OpenShell Kubernetes guide: what the CNCF post covers
From CNCF blog: OpenShell on Kubernetes: A guide for platform engineers · Open at CNCF blog: OpenShell on Kubernetes: A guide for platform engineers
On 11 November 2026, Jim Bugwadia of Nirmata published a guide on running OpenShell on Kubernetes. It appears as a member post on the CNCF blog. OpenShell is a runtime that runs AI agents in sandboxes. The post says NVIDIA started the project and that it is now a CNCF Sandbox project. The guide walks through how a sandbox is created on Kubernetes and ships a demo you can run. You can read it at OpenShell on Kubernetes: A guide for platform engineers on the CNCF blog.
What the original source confirms
| Item | What the source says | Where |
|---|---|---|
| What OpenShell does | Runs each AI agent in a sandbox. A trusted supervisor outside the sandbox decides what the agent can reach. | CNCF guide |
| Project status | Started by NVIDIA. Now a CNCF Sandbox project. | CNCF guide |
| Control areas | Rules are written in YAML for filesystem, process, network and credentials. | CNCF guide |
| Network default | All outbound traffic is denied by default. Rules can allow traffic by binary, host, port and HTTP method. | CNCF guide |
| Credentials | The agent sees only a placeholder for each API key. The supervisor puts in the real key for allowed endpoints. | CNCF guide |
| Kubernetes backend | OpenShell has no scheduler of its own. It uses the Agent Sandbox project from SIG Apps. | CNCF guide |
| Tested stack | Kubernetes 1.35 on a two-node kind cluster, Cilium 1.20, Agent Sandbox v1.0.5, OpenShell 0.1.3 and Kyverno 1.18.2. | CNCF guide |
| Kyverno demo | Seven policies in Enforce mode: six ValidatingPolicy and one MutatingPolicy, written in CEL. | CNCF guide |
What changed for people who use it
The guide gives platform teams a step by step view of how OpenShell creates a sandbox on Kubernetes. Here is what it says matters for operators.
- Sandboxes are created through the OpenShell gateway. Clients do not call the Kubernetes API directly.
- The gateway sets up network policies before the workload starts. The workload policy blocks all outbound traffic.
- The driver checks each workload Pod. It looks for a non-root user, no added capabilities, RuntimeDefault seccomp, no host namespaces and no ServiceAccount token. If a check fails, creation stops.
- The
openshell policy updatecommand applies a new policy to a running sandbox without a restart. - Stopping a sandbox removes the Pod but keeps the
/sandboxvolume. Deleting it leaves the two namespace NetworkPolicies in place. - The guide says Kubernetes NetworkPolicy can allow a host and port, but cannot tell HTTP methods or binaries apart. It says OpenShell can.
The demo code is in the nirmata/demo-openshell repository on GitHub. The project code is in the NVIDIA/OpenShell repository on GitHub. The project README says it is licensed under the Apache License 2.0. NVIDIA's OpenShell Kubernetes setup docs say the cluster needs Kubernetes 1.29 or later, Helm 3.x and a CNI that enforces NetworkPolicy for ingress and egress.
What the source leaves out
| Item | What the source says | Where |
|---|---|---|
| Creating sandboxes as Kubernetes objects | Only possible through the gateway for now. A CRD and operator are tracked in OpenShell issue 1719. | CNCF guide |
| Scale | One supervisor Pod per agent gives strong isolation but may not scale well. RFC 0018 covers options. | CNCF guide |
| Controls not in the demo | Image signature checks, RuntimeClass rules for gVisor or Kata, workspace budgets and idle sandbox cleanup are not in the demo. | CNCF guide |
| Gateway permissions | The gateway's ServiceAccount can still create Pods and NetworkPolicies in the sandbox namespace. The guide says production should extend policies to those objects. | CNCF guide |
| Licence | Not stated in the guide. | CNCF guide |
| Performance numbers for OpenShell | Not stated. | CNCF guide |
The guide also describes Agent Substrate, a separate CNCF project from Google, and says both projects target sandboxed agent work. The author is from Nirmata, which makes the Runtime for Kyverno tool the guide mentions.
Running open models in your own data centre is what Command is for. Get Command early access