NVIDIA/OpenShell
OpenShell
OpenShell es un framework de seguridad y runtime de ejecución en sandbox para agentes de IA autónomos. Proporciona entornos aislados utilizando contenedores y máquinas virtuales para proteger la infraestructura anfitriona y los datos sensibles del acceso no autorizado durante la ejecución del agente.
El sistema se distingue por combinar el passthrough acelerado por hardware para el acceso a la GPU del anfitrión con una puerta de enlace de seguridad que intercepta las llamadas a la API del modelo. Esta puerta de enlace gestiona las credenciales eliminando la información del llamador e inyectando secretos de backend, asegurando que las claves de API sensibles permanezcan fuera del sistema de archivos local.
La plataforma cubre áreas de capacidad amplias, incluyendo la aplicación de políticas declarativas para restricciones de sistema de archivos y red, gestión de credenciales de agentes y monitoreo de actividad en tiempo real. Admite el aprovisionamiento de entornos a través de imágenes de contenedor personalizadas, directorios locales o catálogos comunitarios.
Features
- Agent Execution Environments - Provides isolated runtimes using containers and virtual machines specifically configured to execute autonomous AI agents securely.
- Container-Based Sandboxes - Implements isolated execution environments using containers to protect the host system from autonomous agent activity.
- Agent Gateways - Provides a secure API gateway to manage credentials and prevent data exfiltration for AI agent workflows.
- AI Execution Sandboxes - Provides secure execution environments specifically designed for running autonomous AI coding agents.
- Autonomous AI Agent Frameworks - Provides a functional framework for running autonomous AI agents within secure, isolated sandboxes.
- Inference API Proxies - Provides a proxy to intercept model API calls for secure credential management and request routing.
- Runtime Credential Injection - Injects sensitive secrets into containerized environments as runtime variables to keep keys off the local filesystem.
- Security Policy Enforcers - Uses declarative YAML rules to enforce mandatory access control policies on filesystem and system calls.
- Declarative Policy Managers - Enforces filesystem and network restrictions on autonomous agents via predefined declarative security rules.
- Sandboxed Execution Environments - Provisions isolated runtime environments that restrict AI agent access to host system resources.
- Agent Action Guardrails - Implements security mechanisms and declarative rules that restrict autonomous agent operations via sandboxing and access controls.
- Declarative Policy Enforcers - Enforces filesystem and network restrictions and blocks dangerous system calls using declarative security rules.
- Request Interception Middleware - Implements architectural middleware to intercept model API requests for credential stripping and secret injection.
- AI Security Orchestrators - Manages isolated connections and enforces security boundaries between AI agents and external services.
- AI Request Routing - Secures and manages the flow of requests to AI services through a controlled routing layer.
- Hardware Acceleration - Exposes host GPU resources to containerized sandboxes to enable hardware-accelerated AI workloads.
- GPU Accelerated Sandboxes - Provides isolated execution environments equipped with GPU hardware for AI model inference.
- Sandbox - Provides a real-time dashboard for streaming logs and terminal data to monitor sandbox environment status and gateway health.
- Real-Time Monitoring Dashboards - Provides a centralized dashboard for real-time observation of logs and terminal data from sandboxed environments.
- Security and Sandboxing - Private runtime for autonomous agents.
