# OpenShell 0.1.3 brings fine-grained AI agent sandboxing to Kubernetes via CNCF

> **Key takeaway:** OpenShell layers per-binary, per-method network and filesystem controls on top of standard Kubernetes resources to safely run untrusted AI agents that hold real credentials.

**Published:** 2026-11-04T12:00:00+00:00 
**Source:** Cloud Native Computing Foundation (CNCF) 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/openshell-013-brings-fine-grained-ai-agent-sandboxing-to-kub.html 

## Summary
OpenShell, a runtime for securing AI agents that originated at NVIDIA and is now a CNCF Sandbox project, has released version 0.1.3 with a documented Kubernetes deployment path. The project addresses the growing risk that autonomous agents—which execute shell commands, install packages, and make network requests based on untrusted web content—pose when they carry live API credentials. Rather than replacing Kubernetes scheduling, OpenShell integrates with the Agent Sandbox resource from Kubernetes SIG Apps, representing agents as familiar Pods, Services, PVCs, Secrets, and NetworkPolicies while adding enforcement capabilities that native Kubernetes lacks.

The runtime applies four declared controls through YAML policy: Landlock-based filesystem restrictions, seccomp and capability-dropping process hardening, default-deny outbound network rules that can be scoped to specific binaries, hosts, ports, and HTTP methods, and credential substitution that hides real API keys from the agent itself. A supervisor Pod mediates all agent traffic and can update policy on running sandboxes without restart. The current release requires sandbox creation through the OpenShell Gateway API rather than native Kubernetes APIs, though a CRD and operator are planned.

## How OpenShell hardens agent workloads on Kubernetes
- **Filesystem isolation via Landlock:** The sandbox runtime uses Landlock to restrict agent filesystem access; in the reference deployment, /usr, /etc, and system paths are read-only while only /sandbox, /tmp, and /dev/null are writable, preventing arbitrary file modification.
- **Process sandboxing:** Before agent startup, the runtime drops privileges to a non-root user with no Linux capabilities and applies a seccomp profile, reducing the attack surface from privileged operations.
- **Per-binary network policy:** Unlike Kubernetes NetworkPolicies, which operate at the Pod level, OpenShell enforces default-deny outbound connectivity and permits traffic rules per binary, destination host, port, and HTTP method—allowing distinctions such as permitting curl to read GitHub issues but not create them.
- **Credential proxying:** Agents receive placeholder tokens only; the supervisor substitutes real API keys at request time and only for explicitly allowed endpoints, ensuring compromised agents cannot exfiltrate live credentials.
- **Gateway-mediated lifecycle:** The OpenShell gateway authenticates callers over mTLS, maintains the sandbox record as source of truth, and orchestrates creation of NetworkPolicies, Sandbox resources, supervisor Pods, and workload Pods with scheduling gates; Kyverno validates Kubernetes objects at admission.

## Why it matters
For platform engineers running AI workloads on Kubernetes, OpenShell offers a concrete alternative to trusting agents with direct API access or relying solely on coarse NetworkPolicies that cannot distinguish read from write operations. Its integration with standard SIG Apps resources and Cilium-compatible egress enforcement means teams can adopt it without replacing existing cluster infrastructure, though the per-agent supervisor Pod design may require operational attention at scale until RFC 0018's flexible deployment options arrive.