The model in one picture
Gateway: keys · policy · providers →
Supervisor: enforce · inject key · connect ⇄
Sandbox: agent with placeholder key, no network
Deny by default · rules scoped by binary + host · the agent never sees real
credentials.
Lifecycle
| Do | Command |
|---|
| Install | curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh |
| Health | openshell status |
| Build agent image | docker build -t claude-agent:local -f Dockerfile.claude . |
| Create + run agent | openshell sandbox create --name X --from IMG --provider P -- claude |
| Bring code in | --upload .:/workspace on create · openshell sandbox upload X ./src |
| Get results out | openshell sandbox download X <path> ./local |
| Run a command inside | openshell sandbox exec --name X -- <cmd> |
| Reattach | openshell sandbox connect X |
| List / stop / delete | openshell sandbox list · stop X · delete X |
| Logs (denials!) | openshell logs X --source sandbox |
Providers (credentials + access)
| Do | Command |
|---|
| Import a profile | openshell profile import --url https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/claude-code.yaml (or -f file.yaml; add --global for platform-wide) |
| Key into session only | read -rs ANTHROPIC_API_KEY && export ANTHROPIC_API_KEY |
| Create provider | openshell provider create --name my-claude --type claude-code --from-existing, then unset the variable |
| Attach later | openshell sandbox provider attach X my-claude --wait (only new processes get it) |
| Agent | Profile | Credential env | Smoke test |
|---|
| Claude Code | claude-code | ANTHROPIC_API_KEY | -- claude -p 'reply with OK' |
| Copilot CLI | copilot | COPILOT_GITHUB_TOKEN / GH_TOKEN | -- copilot -p 'reply with OK' |
| Codex | codex | CODEX_AUTH_* | -- codex exec 'reply with OK' |
| OpenCode | openrouter (etc.) | OPENROUTER_API_KEY | --from ghcr.io/anomalyco/opencode:latest -- opencode -m … |
Policy
| Section | Controls | Changes |
|---|
filesystem_policy | read_only / read_write paths, include_workdir | static → recreate sandbox |
landlock | best_effort | hard_requirement | static |
process | run-as user/group | static |
network_policies | host · port · protocol · binaries · access / rules / deny_rules · enforce | audit | hot-reload |
openshell policy get X --full # effective policy
openshell policy set X --policy policy.yaml --wait
openshell policy update X --rule-name gh_ro --binary /usr/bin/curl \
--add-endpoint api.github.com:443:read-only:rest:enforce --wait
openshell rule get X --status pending # advisor proposals
openshell rule approve X --chunk-id <id> · openshell rule reject X --chunk-id <id> --reason "…"
Layers of "no" (with Check Point)
| Layer | Asks | Scope |
|---|
| OpenShell policy | Is this permitted? (binary · host · path) | one sandbox |
| Supervisor middleware → CP semantic monitoring (beta) | Does it still fit the task? (<100 ms) | one agent trajectory |
| Check Point AI Defense Plane | Which agents exist, and are they governed? | whole enterprise |
Request path: policy → middleware → inject credential → forward. Middleware sees only
allowed traffic, never the key, and is fail_closed by default.
network_middlewares:
regex-demo:
middleware: openshell/regex # demo only; or a registered gRPC service
endpoints: { include: ["api.anthropic.com"] }
# order: 20 · on_error: fail_closed (default) · config: {...}
Always true
- Default policy: no network, read-only system paths, read-write
/tmp and the workdir.
- A deny rule beats any allow. Loopback, link-local and
169.254.169.254 are always blocked; private IPs are blocked by default.
- Rules must name the real binary (resolve symlinks; interpreters count).
- A network allow does not authorize a credential there. Credentials go only to their profile's endpoints.
- Default image
nvcr.io/nvidia/base/ubuntu:24.04 has no agent CLIs. Bring your own image.