NVIDIA OpenShell v0.1.2: Give the agent a "locked room", the official Linux version is about 9.96 MBNVIDIA OpenShell v0.1.2：给智能体一间「上锁的房间」，官方 Linux 版约 9.96MB

The first is kernel-level enforcement. Each agent runs in a separate sandbox, the kernel controls which files it can access, which system calls it can make, and each network connection goes through a policy check before leaving the sandbox. The agent never sees the real credentials - OpenShell only annotates the credentials on requests to approved endpoints.

The second is formal verification. When the policy is to be changed, it first uses a formal method to calculate which permissions will be "new" for this change - such as being able to access a new host with credentials and calling a new API method - and marks these risk points for human review. This is the biggest difference between it and the ordinary container isolation scheme: instead of waiting for something to happen, it tells you what it will allow before the strategy takes effect.

The diagram shows the system architecture diagram (docs/images/openshell-system-architecture.svg) in the official warehouse: the user interface is connected to the gateway, and the gateway uses a prover to verify policy changes; at runtime, the trusted supervisor is separated from the network-isolated sandbox load, and the only external path of the load is the intermediated connection.

In the past year, there have been many incidents where the agent has exceeded its authority: crossing the boundary to access files, taking away the keys in environment variables, and actively sending data to the outside world after being prompted to inject them. A common practice in the industry is to "trust first, say later", or simply not give it permission to do anything. OpenShell follows a third path: give capacity, but write the boundaries of capacity into an auditable strategy.

For those who are enterprise-level agents, the Kubernetes path is worth seeing: using Helm to deploy the gateway, the strategy and access are managed by the control plane, and the sandbox can be sent in batches in the cluster. The document also gives a complete description of the network policy, the file system policy, the process policy, and the division of labor between the advisor (automatic recommendation) and prover (formal verification) components.

It also open-sources Skills for Agents: npx skills add NVIDIA/OpenShell allows your programming agent to learn to drive its own OpenShell CLI, write sandbox strategies, troubleshoot gateways, and reason about routing problems without the need for additional clone source code.

Officially requires Linux, Apple Silicon's macOS, or Windows + WSL 2 (experimental), plus one of Docker, Podman, or host virtualization. Note for typical Windows users - not native Windows at this time, WSL 2 is required.

One line (both CLI and local gateway will be ready): curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh, then openshell sandbox create --name demo Build the first sandbox.

The default sandbox image is minimalist Ubuntu, and there is no agent installed inside. If you really want to run an agent, press the official "Run Your First Agent" to use OpenCode with a free OpenRouter model, and the whole process will show you how to approve when the agent needs new permissions.

This site provides the official Linux x86_64 (musl static link) command-line client for Release v0.1.2, about 9.96 MB. The official release of deb, rpm, snap, macOS version and various gateway/driver components, but the gateway file is generally more than 27MB, exceeding the single file limit of this site, please go directly to the official release page to download the gateway.

Another note: OpenShell collects anonymous telemetry by default, limited to action categories and counts, and does not include sandbox names, host names, file paths, prompts, credentials, or model names. To turn off, set the environment variable OPENSHELL_telemetry_enabled = false on the gateway.

This article is compiled from public sources and ships with the matching resource. Product features and pricing are subject to the official page. Resources are for learning and exchange only — please respect the original license.