At KubeCon North America on November 10, NVIDIA contributed OpenShell, its open-source security runtime for AI agents, to CNCF as a Sandbox project. OpenShell enforces access to files, networks, credentials, and model endpoints in the infrastructure outside the agent. The project is moving from NVIDIA's GitHub to the neutral ai-openshell organization and is adopting Cedar, another CNCF project, as its policy language. NVIDIA is also contributing to Google-led Agent Substrate and released three open-source Kubernetes components: NVKE, NVKR, and Snapshot. Teams running agents on Kubernetes now get a vendor-neutral permission and isolation layer.
Key Takeaways
- ✓Governance: OpenShell joins the CNCF Sandbox after a TOC vote passed on September 26; code moves to the neutral ai-openshell org, and the NVIDIA/OpenShell repo stays in use until the move is done
- ✓Scale: about 21K GitHub stars and 2,091 forks, written in Rust under Apache-2.0; NVIDIA says hundreds of organizations use it and it has received tens of thousands of contributions in under a year (vendor figures)
- ✓Policy: it is adopting the CNCF project Cedar as its policy language; NVIDIA, Red Hat, Docker, and Canonical were early core contributors
- ✓Ecosystem: NVIDIA is contributing to Google-led Agent Substrate, wiring in Dynamo and KAI Scheduler, and working with Google on an OpenShell plus Agent Substrate integration
- ✓Companion tools: on HGX B300, Snapshot cut Crusoe's GLM-5.3 ready time from about 8 minutes to 31 seconds and Saturn Cloud's vLLM startup from 2-8.5 minutes to 6-34 seconds (partner figures)
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and Industry Pain Points
Agents increasingly read and write files, call APIs, and run code with real credentials, and prompt rules alone cannot contain that. What enterprises worry about is which data an agent can touch, which networks it can reach, and whether secrets leak. NVIDIA open-sourced OpenShell as an agent runtime in February and published a reference architecture at GTC Berlin in October. Donating it to CNCF hands this security layer to vendor-neutral community governance.
Architecture Highlights and Mechanisms
OpenShell enforces control outside the agent. It gives each agent an isolated sandbox on local containers, Kubernetes, or virtual machines and applies one set of controls to filesystem access, network egress, process execution, credentials, and inference routing. It is adopting the CNCF project Cedar as its policy language, which makes policies easier to compare and audit. Compute, credential stores, inference providers, and approval workflows all have extension points, so teams can plug in existing systems and adopt it step by step.
Benchmarks and Measured Results
OpenShell is a security runtime and no official performance benchmark has been published. Community signals: about 21K GitHub stars and 2,091 forks. Snapshot, released at the same event, has partner results: on HGX B300, Crusoe cut GLM-5.3 ready time from about 8 minutes to 31 seconds, and Saturn Cloud cut vLLM startup from 2-8.5 minutes to 6-34 seconds (partner figures).
Developer Adoption and Getting Started
Until the move finishes, code, issues, and PRs stay in the NVIDIA/OpenShell repo, then shift to the ai-openshell org; discussion happens in #openshell-dev on CNCF Slack. Teams already running Agent Substrate on GKE should watch the NVIDIA and Google integration, with Substrate handling suspend and resume and OpenShell handling permissions. A good first step is trying network egress allowlists and a credential proxy policy.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.