Who it is forA developer who would rather ask Claude Code or Codex to set up sandboxes than learn every policy rule by hand.
The problemSandbox policies and gateway routing are new territory, and a wrong rule either blocks the agent or lets too much through.
The outcomeA coding agent that can drive the Open Shell CLI, draft sandbox policies and debug gateways and inference routing for you.
What you need first
- Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental)
- Docker, Podman, or host virtualization
- An agent to run inside the sandbox; the default image is minimal Ubuntu with no agent installed
- For Kubernetes: Helm and a CNI that enforces NetworkPolicy
Steps
- Run
npx skills add NVIDIA/OpenShellin your project - Ask your agent to use the Open Shell skills; they work without an Open Shell source checkout
- Have it draft a filesystem, network and process policy for your sandbox and review the draft yourself
- Use the advisor and prover from the Policies docs to check what a change would allow before you apply it
- For apps, add the Python SDK with
uv add openshelland use the same release for the SDK and the gateway
Prompt for your agent
Install the NVIDIA/OpenShell skills with `npx skills add NVIDIA/OpenShell`, then write a sandbox policy for <project> that allows <files and hosts> and nothing else. Explain each rule, and do not apply it until I approve.
Caveat. An agent-written policy is a draft: the point of Open Shell is that a human reviews new access, so read every rule before you approve it.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for NVIDIA/OpenShell and "Teach your coding agent to drive Open Shell"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer