CNCF: OpenShell on Kubernetes: A guide for platform engineers
The article describes OpenShell, a CNCF Sandbox runtime started by NVIDIA, that runs each AI agent in a sandbox supervised outside it, with declared filesystem, process, network and credential controls. On Kubernetes, the OpenShell gateway creates Agent Sandbox resources, NetworkPolicies and a supervisor Pod per agent, and Kyverno checks objects at admission. The article also compares OpenShell with Agent Substrate, another CNCF Sandbox project, and notes a proposed Substrate backend for OpenShell.
What changes for platform teams
Platform teams running agents on Kubernetes can enforce per-request egress and method rules and see sandboxes as ordinary Pods, Services, PVCs and NetworkPolicies covered by RBAC, Kyverno and audit logs. OpenShell is at v0.1.x and sandboxes can currently only be created through its Gateway API, not the Kubernetes API.
Read the original at CNCF Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules