NVIDIA/OpenShell
OpenShell
OpenShell ist ein Sicherheitsframework und eine sandboxed Ausführungs-Runtime für autonome KI-Agenten. Es bietet isolierte Umgebungen unter Verwendung von Containern und virtuellen Maschinen, um die Host-Infrastruktur und sensible Daten während der Agentenausführung vor unbefugtem Zugriff zu schützen.
Das System zeichnet sich durch die Kombination von hardwarebeschleunigtem Passthrough für Host-GPU-Zugriff mit einem Sicherheits-Gateway aus, das Modell-API-Aufrufe abfängt. Dieses Gateway verwaltet Anmeldeinformationen, indem es Aufruferinformationen entfernt und Backend-Geheimnisse injiziert, wodurch sichergestellt wird, dass sensible API-Schlüssel außerhalb des lokalen Dateisystems verbleiben.
Die Plattform deckt breite Funktionsbereiche ab, einschließlich deklarativer Richtliniendurchsetzung für Dateisystem- und Netzwerkbeschränkungen, Agenten-Credential-Management und Echtzeit-Aktivitätsüberwachung. Sie unterstützt die Bereitstellung von Umgebungen durch benutzerdefinierte Container-Images, lokale Verzeichnisse oder Community-Kataloge.
Features
- Agent Execution Environments - Provides isolated runtimes using containers and virtual machines specifically configured to execute autonomous AI agents securely.
- Container-Based Sandboxes - Implements isolated execution environments using containers to protect the host system from autonomous agent activity.
- Agent Gateways - Provides a secure API gateway to manage credentials and prevent data exfiltration for AI agent workflows.
- AI Execution Sandboxes - Provides secure execution environments specifically designed for running autonomous AI coding agents.
- Autonomous AI Agent Frameworks - Provides a functional framework for running autonomous AI agents within secure, isolated sandboxes.
- Inference API Proxies - Provides a proxy to intercept model API calls for secure credential management and request routing.
- Runtime Credential Injection - Injects sensitive secrets into containerized environments as runtime variables to keep keys off the local filesystem.
- Security Policy Enforcers - Uses declarative YAML rules to enforce mandatory access control policies on filesystem and system calls.
- Declarative Policy Managers - Enforces filesystem and network restrictions on autonomous agents via predefined declarative security rules.
- Sandboxed Execution Environments - Provisions isolated runtime environments that restrict AI agent access to host system resources.
- Agent Action Guardrails - Implements security mechanisms and declarative rules that restrict autonomous agent operations via sandboxing and access controls.
- Declarative Policy Enforcers - Enforces filesystem and network restrictions and blocks dangerous system calls using declarative security rules.
- Request Interception Middleware - Implements architectural middleware to intercept model API requests for credential stripping and secret injection.
- AI Security Orchestrators - Manages isolated connections and enforces security boundaries between AI agents and external services.
- AI Request Routing - Secures and manages the flow of requests to AI services through a controlled routing layer.
- Hardware Acceleration - Exposes host GPU resources to containerized sandboxes to enable hardware-accelerated AI workloads.
- GPU Accelerated Sandboxes - Provides isolated execution environments equipped with GPU hardware for AI model inference.
- Sandbox - Provides a real-time dashboard for streaming logs and terminal data to monitor sandbox environment status and gateway health.
- Real-Time Monitoring Dashboards - Provides a centralized dashboard for real-time observation of logs and terminal data from sandboxed environments.
- Security and Sandboxing - Private runtime for autonomous agents.
