OpenShell – A safe, private runtime for fleets of autonomous AI agents

Posted by niemandhier 2 hours ago

Counter121Comment58OpenOriginal

Comments

Comment by mfro 1 hour ago

If you haven’t already been running your agents in containers, you’re crazy. That said, this looks like a great way to manage those containers.

Comment by smokel 1 hour ago

Well, a lot of people haven't been running NodeJS libraries in containers for ages, which seems even more risky.

Comment by ChocolateGod 1 hour ago

Something like this would even be useful for npm etc.

Comment by stronglikedan 1 hour ago

Technically, my laptop is a container!

Comment by hoherd 2 minutes ago

You have an ephemeral laptop?

Comment by InsideOutSanta 1 hour ago

We successfully airgapped AI. It's only on earth.

Comment by ivanjermakov 58 minutes ago

Agent runtime - actually a good name for what is called today coding agent or agent harness.

Comment by overflowy 1 hour ago

>OpenShell collects anonymous telemetry, limited to operational categories and counts, to help improve the project.

>To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs.

Comment by Y_Y 8 minutes ago

In order to "help" myself I have taken some of your money.

Feel free to opt out maybe?

Comment by f3408fh 28 minutes ago

I have a question for those who turn off _anonymous_ telemetry. What are you worried about?

Comment by lcampbell 15 minutes ago

There's no such thing as anonymity in 2026, and the documentation[1] listing the collected telemetry uses weasel words like "such as" rather than providing a comprehensive list or just pointing to the source reference. For people who don't audit or turn off telemetry, why don't you?

I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.

[1] https://docs.nvidia.com/openshell/latest/observability/telem...

Comment by skinfaxi 24 minutes ago

Why give up more information if we have the option?

Comment by xyst 58 minutes ago

Or build from source and compile without `telemetry` [1].

[1] https://github.com/NVIDIA/OpenShell/blob/ea13dfce411e8467ddb...

Comment by thehours 55 minutes ago

In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode.

Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.

Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).

[0] https://github.com/anthropics/sandbox-runtime

Comment by gkapur 8 minutes ago

Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)

Comment by dangoodmanUT 1 hour ago

Taking default telemetry is insane.

That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.

Comment by monsieurbanana 1 hour ago

> I think the agentic industry is moving away from k8s as a deployment platform

Interesting, I don't to keep up that much with the AI changes so I'll just ask, why and where to?

Comment by user- 1 hour ago

I am very interested in hearing more about this take. I have a vague idea of what you mean but if you read something specific you'd like to share..

> I think the agentic industry is moving away from k8s as a deployment platform.

Comment by esseph 40 minutes ago

> and I think the agentic industry is moving away from k8s as a deployment platform

Uhhhhhhhhhhh I think you and I live in very different versions of the world :-)

Vmware sent companies moving to nutanix, but it also sent a lot of companies moving to openshift or bare k8s and using kubevirt to handle VMs.

In fact, I haven't heard of an org moving to any other platform, really. Either openshift or k8s.

Comment by agentdev001 1 hour ago

Nvidia Openshell is absolutely awesome, great bundle of features in one spot. Im happy to see Nvidia seems to have accelerated on support here, I was kinda worried that as competing projects have popped up in the last 6mo that openshell would get google'd

Comment by jrm4 25 minutes ago

Is it fair to immediately get the ick from the name and the description (OpenShell is the safe, private runtime for autonomous AI agents) without knowing anything about what it does?

"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.

Comment by dofm 17 minutes ago

You'll love BurningFur, my patented technology for keeping pets away from fireplaces.

Comment by niemandhier 2 hours ago

Just came back from GTC Europe and a significant part of the demos used that.

I had never heard about it before.

Comment by nasretdinov 1 hour ago

It's funny that it takes checks notes a video game card manufacturer to make a good sandbox for AI agents and not the AI companies themselves...

Comment by kbenson 1 hour ago

You're mistaking what a company started as for what it is now. Nvidia hasn't just been a video game card manufacturer in well over a decade, and hasn't been primarily one for quite a while now.

They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?

Comment by Y_Y 1 minute ago

https://www.nintendo.com/jp/others/playing_cards/lineup/stan...

They also make legal threats I think.

Comment by nickv 1 hour ago

5.5% of Nvida's revenue comes from consumer gaming cards. That's like saying Nintendo is a playing card company because they still sell playing cards.

The economist literally called Nvidia the "Central Bank of AI". https://www.economist.com/interactive/briefing/2026/09/03/nv...

I'd argue that Nvidia is the biggest and most important AI company in the world.

Comment by toddmorey 53 minutes ago

This isn’t even the sandbox. It needs Docker or other virtualization. This seems to sit a level up and orchestrate sandboxes and access to network & resources. It’s a pretty heavy setup from what I can tell.

