OpenShell – A safe, private runtime for fleets of autonomous AI agents
- ID
- 38673
- Status
- summarized
- Published
- 23 Oct 2026, 1:44 AM
- Fetched
- 23 Oct 2026, 4:59 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://github.com/NVIDIA/OpenShell
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.5
- Created
- 23 Oct 2026, 4:59 PM
- Tags
- Audience
- developersai_agent_usersai_ml_learnersvibe_coders
What happened
NVIDIA's OpenShell repo is an Apache-2.0 "safe, private runtime for fleets of autonomous AI agents" that lets you declare per-agent policy for files, packages, APIs, credentials and network access, and enforces it by instrumenting the kernel rather than trusting the agent's prompt. The project sits on a Rust core (crates/, Cargo.toml) with a Python SDK, providers, and e2ee directories, and carries 18.1k stars, 1.8k forks and 1,852 commits. It is on a 0.1.x line that ships a stable release cadence, new isolation primitives, an expanded extension surface and new APIs, with a dedicated 0.1.0 upgrade guide, and the Hacker News thread drew 387 points and 190 comments.
Why it matters
If you are letting an agent run shell commands, pip install, or hold API keys, the choice you actually have to make is where the boundary lives: prompt instructions (unenforceable), a container (coarse), or kernel-level policy per agent (what OpenShell claims). Because it is Apache-2.0 and self-hosted, teams that cannot ship customer data or credentials to a hosted sandbox can run the enforcement layer inside their own infrastructure. Treat it as pre-1.0: 0.1.x explicitly changed isolation primitives and APIs, so pin a version and read the 0.1.0 upgrade guide before wiring it into anything that touches production credentials.
Discussion angle
Where should the agent permission boundary actually sit — prompt, container, or kernel? Compare what OpenShell's policy enforcement covers versus a plain Docker container, and ask who in the room is currently handing agents real credentials without any enforced limit.