NVIDIA OpenShell：面向自主 AI Agent 的安全、私有运行时
英文标题：🔥 NVIDIA/OpenShell
OpenShell 是 NVIDIA 推出的自主 AI Agent 运行时，旨在让 Agent 能够访问文件、安装软件包、调用 API 和使用凭据，同时避免获得对数据、密钥及网络的无限制访问权限。该项目通过内核级隔离与运行时策略检查控制文件、系统调用和网络连接，并在策略变更生效前使用形式化验证识别风险新增权限。OpenShell 0.1.x 引入稳定发布节奏、新隔离原语、扩展能力与 API，支持 Linux、Apple Silicon macOS，以及实验性的 WSL 2 环境。项目同时提供 Python、TypeScript、Go 和 Rust SDK，并支持 Kubernetes、推理凭据路由及面向编码 Agent 的 OpenShell Skills。
69.7 KB
68.8 KB
1.3 KB
3.9 KB
1.4 KB
1.2 KB
53.6 KB
中文
重要提示
**OpenShell 0.1.x 新增内容：**稳定的发布节奏、新的隔离原语、扩展后的扩展能力以及新的 API。阅读 0.1.0 升级指南。
OpenShell 是面向大规模自主 AI Agent 的安全、私有运行时。当 Agent 能够读取文件、安装软件包、调用 API 并使用凭据时，它们最具实用价值。OpenShell 赋予它们这些能力，同时不会让它们无限制访问你的数据、密钥或网络。你可以通过策略声明每个 Agent 可访问的资源，OpenShell 将负责执行这些策略。
OpenShell 以两种方式治理 Agent 的行为：一是在内核层进行插桩，在运行时对每一次文件访问、系统调用和网络连接执行策略；二是在应用策略变更之前，使用形式化验证检查该变更将允许哪些操作。
- **内核级强制执行。**每个 Agent 均在隔离沙箱中运行。内核控制机制限制其可访问的文件及可进行的系统调用；每个网络连接在离开沙箱前都必须通过策略检查。Agent 永远不会看到真实凭据；OpenShell 仅会将凭据添加到发往获批端点的请求中。
- **经形式化验证的策略变更。**在策略变更获批前，OpenShell 会利用形式化验证标记其可能授予的高风险新访问权限，例如携带凭据访问新的主机，或调用新的 API 方法，因此这些变更将等待人工审核。
有关网关、监管器和沙箱如何协同工作，请参阅架构。
你需要 Linux、搭载 Apple Silicon 的 macOS，或 Windows with WSL 2（实验性支持），以及 Docker、Podman 或主机虚拟化环境。详情请参阅支持矩阵。
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
安装程序会配置 CLI 和本地网关。默认沙箱镜像是未安装任何 Agent 的精简 Ubuntu。若要运行真实 Agent，请遵循运行你的第一个 Agent：该教程会针对免费的 OpenRouter 模型运行 OpenCode，并展示当 Agent 需要新访问权限时如何进行批准。
- 沙箱：镜像、运行时、GPU 和生命周期。
- 策略：文件系统、网络和进程规则，并提供用于审查变更的顾问工具和证明器。
- 提供程序：仅可在获批端点使用的凭据，包括推理。
- 网关：用于管理沙箱、策略和访问权限的控制平面。
- Kubernetes：通过 Helm 部署网关。你的 CNI 必须强制执行
NetworkPolicy。 - 可扩展性：中间件、拦截器和计算驱动程序。
- 教程：逐步讲解策略与 Agent 的操作流程。
- 预发布和开发构建版本：试用即将发布的版本或
main上的最新提交。
为你的编码 Agent 安装公开的 OpenShell Skills：
npx skills add NVIDIA/OpenShell
这些 Skills 可教会你的 Agent 操作 OpenShell CLI、编写沙箱策略，以及调试网关和推理路由。它们位于 skills/，无需检出 OpenShell 源代码即可使用。
SDK 可将应用程序连接至 OpenShell 网关，但不会安装 CLI。在可能的情况下，请为 SDK 和网关使用相同的 OpenShell 版本。
| 语言 | 安装 | 文档 |
|---|---|---|
| Python | uv add openshell |
README |
| TypeScript | npm install @nvidia/openshell-sdk（GitHub Packages） |
README |
| Go | go get github.com/NVIDIA/OpenShell/sdk/go@latest |
README |
| Rust | cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag <release-tag> |
安装与使用 |
社区
OpenShell 采用 Agent-first 的构建方式：它使用自己所支持的、由 Agent 驱动的工作流进行开发。有关开发环境配置和贡献工作流，请参阅 CONTRIBUTING.md；有关贡献者 Agent Skills 和工作流链，请参阅 AGENTS.md。
OpenShell 会收集匿名遥测数据，仅限于运营类别和计数，以帮助改进项目。它不会收集沙箱名称、主机名、文件路径、提示词、凭据、提供程序或模型名称，也不会收集用户内容。要禁用遥测，请在网关上设置 OPENSHELL_TELEMETRY_ENABLED=false，或在 Helm 安装中设置 server.telemetryEnabled=false。你也可以在编译时完全移除遥测功能。详情请参阅遥测文档，以及包含已发布使用趋势的社区遥测报告。
本软件会自动检索、访问或与外部材料交互。这些被检索的材料并不随本软件一同分发，且仅受独立的条款、条件和许可证约束。你须自行负责查找、审查并遵守所有适用的条款、条件和许可证，并验证任何被检索材料是否具备适用于你的特定使用场景的安全性、完整性和适用性。本软件按“现状”提供，不提供任何形式的保证。作者不对任何被检索材料作出任何陈述或保证，也不对因你使用或无法使用本软件或任何被检索材料而产生的任何损失、损害、责任或法律后果承担责任。使用本软件及被检索材料的风险由你自行承担。
本项目采用 Apache License 2.0 许可证。
English / 原文
Important
New in OpenShell 0.1.x: a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs. Read the 0.1.0 upgrade guide.
OpenShell is the safe, private runtime for fleets of autonomous AI agents. Agents are most useful when they can read files, install packages, call APIs, and use credentials. OpenShell gives them that capability without giving them unrestricted access to your data, secrets, or network. You declare what each agent can touch in a policy, and OpenShell enforces it.
OpenShell governs what agents can do in two ways: it instruments the kernel to enforce policy on every file access, system call, and network connection at runtime, and it uses formal verification to check what a policy change would allow before it is applied.
