Nvidia hands its AI agent sandbox OpenShell to the CNCF

Nvidia is donating OpenShell, its open source runtime for securing and governing autonomous AI agents, to the Cloud Native Computing Foundation. The announcement came at KubeCon + CloudNativeCon, where the company also introduced three Kubernetes tools for AI factories.

OpenShell becomes a CNCF Sandbox project. Nvidia says that means it will be governed by the organizations building it into their products and reviewed by security professionals worldwide. The company says hundreds of organizations have used OpenShell and that the project has received tens of thousands of contributions in under a year since launch. Those figures are Nvidia’s own and were not independently verified.

What OpenShell does and who can use it

OpenShell applies deterministic controls to agent activity, so teams can enforce policy when an agent calls tools, reaches inference services or runs workloads. Nvidia describes an extensible design in which organizations plug in their own compute, inference providers, credential storage and monitoring.

The project is already public. Nvidia’s documentation describes it as a runtime that runs agents in sandboxes with kernel-level isolation, released under the Apache 2.0 license, with source on GitHub. The docs list Claude Code, Codex and OpenCode among the supported agents. They also say filesystem and process rules are fixed when a sandbox is created, while network and inference rules can be changed on a running one. The donation changes who steers the project, not whether developers can use it today.

Jim Zemlin, CEO of the Linux Foundation, said the cloud-native community faces “a new infrastructure challenge: giving agents secure environments in which to operate.”

Agent Substrate and the Google tie-in

Nvidia is also contributing to Agent Substrate, a Google-originated framework for running long-running agent workloads on Kubernetes that has been accepted into the CNCF Sandbox. Nvidia says it is making sure the framework works with its Dynamo inference software and its KAI Scheduler, which allocates shared cluster resources.

According to Nvidia, Agent Substrate keeps an agent’s environment between tasks and releases compute while the agent is idle, by suspending and resuming environments across a shared pool. Nvidia and Google are also working on an integration of OpenShell and Agent Substrate, aimed at governing agents across clouds and on-premises systems. No date or shipping form for that integration is given.

Three Kubernetes tools, one with eye-catching startup times

The new pieces of the DSX AI Factory Platform are Nvidia Kubernetes Engine (NVKE), Nvidia Kubernetes Recipes (NVKR) and Nvidia Snapshot. NVKE and NVKR are in public preview. Nvidia says they automate cluster lifecycle management and provide signed, version-pinned images, for providers that want to sell managed Kubernetes on GPU infrastructure. Mirantis, Netris, OpenNebula Systems, Rafay, Spectro Cloud and vCluster, plus Firmus and SK Telecom, have agreed integration plans, which are plans rather than shipping products.

Snapshot restores checkpointed inference replicas without reloading the model or warming up. Nvidia cites two design partners, both testing on HGX B300 systems:

• Crusoe, testing GLM-5.3 on its cloud, says time to readiness fell from roughly eight minutes to 31 seconds.
• Saturn Cloud says vLLM startup dropped from a range of two to 8.5 minutes to between six and 34 seconds.

These are partner benchmarks on a single hardware generation, and the source does not describe model sizes or test conditions.

Why neutral governance matters for agent security

The angle here is rules and safety. A security runtime is only useful if customers trust whoever controls its policy engine. Putting OpenShell under the CNCF, a Linux Foundation nonprofit, answers a concern that a single GPU vendor owns the control point for agents that may run on rival hardware and clouds.

There are limits to what the move proves. The CNCF describes Sandbox as its entry tier, for experimental projects not yet widely tested in production, below Incubating and Graduated. Its project page lists 41 graduated and 38 incubating projects. Sandbox status signals neutral hosting and a path to maturity, not a security audit. Nvidia also does not say whether any independent review of OpenShell’s isolation has taken place.

The OpenShell docs add a second caveat: third-party guides describe the project as an early 0.0.x release whose command structure and policy schema may change, while Nvidia’s own docs present a stable release cadence. Teams planning production use should check the current version and its change policy.

For readers running Kubernetes clusters, the practical change is a set of open components for jobs that used to require custom work: policy for agents, fast replica startup and managed cluster images. The source does not give pricing for NVKE, NVKR or Snapshot, or say when they leave preview. Nvidia invites attendees to join it at KubeCon to learn more.