277 points and 143 comments on the Hacker News front page on October 22, 2026, plus 17,800 GitHub stars: OpenShell, NVIDIA's runtime for running autonomous agents without giving them free rein over your data, secrets or network, has just shipped its 0.1 series with a stable release cadence. It lands the same day Google unveiled its own agent sandbox platform, and the comparison helps explain what each one is for.
What it is
OpenShell starts from a simple premise: an agent is useful when it can read files, install packages, call APIs and use credentials, and dangerous for exactly the same reasons. Instead of taking those abilities away, you declare them in a policy and OpenShell enforces it on two levels:
- In the kernel, at runtime. Each agent runs in a sandbox. In the current Linux backend, the workload uses a single non-root identity with no Linux capabilities; Landlock restricts file access and seccomp user notification intercepts every TCP open and DNS query so it waits for a policy decision.
- Before a change is applied. A policy prover based on formal verification checks the network rules the agent itself proposes and flags the risky ones (new credentialed reach, new HTTP methods, access to cloud metadata endpoints). Any finding blocks auto-approval and the change waits for a human. It also ships as a standalone
openshell-provercommand for checking policies in CI.
The architecture splits three pieces. The gateway is the control plane: identity, policies, credentials and lifecycle. The sandbox shares the boundary with the agent, so it never decides anything; it only reports what the agent is trying to do. The supervisor, on the trusted side, makes the decisions, resolves DNS, opens approved connections and attaches credentials only to requests bound for allowed destinations. The agent never sees the real key. If the link between the two drops, the agent is frozen: it fails closed.
Sandboxes run on Docker, Podman, Kubernetes or microVMs, with the supervisor channel over a Unix socket, TCP or vsock depending on the runtime. It supports Linux, macOS on Apple Silicon and, experimentally, Windows with WSL 2. Apache 2.0 licensed, with SDKs for Python, TypeScript, Go and Rust.
How to use it
Per the README, with Docker, Podman or host virtualization available:
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demoThe installer is a curl | sh that sets up the CLI and a local gateway: read it before you run it. The default image is a minimal Ubuntu with no agent installed, and the default policy denies network access, so you need to build an image with your agent and open up whatever it needs. Kubernetes gets a Helm chart, with one important requirement: your CNI must enforce NetworkPolicy. The project also publishes skills that teach your agent to drive the CLI and write policies (npx skills add NVIDIA/OpenShell).
What I like and what I don't
I like how trust is split. The component living next to the agent makes no decisions, credentials stay outside, and a dropped connection freezes the agent: exactly the properties you would ask for in a security review. The formal prover is the most original part. An agent asking for broader permissions is precisely what a prompt injection looks like, and here that change does not go through without review.
What I don't like: 0.1.0 breaks almost everything. 0.0.x installs cannot be upgraded in place, every sandbox has to be recreated, gateway.toml must move to schema version 2, and provider profiles have to be exported before upgrading. With 373 open issues and 190 open PRs, the project is very much alive but young. It also collects anonymous telemetry by default (turn it off with OPENSHELL_TELEMETRY_ENABLED=false).
OpenShell vs Agent Substrate
On October 22, 2026, Google open-sourced Agent Substrate, a Kubernetes runtime for agents, alongside its managed Agent Compute Engine service.
| OpenShell | Agent Substrate | |
|---|---|---|
| Focus | Declarative per-agent policy: files, processes, network and credentials | Density: more agents per server |
| Mechanism | Landlock and seccomp, on containers, Kubernetes or microVMs | Suspending idle agents and resuming them on demand |
| Deployment | Portable: Docker, Podman, Kubernetes via Helm | Kubernetes |
| Numbers | 17,800 stars | 10x more agents per server; 200,000 agents with under 500 ms to suspend and resume, per Google |
| License and maturity | Apache 2.0, 0.1 series just out | Open source, just released |
When to use which: OpenShell if what keeps you up at night is what the agent can touch, especially on a laptop or a small cluster with real credentials; Agent Substrate if you already run many agents on Kubernetes and the problem is the cost of keeping them alive while they wait. They are not mutually exclusive: one is access control, the other is resource scheduling.
Sources
- NVIDIA/OpenShell, GitHub.
- OpenShell – A safe, private runtime for fleets of autonomous AI agents, Hacker News, October 22, 2026.
- Architecture, OpenShell docs.
- Upgrade to NVIDIA OpenShell 0.1.0, OpenShell docs.
- Google's Agent Compute Engine gives every Gemini agent its own hardware-isolated micro virtual machine, The Decoder, October 22, 2026.