OpenShell
Star of the week, issue #15What it is
NVIDIA's open agent sandbox: a policy lists the files, syscalls, and hosts an agent may touch, and everything else is denied at the kernel.
Featured in
Issue #15 — Side Doors · — the full issue has that week's other tools, reads, and big-lab releases.
More infra tools we've covered
- Drop A rootless Linux sandbox modelled on Python's virtualenv: create a disposable environment, step into it, and everything you already have installed still works — but your real home directory is hidden, localhost services are refused unless you expose them, and a short TOML file declares which files, directories, and local ports the sandbox may see. It runs in its own user, mount, network, and IPC namespaces with capabilities dropped, and can optionally put programs on gVisor's user-space kernel for a second wall. Apache-2.0, a solo project by Jan Wrobel.
- OpenViking Volcengine's (ByteDance's cloud arm) self-evolving context database for agents: memory, RAG knowledge, and skills unified as a virtual filesystem behind a `viking://` protocol, which agents browse with `ls`, `tree`, and `find` instead of querying a vector store. Content is tiered — abstract, overview, full detail — and loaded on demand to keep token use down. Rust core under AGPLv3, `pip install openviking` to run the server; integrations for Claude Code, Codex, Cursor, and OpenCode.
- OpenBot CopilotKit's agent platform for your own infrastructure: Docker Compose brings it up, data sits in your Postgres, no model ships in the box, and the admin's credential is encrypted at rest. Each bot gets a computer of its own — a real browser with its own logins, its own files, and only the tools you grant — and anything it does to a computer, file, or MCP server passes through a single gateway that decides before and records after. Any AG-UI agent can be dropped in as a coworker.
- Cloudflare Computer A virtual filesystem that lives inside a Durable Object: SQLite holds the authoritative state, and three pluggable backends — a FUSE-mounted container, a bash isolate, and a JavaScript isolate — run behind a single workspace.runtime.exec() entry point. MIT, 7.9K stars, explicitly preview-only.