{
 "schema_version": 1,
 "generated": "2026-10-25",
 "id": "nvidia-openshell--run-a-coding-agent-in-an-openshell-sandbox",
 "repo": "NVIDIA/OpenShell",
 "repo_url": "https://github.com/NVIDIA/OpenShell",
 "repo_slug": "nvidia-openshell",
 "title": "Run a coding agent in a locked-down sandbox",
 "page_title": "How to run a coding agent in a locked-down sandbox with OpenShell",
 "summary": "Install OpenShell, create a sandbox and run an agent that must ask before it reaches anything new.",
 "who": "A developer who wants an agent to work autonomously for hours but not touch the rest of the laptop.",
 "problem": "Agents are most useful with file, package, API and credential access, which is exactly what makes them risky to leave alone.",
 "outcome": "An agent working inside an isolated sandbox, with file, system call and network access limited to what a policy allows.",
 "steps": [
  "Run `curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh` to install the CLI and a local gateway",
  "Run `openshell sandbox create --name demo` to create your first sandbox",
  "Follow the Run Your First Agent guide in the docs, which runs OpenCode against a free OpenRouter model inside the sandbox",
  "When the agent needs new access, approve it from OpenShell instead of granting it up front",
  "Set `OPENSHELL_TELEMETRY_ENABLED=false` on the gateway if you want to turn off the anonymous telemetry"
 ],
 "agent_prompt": "Install NVIDIA/OpenShell on this machine, create a sandbox named <name> with `openshell sandbox create`, and run <agent> inside it on <task>. Every time it asks for new file or network access, show me the request and wait for my approval before allowing it.",
 "agents": [
  "claude-code",
  "codex",
  "cursor"
 ],
 "difficulty": "Intermediate",
 "time": "30 minutes",
 "basis": "readme",
 "caveat": "OpenShell is at 0.1.x and Windows support goes through WSL 2 and is marked experimental, so expect changes between releases.",
 "category": "Software and DevOps",
 "tags": [
  "Software and DevOps"
 ],
 "lang": "rust",
 "requirements": [
  "Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental)",
  "Docker, Podman, or host virtualization",
  "An agent to run inside the sandbox; the default image is minimal Ubuntu with no agent installed",
  "For Kubernetes: Helm and a CNI that enforces NetworkPolicy"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "remote-script",
   "notice": "The quickstart pipes install.sh from GitHub straight into your shell, so read the script first if you do not want to run it blind."
  }
 ],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/nvidia-openshell/run-a-coding-agent-in-an-openshell-sandbox/",
 "md": "https://dedupedai.com/use-cases/nvidia-openshell/run-a-coding-agent-in-an-openshell-sandbox/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/nvidia-openshell--run-a-coding-agent-in-an-openshell-sandbox.json",
 "api_version": "v1"
}