NVIDIA OpenShell

What it is

A policy-enforced sandbox for AI agents, started by NVIDIA and now a CNCF Sandbox project. You declare what each agent may touch, and the runtime enforces filesystem, network, process, and credential controls. Credentials attach only at approved endpoints, and policy changes can be formally checked before they apply.

What it helps with

- Running agents with constrained file and network access
- Restricting credentials so they resolve only at approved endpoints
- Reviewing policy changes before they grant new access

Who it's for

Security and platform teams running AI agents they operate or are authorized to deploy.

Worth knowing

Anonymous telemetry is on by default and can be disabled or compiled out. Kubernetes needs a CNI that enforces NetworkPolicy, or sandboxes may bypass network controls.

Does it run on Windows?
Linux and macOS on Apple Silicon are supported. Windows with WSL 2 is experimental; native Windows is on a separate branch.

Can I use it without Kubernetes?
Yes. Local gateways can use Docker, Podman, or MicroVM.

How does it compare with NeMo Guardrails, garak, and Falco?
In our view NeMo Guardrails constrains model input and output, garak probes LLM weaknesses, and Falco watches cloud-native runtime events; OpenShell sandboxes the agent itself.