{"data":{"slug":"openshell","name":"OpenShell","tagline":"Apache-2.0 agents/sandbox policy runtime — deny-by-default kernel governance","category":"agents","categoryName":"AI Agents","url":"https://docs.nvidia.com/openshell","github":"https://github.com/NVIDIA/OpenShell","pricing":"open-source","hook":"OpenShell is NVIDIA’s open sandbox runtime for autonomous agents — declarative YAML policy from filesystem and process down to network and credential injection, without handing the agent the whole host.","whatsGood":"Apache-2.0 (NVIDIA/OpenShell). Agent-first sandboxes with Landlock/kernel-shaped isolation, hot-reloadable network policy, and provider-credential injection only at profile-authorized endpoints. Install via `install.sh` or PyPI `openshell`. Docs at docs.nvidia.com/openshell; compute drivers cover Docker, Podman, MicroVM, and Kubernetes. Ships agent skills for CLI, gateway debug, and policy generation.","theCatch":"Vs E2B / Daytona / CubeSandbox: those are hosted Firecracker sandboxes, freemium stateful env computers, or self-hosted RustVMM/KVM density — OpenShell’s catch is deny-by-default kernel governance + credential injection as policy, not a sandbox SaaS seat. Telemetry defaults on (disableable). ★10,805 in about 60 weeks (~180 a week), so treat the star count with caution; rank on substance, not the counter.","verdict":"Apache-2.0 policy runtime when agents need deny-by-default sandbox governance — not E2B/Daytona cloud seats; rank the YAML, not the ★.","addedAt":"2026-09-30","featured":false,"domain":"AI Agents","subSpecialty":"Orchestration","subcategory":"Orchestration","tags":["self-host","permissive","sandbox","active"],"capabilities":["sandbox","policy","agents"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":16647,"starsPerWeek":490,"access":"free","archived":false,"repo":{"createdAt":"2026-02-24","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"claude-code","name":"Claude Code","tagline":"Terminal-first coding agent with deep repository context"},{"slug":"cursor","name":"Cursor","tagline":"The AI-first code editor that understands your codebase"},{"slug":"devin","name":"Devin","tagline":"Autonomous AI engineer for defined engineering tasks"},{"slug":"stagehand","name":"Stagehand","tagline":"AI-native browser automation that mixes code and natural language"},{"slug":"browser-use","name":"Browser Use","tagline":"Open-source framework for LLM-driven browser agents"}],"links":{"self":"/api/gems/openshell","html":"/gems/openshell","markdown":"/gems/openshell.md","category":"/api/gems?category=agents","categoryPage":"/stacks/agents"}}