# OpenShell

> Apache-2.0 agents/sandbox policy runtime — deny-by-default kernel governance

**Category:** AI Agents  
**Pricing:** open-source  
**URL:** https://docs.nvidia.com/openshell  
**GitHub:** https://github.com/NVIDIA/OpenShell  
**Added:** 2026-09-30

---

## The Hook

OpenShell is NVIDIA’s open sandbox runtime for autonomous agents — declarative YAML policy from filesystem and process down to network and credential injection, without handing the agent the whole host.

## What's Good

Apache-2.0 (NVIDIA/OpenShell). Agent-first sandboxes with Landlock/kernel-shaped isolation, hot-reloadable network policy, and provider-credential injection only at profile-authorized endpoints. Install via `install.sh` or PyPI `openshell`. Docs at docs.nvidia.com/openshell; compute drivers cover Docker, Podman, MicroVM, and Kubernetes. Ships agent skills for CLI, gateway debug, and policy generation.

## The Catch

Vs E2B / Daytona / CubeSandbox: those are hosted Firecracker sandboxes, freemium stateful env computers, or self-hosted RustVMM/KVM density — OpenShell’s catch is deny-by-default kernel governance + credential injection as policy, not a sandbox SaaS seat. Telemetry defaults on (disableable). ★10,805 in about 60 weeks (~180 a week), so treat the star count with caution; rank on substance, not the counter.

## Verdict

Apache-2.0 policy runtime when agents need deny-by-default sandbox governance — not E2B/Daytona cloud seats; rank the YAML, not the ★.