NVIDIA donated OpenShell to the CNCF on November 10 at KubeCon + CloudNativeCon North America. OpenShell is a kernel-level runtime that sandboxes autonomous AI agents on Kubernetes — governing what files they can touch, what system calls they can make, and where their traffic can go. The agent never sees real credentials. Policy changes require human approval by default. It now lives under vendor-neutral governance, Apache 2.0, with hundreds of organizations already running it in production.
The Problem With Trusting Your Agent
Most teams running AI agents in production hand them real API keys and real infrastructure access, then hope the agent behaves. The standard line of defense is container isolation — but containers don’t stop a compromised agent from exfiltrating secrets it was given. The agent process still has access to whatever credentials were mounted into it.
OpenShell’s answer is to enforce policy below the container layer, at the kernel level, before the agent process even starts.
Three Layers, All Kernel-Backed
OpenShell applies three independent enforcement mechanisms to each agent sandbox:
- Landlock LSM — confines the agent to a declared set of filesystem paths via kernel-level syscall interception. Requires Linux 5.13+.
- seccomp — blocks dangerous system calls outright: ptrace, mount, raw socket creation.
- Network namespace isolation — forces all traffic through a proxy at the IP layer, so the agent cannot reach anything you have not explicitly permitted.
The Supervisor applies all three to the agent process after fork and before exec — the agent inherits a fully constrained execution context from the moment it starts, not from some policy applied after the fact.
Credential Proxy: The Agent Never Sees the Keys
This is the most important feature for teams moving agents into production. When the sandbox starts, OpenShell replaces each credential with an opaque placeholder. A proxy outside the agent swaps in the real value only for requests going to endpoints that credential is bound to. If the agent is compromised or misbehaves, there is nothing to exfiltrate — it never held the actual key.
That’s a meaningful shift from the standard pattern of mounting secrets into a container and hoping the agent doesn’t leak them.
Human Approval by Default
Every policy change proposal waits for human review by default. The agent cannot approve its own requests. Four types of prover findings force mandatory review regardless of settings. OpenShell also automatically flags destinations for human review: private IP addresses, wildcard hosts, ports above 49152, and database ports.
This is not a panic button you add after something goes wrong. It’s the default operating mode — agents propose, humans approve. NVIDIA also publishes Claude Code skills that let your coding agent drive the OpenShell CLI itself, so the propose-approve loop applies to operating OpenShell, not just the workloads inside it.
What Changes With CNCF Governance
OpenShell moves from NVIDIA’s GitHub to a vendor-neutral organization (ai-openshell). It now follows the CNCF code of conduct, runs a public RFC process, and ships with explicit vendor-neutrality commitments. It works across any conformant Kubernetes cluster — not just NVIDIA infrastructure. Enterprise teams blocked on adopting a vendor-controlled project can now evaluate it on neutral terms.
Cedar, also a CNCF project, is in progress as an alternative policy language. For now, stick to declarative YAML — Cedar support is not yet in a stable release.
How It Fits With gVisor and Agent Substrate
These three projects are complementary. OpenShell governs agent behavior over time — credentials, egress policy, human-in-the-loop approvals. gVisor (donated to CNCF by Google the same week) provides user-space kernel isolation for the underlying process. Agent Substrate (also Google, also CNCF this week) manages the agent lifecycle at scale: 1,000+ dormant agents per host, resume in under 500 milliseconds. OpenShell can use gVisor as its underlying runtime by setting runtimeClassName: gvisor in the SandboxTemplate.
KubeCon NA this week turned CNCF into the de facto neutral home for AI agent infrastructure. OpenShell, Agent Substrate, gVisor, and Broadcom’s VM API all landed in the CNCF Sandbox within 48 hours. The Kubernetes control plane for production AI agents is taking shape — it just needs to be assembled.
What to Check Now
- Confirm your Linux nodes are on kernel 5.13+ for Landlock support
- Review the OpenShell Helm chart on GitHub for Kubernetes deployment
- If you are already using gVisor, configure it as OpenShell’s underlying runtime via
runtimeClassName: gvisor - Watch the ai-openshell organization for governance updates and Cedar policy support
- Check the NVIDIA developer blog for integration guides
