As AI applications transition from simple language models that answer questions to "Agents" capable of executing real tasks—such as running commands, installing packages, and reading files—a new security challenge has emerged. These agents, which often operate based on data fetched from the internet, are essentially "untrusted code" with access to sensitive data, making their execution in production environments a significant risk unless they are strictly isolated.
What is the OpenShell project?
OpenShell, a CNCF sandbox project initiated by NVIDIA, is a solution designed to provide an isolated runtime environment for these agents. The project is based on the concept of a trusted "Supervisor" that operates outside the isolation environment, making decisions about what the agent can access based on pre-defined policies via YAML files. OpenShell provides four fundamental levels of control:
- Filesystem: Using Landlock technology, paths that the agent can read or write to are defined, preventing access to sensitive system files.
- Process: The agent is run as a non-root user with the seccomp protocol applied to restrict system calls.
- Network: External traffic is blocked by default, with the ability to allow it based on granular rules that include the executable name, host, port, and even the HTTP request method.
- Credentials: The agent does not see actual API keys; instead, it sees "placeholders," with the Supervisor replacing them with actual keys only when necessary and for authorized entities.
Integration with Kubernetes and Advanced Capabilities
Unlike solutions that attempt to bypass the Kubernetes architecture, OpenShell relies on the Agent Sandbox project from SIG Apps. Agents appear in the system as familiar Kubernetes objects such as Pods, Services, and Secrets. The core advantage here is OpenShell's ability to provide Layer 7 (L7) visibility; while traditional NetworkPolicy can allow a Pod to reach a specific site, OpenShell can determine whether a curl command is permitted to read data from GitHub but is prohibited from creating (POST) new issues.
Technical Comparison: OpenShell vs. Agent Substrate
Another CNCF project, Agent Substrate, stands out in the landscape, and the fundamental difference between them lies in their design philosophy:
- OpenShell: Focuses on security and granular control. It is the optimal choice for agents that need to access production systems and require strict per-request policies.
- Agent Substrate: Focuses on scalability and cost reduction. It relies on suspending idle agents instead of allocating a full Pod for each agent, making it suitable for models that require high density and low cost.
Technical projections suggest the possibility of integrating the two projects in the future, where OpenShell provides the control policies, while Substrate provides the efficiency of isolation and scaling.
Why does this development matter to platform engineers?
OpenShell represents a necessary bridge between the flexibility of AI and the rigor of cloud computing security. For Kubernetes administrators, isolating traditional containers is no longer sufficient; it has become essential to control the behavior of the "intelligent agent" inside the container. By integrating with tools like Kyverno, engineers can enforce admission control policies that ensure agents run only with specific, trusted images, while setting limits on processing and memory resources, ensuring that an AI agent does not become a source of a security threat or excessive consumption of cluster resources.