NVIDIA's OpenShell Sandbox Hits 19,500 Stars, With Telemetry On by Default

NVIDIA's OpenShell, an Apache-2.0 runtime that runs AI agents inside isolated sandboxes, gained 896 stars on GitHub in a day and was on the platform's trending list on Oct. 25. The repository README shows about 19,500 stars, 1,900 forks, 376 open issues and 201 open pull requests.

Stars are attention, not deployment. The README itself describes a 0.1.x release line, and the runtime is installed with a one-line curl command piped to sh from the main branch.

What the sandbox is meant to stop

The README describes the repository as "the safe, private runtime for autonomous AI agents". An operator writes a policy declaring what each agent may reach. Kernel controls limit the files an agent can open and the system calls it can make, and every network connection passes a policy check before it leaves the sandbox.

Credentials are the part aimed at the usual agent failure. The README says agents never see real credentials: OpenShell adds them only to requests headed for approved endpoints. Policy changes are checked with formal verification, which flags risky new access, such as a new host that would receive credentials, so a person reviews it before approval.

The README does not say which kernel mechanisms do the enforcing, and it does not say how much of a policy the formal check covers.

What it needs to run

Item	README says
Platforms	Linux, macOS on Apple Silicon, Windows through WSL 2 (experimental)
Container layer	Docker, Podman or host virtualization
Kubernetes	Needs a network plugin that enforces NetworkPolicy
SDKs	Python, TypeScript, Go and Rust; they do not install the CLI

The default sandbox image is minimal Ubuntu with no agent installed. The README's walkthrough runs the OpenCode agent against a free OpenRouter model.

The telemetry default

Telemetry is on by default. The README calls it anonymous and limited to operational categories and counts, and gives two ways off: the environment variable OPENSHELL_TELEMETRY_ENABLED=false, or server.telemetryEnabled=false in Helm. A security product that reports home unless told otherwise is a choice a team adopting it has to make deliberately.

The software is provided "AS IS", and the README tells researchers to report vulnerabilities through SECURITY.md and not public issues.

The Ubuntu route

OpenShell is not new to the Canonical ecosystem. On June 1, at Computex in Taipei, Canonical announced a collaboration with NVIDIA to package it as a verified snap, labelled a preview. Canonical named NVIDIA DGX Spark, DGX Station, RTX PRO workstations and DGX systems as target hardware, and the install is a single snap followed by openshell sandbox create.

Mark Shuttleworth, Canonical's founder, said in the announcement that "Sandboxing is the critical foundational layer of agentic workflows". Justin Boitano, NVIDIA's vice president of Enterprise AI Platforms, said agents are moving from the lab into enterprise infrastructure and that "demands a runtime built for trust and control".

OpenShell is one of several agent projects drawing stars at once. Cloudflare's audit skill drew similar attention, as covered in Cloudflare Open-Sources a 450-Line Audit Skill, and HumanLayer's open-sourcing shows how far a homepage can lag a repository.

The README's Releases section was empty when fetched, so the version number, not the star count, is the figure to watch before a production rollout.