NVIDIA Just Built a Sandbox That Knows When to Say No (Openshell)

Highlights

• OpenShell is an open-source Apache 2.0 sandbox written in Rust that enforces kernel-level file system and process limits.

• The sandbox uses a supervisor to inject credentials only for requests hitting an approved endpoint, ensuring the agent never sees real credentials.

• Policy changes are evaluated using a Z3 solver math engine to detect unintended access before going live within a 10-second default time limit.

• NVIDIA's telemetry reported over 550,000 sandboxes created and 4.2 million agent actions denied over a two-week period in the summer.

• OpenShell runs on Docker, Podman, Kubernetes, and tiny micro VMs, operating as a policy layer on top of standard container walls.

Timeline

1. 00:00 - 01:30

   The Core Problem with AI Agents and Traditional Containers

   Many users run coding agents without approving individual actions or restricting permissions while tasks execute. While a container stops an agent from wandering into the host machine, handing an agent a key defeats standard isolation. OpenShell resolves this by routing all sandbox traffic through a trusted supervisor that enforces specific policies.

   • Standard Docker containers treat all traffic from an agent equally without distinguishing between reading repositories and opening issues.
   • Running AI agents often requires handing over files, packages, APIs, and credentials because safety isolation is lost once keys are provided.
   • OpenShell acts as an open-source Apache 2.0 sandbox written in Rust to check file access, system calls, and network connections against defined policies.
2. 01:30 - 04:04

   Sandbox Demonstration and Policy Enforcement

   Running sandbox status confirms the execution state and shows that file system access is locked down. When attempting to query the GitHub API or create an issue, requests are blocked unless explicitly permitted by the policy tied to the specific binary. Every denial is logged with a detailed backtrace to provide a complete audit trail.

   • The sandbox runs unprivileged at the kernel level, preventing privilege escalation and blocking file writes outside permitted paths.
   • Default network rules block all external access, generating logged denials for any unapproved connection attempts such as curl commands.
   • Policies can be updated dynamically via command line without restarting, allowing read-only access to specific endpoints while blocking unauthorized POST requests.
3. 04:04 - 05:32

   Credential Injection and Architecture

   By keeping credentials out of the agent's reach entirely, prompt injections attempting to leak API keys fail because the keys do not exist within the environment. OpenShell integrates with Docker, Podman, Kubernetes, and micro VMs. Additionally, the Z3 solver checks policy files for accidental wildcards before changes go live.

   • The agent never stores or sees real credentials because the supervisor injects them on the fly only for approved requests.
   • The supervisor handles DNS resolution and opens only approved network connections, mitigating risks from prompt injection attacks.
   • Policy updates are passed through a Z3 solver math engine to verify what access changes grant before taking effect within a 10-second limit.
4. 05:32 - 07:37

   Adoption Metrics and Alternative Solutions

   OpenShell gathered over 20,000 GitHub stars and logged millions of blocked actions during NVIDIA telemetry tracking. While lighter runtimes or plain containers require less setup for quick tasks, OpenShell suits workflows requiring strict per-request rules and dynamic credential management.

   • NVIDIA announced OpenShell at GTC alongside partners including Cisco, CrowdStrike, Google Cloud, and Microsoft Security.
   • OpenShell differs from tools like Anthropic Sandbox Runtime or E2B by focusing on self-hosted, policy-first control for long-running agents.
   • Telemetry and configuration considerations include default anonymous telemetry, Linux kernel landlock requirements on Mac, and an early preview version 0.1.5.