重要
New in OpenShell 0.1.x：一种稳定的释放cadence，新的隔离原始，扩展扩展表面，以及新的API. 解读0.1.0升级指南。
OpenShell是自主AI agents的车队的安全，私人运行时间。 Agents最有用时可以读取文件，安装包，调用API，并使用证书。 OpenShell赋予他们这种能力，而不让他们不受限制地访问你的数据，秘密或网络。 您在策略中声明 agent 可以触摸的内容，OpenShell 执行。
OpenShell以两种方式规范agents可以做什么：它将内核用于执行每个文件访问，系统调用，以及运行时间的网络连接的政策，它使用正式的验证来检查政策变化在应用之前允许什么。
- 内核一级执法每个agent运行在一个孤立的沙盒中。 内核控制限制它能访问哪些文件，以及它能呼叫哪个系统，每个网络连接在离开沙盒之前都会通过政策检查。 Agents从未见过真实的证书；OpenShell 新增它们只针对被绑定为已核准的终点的请求。
- 正式核实的政策变化。 在政策修改获得批准之前，OpenShell会使用正式的核查来标出它会给予的冒险的新访问，例如到达有资质的新主机，或者调用新的API方法，所以这些修改会等待人文审查。
见建筑如何连接门户、主管和沙盒。
您需要Linux,macOS在Apple硅上，或者Windows与WSL 2 (实验)，加上Docker,Podman，或者主机虚拟化。 详情见支持矩阵。
卷曲-LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
打开贝壳沙盒创建 -- 名称演示
安装者设置CLI和本地网关。 默认的沙盒图像是最小的Ubuntu，没有安装agent. 要运行一个真实的agent，跟随Run Your First Agent：它运行OpenCode与自由的OpenRouter模型和显示如何批准agent需要的新访问。
- 沙盒：图像、运行时间、GPU和生命周期。
- 政策：文件系统、网络和流程规则，由顾问和证明人审查变化。
- 提供商：只在核定终点，包括推断点工作的证书。
- 通道：用于沙盒、政策和进入的控制平面。
- Kubernetes：与赫尔姆部署网关。 你的CNI必须执行网络政策
- 广泛性：中间软件、拦截器和计算司机。
- 教学：分步政策，agent步道。
- 建立先发制人和发展：尝试即将发布的版本或主要的最新承诺。
为您的编码 agent 安装公开的 OpenShell 技能：
npx 技能添加 NVIDIA/ OpenShell
这些技能教会你的agent驾驶OpenShell CLI，写沙盒政策，调试网关和推论路由。 他们生活在技能中/并且工作时没有OpenShell源检查。
SDKs将应用程序连接到OpenShell网关。 他们不安装CLI。 尽可能为 SDK 和网关使用相同的 OpenShell 发布。
- 问题和讨论：GitHub讨论
- 错误报告和特性请求：GitHub 问题，使用问题模板
- 安全弱点：跟随安全局。 不打开 GitHub 期。
- 路线图：开放壳路线图和RFC板
- 在云里试试：Brev可发射
OpenShell是建造的agent-First：它以它所允许的相同的agent驱动工作流程开发。 见Controduction.md用于开发设置和贡献工作流程，以及AGENTS.md用于存储编码公约。
OpenShell收集匿名遥测，仅限于操作类别和计数，以帮助改进项目。 它不收集沙盒名称，主机名称，文件路径，提示，证书，提供者或模型名称，或用户内容。 要禁用它，请在网关上设置 OpenSHELL TELEMETRY ENABLED=false，或服务器。 遥测 Enabled=false for Helm s安装。 您也可以完全编译遥测。 详细情况见遥测，公布的使用趋势见社区遥测报告。
该软件自动检索，访问或与外部材料交互。 这些检索到的材料不与该软件一起分发，而仅由单独的条款、条件和许可证管理。 您完全负责查找、审查和遵守所有适用的条件、条件和许可证，并负责核实任何检索材料的安全性、完整性和适合您具体使用的情况。 提供这种软件是“AS IS”，没有任何保证。 提交人未就任何检索材料作出任何陈述或保证，也不对因使用或无法使用该软件或任何检索材料而造成的任何损失、损害、赔偿责任或法律后果承担责任。 冒险使用此软件和检索到的材料。
这个项目根据Apache许可证2.0获得许可。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Important
New in OpenShell 0.1.x: a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs. Read the 0.1.0 upgrade guide.
OpenShell is the safe, private runtime for fleets of autonomous AI agents. Agents are most useful when they can read files, install packages, call APIs, and use credentials. OpenShell gives them that capability without giving them unrestricted access to your data, secrets, or network. You declare what each agent can touch in a policy, and OpenShell enforces it.
OpenShell governs what agents can do in two ways: it instruments the kernel to enforce policy on every file access, system call, and network connection at runtime, and it uses formal verification to check what a policy change would allow before it is applied.
- Kernel-level enforcement. Each agent runs in an isolated sandbox. Kernel controls confine which files it can access and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox. Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints.
- Formally verified policy changes. Before a policy change is approved, OpenShell uses formal verification to flag risky new access it would grant, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review.
See Architecture for how the gateway, supervisor, and sandbox fit together.
You need Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization. See the Support Matrix for details.
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed. To run a real agent, follow Run Your First Agent: it runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it.
- Sandboxes: images, runtimes, GPUs, and lifecycle.
- Policies: filesystem, network, and process rules, with the advisor and prover for reviewing changes.
- Providers: credentials that work only at approved endpoints, including inference.
- Gateways: the control plane for sandboxes, policy, and access.
- Kubernetes: deploy the gateway with Helm. Your CNI must enforce NetworkPolicy.
- Extensibility: middleware, interceptors, and compute drivers.
- Tutorials: step-by-step policy and agent walkthroughs.
- Prerelease and development builds: try an upcoming release or the latest commit on main.
Install the public OpenShell skills for your coding agent:
npx skills add NVIDIA/OpenShell
The skills teach your agent to drive the OpenShell CLI, write sandbox policies, and debug gateways and inference routing. They live in skills/ and work without an OpenShell source checkout.
SDKs connect applications to an OpenShell gateway. They do not install the CLI. Use the same OpenShell release for the SDK and the gateway when possible.
- Questions and discussion: GitHub Discussions
- Bug reports and feature requests: GitHub Issues, using the issue templates
- Security vulnerabilities: follow SECURITY.md. Do not open a GitHub issue.
- Roadmap: OpenShell Roadmap and the RFC board
- Try it in the cloud: Brev Launchable
OpenShell is built agent-first: it is developed with the same agent-driven workflows it enables. See CONTRIBUTING.md for development setup and the contribution workflow, and AGENTS.md for repository coding conventions.
OpenShell collects anonymous telemetry, limited to operational categories and counts, to help improve the project. It does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs. You can also compile telemetry out entirely. See Telemetry for details and the community telemetry reports for published usage trends.
This software automatically retrieves, accesses or interacts with external materials. Those retrieved materials are not distributed with this software and are governed solely by separate terms, conditions and licenses. You are solely responsible for finding, reviewing and complying with all applicable terms, conditions, and licenses, and for verifying the security, integrity and suitability of any retrieved materials for your specific use case. This software is provided "AS IS", without warranty of any kind. The author makes no representations or warranties regarding any retrieved materials, and assumes no liability for any losses, damages, liabilities or legal consequences from your use or inability to use this software or any retrieved materials. Use this software and the retrieved materials at your own risk.
This project is licensed under the Apache License 2.0.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.