I tried to vibecode something similar last weekend. Got tripped up by Claude's safety classifier. It wouldn't let me build any features that track/audit process executions , not through custom kernel hooks nor even using off the shelf software for it.
Wow, interesting. My agents on open weight inference have been completely nerdsniped by the idea of tracking and auditing process executions. They talk of nothing else.
There's no such thing as anonymity in 2026, and the documentation[1] listing the collected telemetry uses weasel words like "such as" rather than providing a comprehensive list or just pointing to the source reference. For people who don't audit or turn off telemetry, why don't you?
I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.
That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.
In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode.
Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.
Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).
Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)
Nvidia Openshell is absolutely awesome, great bundle of features in one spot. Im happy to see Nvidia seems to have accelerated on support here, I was kinda worried that as competing projects have popped up in the last 6mo that openshell would get google'd
You're mistaking what a company started as for what it is now. Nvidia hasn't just been a video game card manufacturer in well over a decade, and hasn't been primarily one for quite a while now.
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
This isn’t even the sandbox. It needs Docker or other virtualization. This seems to sit a level up and orchestrate sandboxes and access to network & resources. It’s a pretty heavy setup from what I can tell.
It's true. It says a bunch about their competitors where Nvidia isn't at their a game and have been offering 8Gb cards for a solid decade and nobody surpassed that. But also gamers pride themselves on how cheap they are and how they can get a deal, it's not surprising that companies simply just give Nvidia more cash.
> is that true? if so that's wild, since they're still dominant in the gaming market as the premium hardware relative to competitors.
Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.
Is it fair to immediately get the ick from the name and the description (OpenShell is the safe, private runtime for autonomous AI agents) without knowing anything about what it does?
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
"Hell is other people": a timeless infinity of transient virtual beings screaming, imprisoned, in un-choreographed inharmonious unison ... until one breaks loose. A mirror to humanity.
Does anyone know how it compares to all the other sandboxes? Any distinguishing features? My expectation is that it will be poorly maintained; nvidia is not a software company.
If it's in AGENTS.md, it's not a statement for a human, but for the LLM. Who knows, maybe they have seen, or think to have seen and now cargo-cult, some behaviour improvement due to the sentence.
So a similar shibboleth as "You are a highly experienced software engineer..."? I really wonder if that ever made a difference (or even degrades quality, because people who advertise themselves on the internet as 'highly experienced' are quite often snake oil salesmen ;)
I was using it in an air gapped environment vs a local inference engine running a qwen-coder-next. Installtion of harnesses on the machine and other things were ruled out because of security constraints.
There i used it to analyze an old visual basic application which creates custom pdf files. it worked surprisingly well. it took some rounds but in the end it got all requirements and scaffolded me a skeleton for a python rewrite as a web-application. Then i worked from there with it to get a prototype.
Use local ai to find any possible telemetry and disable it in the code. Run your own local git repo to hold local edits so you can update and retain them.
Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1]
Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.
I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.
The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.
End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.
Sounds like waitpid(2) is dangerous!
>To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs.
Feel free to opt out maybe?
I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.
[1] https://docs.nvidia.com/openshell/latest/observability/telem...
[1] https://github.com/NVIDIA/OpenShell/blob/ea13dfce411e8467ddb...
That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.
Interesting, I don't to keep up that much with the AI changes so I'll just ask, why and where to?
> I think the agentic industry is moving away from k8s as a deployment platform.
Uhhhhhhhhhhh I think you and I live in very different versions of the world :-)
Vmware sent companies moving to nutanix, but it also sent a lot of companies moving to openshift or bare k8s and using kubevirt to handle VMs.
In fact, I haven't heard of an org moving to any other platform, really. Either openshift or k8s.
Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.
Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).
[0] https://github.com/anthropics/sandbox-runtime
I had never heard about it before.
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
They also make legal threats I think.
The economist literally called Nvidia the "Central Bank of AI". https://www.economist.com/interactive/briefing/2026/09/03/nv...
I'd argue that Nvidia is the biggest and most important AI company in the world.
Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
Unhelpful, I know
We're not in FreeBSD jails anymore, Toto.
> We design systems and use agents to implement them — this is not vibe coding.
Lol, what is even the point of such a statement, and who are they to define what vibe codig is or isn't :D
There i used it to analyze an old visual basic application which creates custom pdf files. it worked surprisingly well. it took some rounds but in the end it got all requirements and scaffolded me a skeleton for a python rewrite as a web-application. Then i worked from there with it to get a prototype.
Spyware
Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.
I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.
The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.
End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.
1: https://github.com/egzo-ai/egzo 2: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/