OpenShell

What it is

A sandbox is a walled-off space for a program. Inside it, the program can only see the files you allow, reach the websites you allow, and run the commands you allow. If your agent gets tricked by a booby-trapped web page or package, or simply makes a bad mistake, the damage stays inside the walls instead of reaching your whole computer, your passwords or your company's data.

OpenShell is NVIDIA's open-source sandbox runtime for AI agents. You write a policy, a YAML file listing what each agent may touch, and OpenShell enforces it using features built into the operating system. The agent can't argue its way past those rules the way it can ignore an instruction in CLAUDE.md.

It covers four things:

• Files. The agent can only read and write the folders you list.
• Network. Every connection goes through a checkpoint. Only approved sites get through, and you can even limit which program may call which site.
• Commands. It blocks attempts to gain admin rights and other risky system calls.
• Keys. The agent never sees your real API keys. It gets placeholders, and OpenShell swaps in the real key only when a request goes to an approved address.

It launched in March 2026 alongside NemoClaw, NVIDIA's security wrapper for the OpenClaw agent. Version 0.1.0, the first stable release, came out in September, and stable releases now ship most weeks. It works with Claude Code, Codex, OpenCode, GitHub Copilot CLI and other agents.

What actually happens when you use it

1. Install. The script installs the openshell command and a local gateway, the background service that manages sandboxes and rules.
2. Prepare an image. The default sandbox is a bare Ubuntu box with no agent in it. You use or build a container image that has your agent and its tools inside.
3. Add your keys. You register a "provider", for example your Anthropic or OpenRouter key, so OpenShell can hand it out safely.
4. Start the sandbox. One command starts your agent inside the box with your policy. By default it can't reach the internet at all.
5. Approve access as needed. When the agent tries to reach something it isn't allowed, OpenShell blocks it and drafts a narrow rule. A built-in checker flags risky changes, and you approve or reject each one. Network rules take effect without restarting. File and command rules are fixed when the sandbox starts.

What people like

• It does more than a plain container. A Hacker News user explained that, unlike Docker on its own, it checks every file and network call against a policy and injects keys so they stay out of the AI's reach.
• Fine-grained, visible rules. One early user found it let Python reach the Anthropic API while blocking curl to the same address, and that every connection was logged with the program, destination and reason. Network rules updated without restarting.
• Teams are building on it. One commenter's company has used it for a while and is adding team policies and safe git access on top. Another called it a great bundle of features in one place.
• It's treated as real infrastructure. Stable releases go out most weeks, and the latest two minor versions get security and reliability fixes.

What people run into

• It's heavy for one person. It isn't the sandbox itself: it needs Docker or another virtualization layer and sits on top, which one commenter called a pretty heavy setup. Another said its control is almost too pedantic outside of enterprise needs, and a third couldn't see the point beyond large organisations.
• Telemetry is on by default. It sends anonymous usage counts unless you switch it off. That drew criticism on Hacker News, and one user noted the docs list what's collected with vague "such as" wording.
• Writing policies takes trial and error. The early user needed four attempts to get a working policy, partly because error messages didn't show the right format. That was on an older version.
• Setup snags. If Docker isn't set up for your user, the gateway won't start. On WSL 2 a bug once made the network checkpoint deny every connection. That's fixed, but WSL is still experimental. Behind a company proxy with Podman, outbound traffic is currently broken.
• It can't read your intent. Even locked down, an agent allowed to reach any site could still leak data through it. One commenter put it simply: any outside request can carry data out. OpenShell narrows the doors. It doesn't judge what goes through them.

Before you install

• Try the simpler option first. Claude Code has its own sandbox for shell commands. Run /sandbox in a session to limit which files and sites commands can reach. It's off by default and works on macOS, Linux and WSL 2. It doesn't cover Claude's file tools or MCP servers, but it's a few minutes' work, not an afternoon.
• Budget for API billing. NVIDIA's Claude Code tutorial uses an Anthropic API key, which bills per token. The docs don't show signing in with a Pro or Max plan. Its first-agent guide uses OpenCode with a free OpenRouter model instead.
• You'll build a container image. The default sandbox has no agent in it. The Claude Code tutorial assumes you've built an image with Claude Code, git and the GitHub CLI.
• Switch off telemetry if you prefer. Set OPENSHELL_TELEMETRY_ENABLED=false on the gateway. Claude Code's own example profile also lets Claude Code reach its telemetry and error-reporting addresses, which you can remove.
• Platform limits. Linux, or a Mac with Apple Silicon. Intel Macs aren't on the support list, and Windows only works through WSL 2, marked experimental.

The short version

OpenShell is the most complete agent sandbox around: real operating-system limits, keys the agent never sees, and a review step before it gets new access. It's built for companies running fleets of agents, and it shows. If you're a solo vibe coder, turn on Claude Code's /sandbox or run your agent in a separate virtual machine first. Reach for OpenShell when you're letting agents run unattended with real credentials and a mistake would genuinely hurt.