Week 40 — OpenShell

This week's tip: OpenShell

If you're using AI agents such as Claude Code or Codex, take a look at NVIDIA OpenShell. It runs agents in a sandbox, with rules controlling file and network access.

I've been testing it on macOS with Colima instead of Docker, which NVIDIA recommends, and had problems restarting a container after it stopped. Unless you want to experiment, stick with Docker.

Writing policy rules takes some getting used to, but once they're in place, everything works great. Run openshell term for a visual overview of agent activity while you work out what access the agent needs.

I tested it with DeepSeek 4.1 Flash, and OpenShell blocked an outbound call I didn't expect: the agent tried to reach https://r.jina.ai/. That's Jina Reader, a service that fetches a web page and returns it as LLM-friendly Markdown. It's handy, but it also means every URL the agent reads goes through a third party.

Getting started

Create a provider with your API key:

openshell provider create --name deepseek --type deepseek --credential DEEPSEEK_API_KEY=sk-YOUR-KEY

Then create the sandbox from your custom image (here deepseek-sandbox:dev) and policy file, and start OpenCode inside it:

openshell sandbox create --name deepseekbox --from deepseek-sandbox:dev --policy policy-file.yaml --provider deepseek -- opencode

To export the full policy from an existing sandbox (replace deepseekbox with your sandbox's name):

openshell policy get deepseekbox --full | sed '1,/^---$/d' > policy-file.yaml

This is also how to get your first policy file: create a sandbox without --policy, export its policy, edit it, and then recreate the sandbox with --policy.

Start with a test folder and limited permissions. Review blocked actions before granting more access.