Running AI agents securely on Kubernetes with OpenShell

NVIDIA’s OpenShell has entered the CNCF Sandbox as a dedicated runtime for executing AI agents safely within Kubernetes clusters. Released in late 2026, this tool addresses the security risks of autonomous agents that execute shell commands, access files, and manage network connections while holding sensitive credentials. By integrating with the Agent Sandbox project from SIG Apps, OpenShell allows platform engineers to enforce strict per-request policies without sacrificing visibility into standard Kubernetes objects.

What happened

AI agents are increasingly capable of performing complex tasks beyond simple API calls, such as installing packages, reading local files, and opening network sockets. Because these agents often act on untrusted data fetched from the internet, they represent a significant security risk when granted real credentials. OpenShell was developed to treat every agent as untrusted code, running each one in an isolated sandbox where a trusted supervisor explicitly approves every action.

The project uses a YAML-based configuration to declare four specific types of control: filesystem access via Landlock, process privileges using seccomp and non-root users, network traffic rules per binary and host, and credential management that swaps placeholders for real keys only at allowed endpoints. Unlike traditional container security, OpenShell can distinguish between different actions by the same binary, such as allowing a GET request to GitHub while blocking a POST request, and it can update these policies on running sandboxes without restarts.

For Kubernetes administrators, OpenShell leverages existing ecosystem tools rather than replacing them. It does not include its own scheduler but instead relies on Agent Sandbox to translate agent definitions into standard Kubernetes resources like Pods, Services, and NetworkPolicies. This approach ensures that agents remain visible to existing operational tools like kubectl, audit logs, and policy engines like Kyverno, while adding a layer of granular control that native Kubernetes resources cannot provide.

How it works

The architecture centers on a gateway that manages the lifecycle of each sandbox and a supervisor pod that mediates all communication for a specific agent. When a user creates a sandbox via the OpenShell gateway API, the system generates a suspended Agent Sandbox resource. The controller then creates a workload pod with strict scheduling gates, ensuring no outbound network access exists until the supervisor is ready. The supervisor authenticates with the gateway using an identity tied to the namespace and sandbox UID, establishing a secure channel to the workload.

Once the supervisor connects, it enforces the declared policies before the agent’s command even starts. Every outbound request from the agent is intercepted by the supervisor, which checks the destination, port, calling binary, and HTTP method against the active policy. If the request is allowed, the supervisor opens the upstream connection; if denied, the request is blocked immediately. This model allows for dynamic policy updates, where changes are loaded and confirmed by the sandbox without requiring a full pod restart or suspension.

Key details

• OpenShell uses the agents.x-k8s.io Sandbox resource from SIG Apps, mapping agents to standard Kubernetes Pods and Services.
• Filesystem isolation is handled by Landlock, restricting write access to specific paths like /sandbox and /tmp while keeping system directories read-only.
• Network policies are enforced by a supervisor that inspects traffic per binary, allowing granular rules such as permitting curl reads but blocking writes.
• Credentials are never exposed to the agent directly; the supervisor swaps placeholder values for real API keys only at permitted endpoints.
• Creation currently requires calling the Gateway API directly, as there is no native Kubernetes CRD for OpenShell sandboxes yet.
• The demo environment runs on Kubernetes 1.35 with Cilium 1.20, Agent Sandbox v1.0.5, and Kyverno 1.18.2 for admission control.

Why it matters

For teams building AI-driven platforms, the primary challenge is balancing agent autonomy with security compliance. Traditional Kubernetes NetworkPolicies can restrict which pods can talk to which hosts, but they cannot inspect the content of the traffic or the intent of the application making the request. OpenShell fills this gap by providing application-aware policy enforcement, ensuring that an agent cannot accidentally or maliciously exfiltrate data or modify production systems even if it compromises the container runtime.

Furthermore, OpenShell maintains compatibility with existing Kubernetes operational workflows. Because agents appear as standard pods and services, platform engineers do not need to learn a completely new observability stack. They can continue using familiar tools for logging, monitoring, and role-based access control, while relying on OpenShell to handle the nuanced security requirements of autonomous agents. This reduces the operational overhead of adopting AI agents in enterprise environments where auditability and least-privilege access are mandatory.

What you can do

• Install Cilium as your CNI to ensure both ingress and egress NetworkPolicies are enforced effectively in your cluster.
• Deploy the Agent Sandbox controller and CRDs before installing the OpenShell gateway Helm chart to establish the required infrastructure.
• Use Kyverno or similar policy engines to enforce admission controls on sandbox images, resource limits, and RBAC rules.
• Define workspaces in OpenShell to group sandboxes, policies, and logs for easier management and auditing of agent activities.
• Test policy updates on running sandboxes to verify that dynamic rule changes apply without disrupting agent execution.
• Review the OpenShell roadmap for future support of Kubernetes-native CRDs and flexible deployment options for large-scale environments.