NVIDIA donates OpenShell agent sandbox runtime to the CNCF
NVIDIA is handing OpenShell, its open-source runtime for sandboxing and governing autonomous AI agents, to the Cloud Native Computing Foundation (CNCF), where it becomes a Sandbox project. The company announced it on November 10, 2026 at KubeCon + CloudNativeCon, along with work on Google’s Agent Substrate and three new open-source tools for running GPU workloads on Kubernetes. For developers giving agents shell access, files and credentials, it moves one of the main agent sandboxes under neutral, community governance.
What’s new
OpenShell goes to the CNCF. OpenShell lets teams declare in a policy what each agent may touch, and enforces it as the agent uses tools, calls inference services and runs workloads. As a CNCF Sandbox project it will be governed by the organizations building it into their products, according to NVIDIA. The company says hundreds of organizations use it and that it has received tens of thousands of contributions in less than a year since launch. The OpenShell README says development is moving to the ai-openshell GitHub organization; until the move is done, code, issues and pull requests stay in the NVIDIA/OpenShell repository.
Agent Substrate. NVIDIA is also contributing to Agent Substrate, a Google-led framework for running long-running agent workloads on Kubernetes that is already in the CNCF Sandbox. It keeps an agent’s environment between tasks but releases its compute when the agent is idle, suspending and resuming environments across a shared pool. NVIDIA is making it work with NVIDIA Dynamo for inference and KAI Scheduler for sharing cluster resources, and says NVIDIA and Google are building an integration of OpenShell and Agent Substrate.
New pieces of the DSX AI Factory Platform, all open source:
| Project | What it does | Status |
|---|---|---|
| NVIDIA Kubernetes Engine (NVKE) | Building blocks for offering managed Kubernetes on GPU infrastructure, with automated cluster lifecycle management | Public preview |
| NVIDIA Kubernetes Recipes (NVKR) | Signed, version-pinned images and recipes that go with NVKE | Public preview |
| NVIDIA Snapshot | Restores checkpointed inference replicas without reloading or warming up the model | Tested by design partners |
NVIDIA quotes two Snapshot results from partners on HGX B300 systems: Crusoe cut the time for a GLM-5.3 workload to become ready from about eight minutes to 31 seconds, and Saturn Cloud cut vLLM startup times from between two and 8.5 minutes to between six and 34 seconds. These are the partners’ figures, as reported by NVIDIA.
How OpenShell works
According to its README, each agent runs in an isolated sandbox. Kernel controls limit which files it can read and which system calls it can make, every network connection passes a policy check before it leaves the sandbox, and the agent never sees real credentials: OpenShell adds them only to requests going to approved endpoints. Before a policy change is applied, OpenShell uses formal verification to flag new access it would grant, such as calling a new host with credentials, so the change waits for a human to review it.
The project is Apache 2.0, and version 0.1.x brought a stable release cadence, new isolation primitives and new APIs, with an upgrade guide for older setups.
What it means for developers
If you let coding or ops agents run commands, install packages or use API keys, OpenShell is a way to fence that off with a policy instead of trusting the agent. It runs on Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), with Docker, Podman or host virtualization. The README’s quickstart installs the CLI and a local gateway, then creates a sandbox:
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demoThe default sandbox is a minimal Ubuntu image with no agent installed; the Run Your First Agent guide runs OpenCode in it and shows how to approve new access as the agent asks for it. Read any install script before piping it to sh.
CNCF governance matters if you are choosing an agent sandbox for the long term: the project’s direction is no longer up to one vendor. “NVIDIA’s contribution of OpenShell to CNCF gives developers a shared foundation to build on,” said Jim Zemlin, CEO of the Linux Foundation, in NVIDIA’s announcement.
Teams that run their own GPU clusters can try NVKE and NVKR from the dsx-ai-factory GitHub organization and Snapshot from ai-dynamo/snapshot. Agents with credentials are a growing security surface; our post on the Git 2.56.1 security fixes is a reminder of how much an agent’s git clone can expose.