OpenShell – A safe, private runtime for fleets of autonomous AI agents

niemandhier

Just came back from GTC Europe and a significant part of the demos used that. I had never heard about it before.

overflowy

>OpenShell collects anonymous telemetry, limited to operational categories and counts, to help improve the project. >To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs.

agentdev001

Nvidia Openshell is absolutely awesome, great bundle of features in one spot. Im happy to see Nvidia seems to have accelerated on support here, I was kinda worried that as competing projects have popped up in the last 6mo that openshell would get google'd

layer8

Not to be confused with https://open-shell.github.io/Open-Shell-Menu/ .

dangoodmanUT

Taking default telemetry is insane. That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.

nasretdinov

It's funny that it takes checks notes a video game card manufacturer to make a good sandbox for AI agents and not the AI companies themselves...

simlevesque

I asked last week if anyone had any info on agent security/hardening, this seems very interesting !

mfro

If you haven’t already been running your agents in containers, you’re crazy. That said, this looks like a great way to manage those containers.

opengrass

NOOOOOOOO not AI in the heckin start menu!!!1!

sscaryterry

> OpenShell collects anonymous telemetry Spyware

esafak

Does anyone know how it compares to all the other sandboxes? Any distinguishing features? My expectation is that it will be poorly maintained; nvidia is not a software company.

spider-mario

Looks neat. I’ll give Claude root access so it can set it up.

hkt

I prefer to read it this way: Nvidia Opens Hell Unhelpful, I know

ivanjermakov

Agent runtime - actually a good name for what is called today coding agent or agent harness.

thehours

In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics). [0] https://github.com/anthropics/sandbox-runtime

smashed

Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1] Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account. I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style. The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects. End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet. 1: https://github.com/egzo-ai/egzo 2: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

flohofwoe

From the top of AGENTS.md: > We design systems and use agents to implement them — this is not vibe coding. Lol, what is even the point of such a statement, and who are they to define what vibe codig is or isn't :D

jrm4

Is it fair to immediately get the ick from the name and the description (OpenShell is the safe, private runtime for autonomous AI agents) without knowing anything about what it does? "Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.

crypt1d

I tried to vibecode something similar last weekend. Got tripped up by Claude's safety classifier. It wouldn't let me build any features that track/audit process executions , not through custom kernel hooks nor even using off the shelf software for it.

dingaling911

Why not just use containers...