At KubeCon North America, NVIDIA contributed OpenShell to the Cloud Native Computing Foundation, and the CNCF has accepted it as a Sandbox project. OpenShell is a runtime that sits outside an AI agent and enforces policy on what it can reach: files, networks, credentials and which inference endpoints its requests go to.
What changes for users
- New home: the project moves from NVIDIA’s GitHub to a neutral organisation, ai-openshell. Expect repository and package paths to change.
- Policy language: OpenShell is adopting Cedar, another CNCF project, as its policy language, per the CNCF post.
- Governance: CNCF Code of Conduct, a public RFC process and explicit vendor-neutrality commitments. NVIDIA says its core engineering continues.
- Where help is wanted: extension implementations for compute, credentials, inference and logging; shared policy patterns; Linux, macOS and Kubernetes isolation coverage; OpenTelemetry-aligned audit events; and reproducible builds, SBOMs and signing.
NVIDIA also said it is contributing to Google’s Agent Substrate, already in the CNCF Sandbox, and making it work with NVIDIA Dynamo and the KAI Scheduler. It also announced NVIDIA Kubernetes Engine, Kubernetes Recipes and Snapshot for its DSX AI Factory platform.
Why this matters
Enforcing agent permissions in the infrastructure, not in the prompt, is the pattern that survives prompt injection, and a neutral foundation makes OpenShell safer to standardise on. Sandbox is the CNCF’s earliest stage, though, and the move to Cedar means your existing policy files may need rewriting, so pin your current version and follow the RFCs before upgrading. OpenShell has already had one serious default fixed, when its gateway stopped starting without auth; outside security review is exactly what the CNCF move invites.
The Campfire
CommentsThanks. Your comment is waiting for the desk. Once it is approved it appears here within about a minute.
Add a comment