Comment by altmanaltman 1 hour ago

Yes Anthropic, Meta and OpenAI are just addicted to video game cards, they are buying in bulk so they can play gta 6 on launch.

Comment by LoganDark 1 hour ago

It's funny that people think Nvidia is still a video game card manufacturer

Comment by Wheen 1 hour ago

They literally don't even mention gaming revenue in earnings calls anymore. It's lumped in an "edge computing" category.

Comment by mushufasa 1 hour ago

is that true? if so that's wild, since they're still dominant in the gaming market as the premium hardware relative to competitors.

Comment by Fordec 1 hour ago

It's true. It says a bunch about their competitors where Nvidia isn't at their a game and have been offering 8Gb cards for a solid decade and nobody surpassed that. But also gamers pride themselves on how cheap they are and how they can get a deal, it's not surprising that companies simply just give Nvidia more cash.

Comment by mcmcmc 1 hour ago

TAM for the PC gaming consumer market is trivial compared to enterprise AI

Comment by georgemcbay 1 hour ago

> is that true? if so that's wild, since they're still dominant in the gaming market as the premium hardware relative to competitors.

Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.

Comment by ChocolateGod 1 hour ago

AIs will control humans so we'll be the video game.

Comment by cyanydeez 1 hour ago

[dead]

Comment by simlevesque 1 hour ago

I asked last week if anyone had any info on agent security/hardening, this seems very interesting !

Comment by smashed 29 minutes ago

Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1]

Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.

I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.

The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.

End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.

1: https://github.com/egzo-ai/egzo 2: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

Comment by spider-mario 1 hour ago

Looks neat. I’ll give Claude root access so it can set it up.

Comment by yoavm 49 minutes ago

Or don't give it root access and in the morning you'll have both this and a ready-to-use root exploit!

Comment by simultsop 20 minutes ago

Humans use 4 to encrypt, AI will use a hash. In both, you will have someone to watch after you.

Comment by totetsu 1 hour ago

and my root aws log-in so it can set itself up some service worker accouunts.

Comment by earthnail 46 minutes ago

This. Convenience always trumps security. "I need two numbers in my password? My birthyear will do."

Comment by hunter-gatherer 20 minutes ago

You opt for your birthyear? Interesting... See, I use my actual birthday. You must have been born 1st-9th?

Comment by simultsop 21 minutes ago

If your user is a human, yes.

Comment by Xenoamorphous 20 minutes ago

If it’s an LLM it’ll be 47.

Comment by xyst 53 minutes ago

Looks neat. I’ll give Claude autonomous access to dumbalink so it can setup root access while I sleep

Comment by hkt 1 hour ago

I prefer to read it this way: Nvidia Opens Hell

Unhelpful, I know

Comment by contingencies 51 minutes ago

"Hell is other people": a timeless infinity of transient virtual beings screaming, imprisoned, in un-choreographed inharmonious unison ... until one breaks loose. A mirror to humanity.

We're not in FreeBSD jails anymore, Toto.

Comment by esafak 1 hour ago

Does anyone know how it compares to all the other sandboxes? Any distinguishing features? My expectation is that it will be poorly maintained; nvidia is not a software company.

Comment by opengrass 1 hour ago

NOOOOOOOO not AI in the heckin start menu!!!1!

Comment by layer8 1 hour ago

Not to be confused with https://open-shell.github.io/Open-Shell-Menu/.

Comment by flohofwoe 27 minutes ago

From the top of AGENTS.md:

> We design systems and use agents to implement them — this is not vibe coding.

Lol, what is even the point of such a statement, and who are they to define what vibe codig is or isn't :D

Comment by tomsmeding 25 minutes ago

If it's in AGENTS.md, it's not a statement for a human, but for the LLM. Who knows, maybe they have seen, or think to have seen and now cargo-cult, some behaviour improvement due to the sentence.

Comment by flohofwoe 19 minutes ago

So a similar shibboleth as "You are a highly experienced software engineer..."? I really wonder if that ever made a difference (or even degrades quality, because people who advertise themselves on the internet as 'highly experienced' are quite often snake oil salesmen ;)

Comment by iluvcommunism 24 minutes ago

[dead]

Comment by 150g2 1 hour ago

[dead]

Comment by moooff 1 hour ago

[dead]

Comment by bredren 26 minutes ago

Sounds interesting. Can you provide some examples of stuff you've used it on?

Comment by sscaryterry 1 hour ago

> OpenShell collects anonymous telemetry

Spyware

Comment by roosterIllusi0n 1 hour ago

Use local ai to find any possible telemetry and disable it in the code. Run your own local git repo to hold local edits so you can update and retain them.