打实的基础设施约束。安装是仓库里的一个 shell 脚本。项目很新（2026 年 2 月创建），README 自己把 0.1.x 称为稳定发布节奏的起点，API 和策略 schema 预计还会动；默认开启匿名遥测，部分环境需要关掉。许可证为 Apache-2.0，比较宽松，但你接入的是一个 pre-1.0 的控制面。\n\n## 点评\n\n这是个新项目但早期关注度异常高：241 天拿到约 19.2k stars，近一个月 +9,666（月榜第 6），外加一条 496 分的 Hacker News 讨论——热度集中在一次爆发而非长期积累，所以人气说明它切中了痛点，不代表它成熟。kernel 级拦截加策略变更验证确实是差异化的方向，NVIDIA 的背景也让持续维护比较可信。风险在于最有意思的那一半——策略变更的形式化验证——恰恰是 0.1.x 阶段最可能单薄或固执的地方，而且整套设计默认你愿意跑一个 gateway。要把 Agent 放到生产数据附近，值得认真评估；只是想要个容器的话，没必要。",{"slug":44,"name":45},"ai-engineering","AI 工程",[],"Apache-2.0","https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002F","2026-10-24T15:05:40Z",[51],{"date":52,"stars":11,"stars_gained":13},"2026-10-24",1792864055]