OpenShell

Why we included this project

Teams that turn a capable coding agent loose on a real codebase quickly learn that file access, shell capability, and credentials together amount to keys to the whole machine. OpenShell is a runtime built to close that gap. It runs agents like Claude Code, Codex, or OpenCode inside kernel-level sandboxes, with YAML policies deciding what each action may touch instead of leaving it to the model's judgment. Outbound traffic is restricted to an allowlist, file reads are confined to declared paths via Landlock, privilege escalation is blocked with seccomp, and model API calls go to a controlled backend. Because egress is deny-by-default and the network and inference policies hot-reload, the rules read like version-controlled security controls, which is exactly what compliance-minded teams need to audit. It is alpha and single-player today, so expect rough edges, but it is the most concrete option around for turning a powerful agent into a safely constrained one.