NVIDIA/OpenShell
OpenShell
OpenShell is a security framework and sandboxed execution runtime for autonomous AI agents. It provides isolated environments using containers and virtual machines to protect host infrastructure and sensitive data from unauthorized access during agent execution.
The system distinguishes itself by combining hardware-accelerated passthrough for host GPU access with a security gateway that intercepts model API calls. This gateway manages credentials by stripping caller information and injecting backend secrets, ensuring sensitive API keys remain off the local filesystem.
The platform covers broad capability areas including declarative policy enforcement for filesystem and network restrictions, agent credential management, and real-time activity monitoring. It supports the provisioning of environments through custom container images, local directories, or community catalogs.
Features
- Agent Execution Environments - Provides isolated runtimes using containers and virtual machines specifically configured to execute autonomous AI agents securely.
- Container-Based Sandboxes - Implements isolated execution environments using containers to protect the host system from autonomous agent activity.
- Agent Gateways - Provides a secure API gateway to manage credentials and prevent data exfiltration for AI agent workflows.
- AI Execution Sandboxes - Provides secure execution environments specifically designed for running autonomous AI coding agents.
- Autonomous AI Agent Frameworks - Provides a functional framework for running autonomous AI agents within secure, isolated sandboxes.
- Inference API Proxies - Provides a proxy to intercept model API calls for secure credential management and request routing.
- Runtime Credential Injection - Injects sensitive secrets into containerized environments as runtime variables to keep keys off the local filesystem.
- Security Policy Enforcers - Uses declarative YAML rules to enforce mandatory access control policies on filesystem and system calls.
- Declarative Policy Managers - Enforces filesystem and network restrictions on autonomous agents via predefined declarative security rules.
- Sandboxed Execution Environments - Provisions isolated runtime environments that restrict AI agent access to host system resources.
- Agent Action Guardrails - Implements security mechanisms and declarative rules that restrict autonomous agent operations via sandboxing and access controls.
- Declarative Policy Enforcers - Enforces filesystem and network restrictions and blocks dangerous system calls using declarative security rules.
- Request Interception Middleware - Implements architectural middleware to intercept model API requests for credential stripping and secret injection.
- AI Security Orchestrators - Manages isolated connections and enforces security boundaries between AI agents and external services.
- AI Request Routing - Secures and manages the flow of requests to AI services through a controlled routing layer.
- Hardware Acceleration - Exposes host GPU resources to containerized sandboxes to enable hardware-accelerated AI workloads.
- GPU Accelerated Sandboxes - Provides isolated execution environments equipped with GPU hardware for AI model inference.
- Sandbox - Provides a real-time dashboard for streaming logs and terminal data to monitor sandbox environment status and gateway health.
- Real-Time Monitoring Dashboards - Provides a centralized dashboard for real-time observation of logs and terminal data from sandboxed environments.
- Security and Sandboxing - Private runtime for autonomous agents.