- Kernel-level enforcement. Each agent runs in an isolated sandbox. Kernel controls confine which files it can access and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox. Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints.
- Formally verified policy changes. Before a policy change is approved, OpenShell uses formal verification to flag risky new access it would grant, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review.
See Architecture for how the gateway, supervisor, and sandbox fit together.
You need Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization. See the Support Matrix for details.
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed. To run a real agent, follow Run Your First Agent: it runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it.
- Sandboxes: images, runtimes, GPUs, and lifecycle.
- Policies: filesystem, network, and process rules, with the advisor and prover for reviewing changes.
- Providers: credentials that work only at approved endpoints, including inference.
- Gateways: the control plane for sandboxes, policy, and access.
- Kubernetes: deploy the gateway with Helm. Your CNI must enforce
NetworkPolicy. - Extensibility: middleware, interceptors, and compute drivers.
- Tutorials: step-by-step policy and agent walkthroughs.
- Prerelease and development builds: try an upcoming release or the latest commit on
main.
Install the public OpenShell skills for your coding agent:
npx skills add NVIDIA/OpenShell
The skills teach your agent to drive the OpenShell CLI, write sandbox policies, and debug gateways and inference routing. They live in skills/ and work without an OpenShell source checkout.
SDKs connect applications to an OpenShell gateway. They do not install the CLI. Use the same OpenShell release for the SDK and the gateway when possible.
| Language | Install | Docs |
|---|---|---|
| Python | uv add openshell |
README |
| TypeScript | npm install @nvidia/openshell-sdk (GitHub Packages) |
README |
| Go | go get github.com/NVIDIA/OpenShell/sdk/go@latest |
README |
| Rust | cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag <release-tag> |
Installation and usage |
Community
OpenShell is built agent-first: it is developed with the same agent-driven workflows it enables. See CONTRIBUTING.md for development setup and the contribution workflow, and AGENTS.md for the contributor agent skills and workflow chains.
OpenShell collects anonymous telemetry, limited to operational categories and counts, to help improve the project. It does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs. You can also compile telemetry out entirely. See Telemetry for details and the community telemetry reports for published usage trends.
This software automatically retrieves, accesses or interacts with external materials. Those retrieved materials are not distributed with this software and are governed solely by separate terms, conditions and licenses. You are solely responsible for finding, reviewing and complying with all applicable terms, conditions, and licenses, and for verifying the security, integrity and suitability of any retrieved materials for your specific use case. This software is provided "AS IS", without warranty of any kind. The author makes no representations or warranties regarding any retrieved materials, and assumes no liability for any losses, damages, liabilities or legal consequences from your use or inability to use this software or any retrieved materials. Use this software and the retrieved materials at your own risk.
This project is licensed under the Apache License 2.0.