Four policy domains separate files, networks, processes, and inference
OpenShell applies rules across 4 domains. Filesystem policy limits readable and writable paths, process policy restricts privilege and system calls, network policy controls outbound destinations, and inference policy routes model requests through approved backends. Filesystem and process settings are fixed when the sandbox starts. Network and inference settings can be replaced while it runs. This split makes sense because a live agent may need a new API endpoint, while silently widening file access underneath an existing process is harder to reason about.
A gateway coordinates sandbox creation and acts as the authentication boundary. Outbound traffic passes through a policy engine that allows it, routes model inference, or denies it and records the decision. Provider bundles place agent or model credentials into the runtime environment without writing them into the sandbox filesystem, according to the README. That is a better boundary than pasting a long-lived token into an agent's working directory, although operators still own provider permissions, rotation, gateway access, and logs.
Four compute drivers turn installation into an infrastructure job
Docker, Podman, microVM, and Kubernetes are the 4 documented compute choices. Linux and Apple Silicon macOS are supported hosts, while Windows uses experimental WSL 2 support. The recommended installer downloads a compiled CLI. The openshell package on PyPI supplies only the Python SDK, so uv add openshell will not produce the command shown in the quick start. A first sandbox also needs an image with the intended agent and tools.
The included base environment lists Python 3.14, Node 22, Git, GitHub's CLI, editors, and four agent commands. Community images and custom Dockerfiles extend it. GPU passthrough is experimental and requires NVIDIA host drivers plus the Container Toolkit; the default base image lacks workload GPU libraries. Kubernetes deployment uses an experimental Helm chart. These prerequisites are manageable for a platform team, but they make OpenShell a poor fit for developers expecting one Python package to create a secure boundary.
What happened when we ran it
Our sandbox installed commit 8a13bc1 in 34 seconds, adding 43 Python packages and using 58 MB. The build completed successfully in 5 seconds, and pip-audit found 0 known vulnerabilities. The checkout had 1,517 files, about 511,973 source lines, and measured 25.6 MB. GitHub identifies Rust as the primary language, while our supplied harness exercised the Python portion in a 3-CPU, 8 GB Debian container.
The test command exited 1 after 6 seconds. Pytest reported 13 passed, 0 failed, and 3 collection or setup errors out of 16. The three affected files were openshell_test.py, release_formula_test.py, and sandbox_test.py. The tail also contained one warning for an unknown asyncio_mode configuration option. It does not show the underlying exception for each error, so the safe conclusion is limited: collected assertions passed, while the available command did not complete successfully in our fresh environment.
Our repository scan found 40 CI workflow files, no Dockerfile, and no top-level tests directory. That layout is unusual beside the runtime-focused README, but the project distributes binaries and points base sandbox users to the separate OpenShell Community repository. The absence of a Dockerfile in this checkout does not mean Docker is unsupported. It means reviewers should trace the published binary, VM runtime, Helm chart, and sandbox image as separate artifacts when building a supply-chain policy.
v0.0.116 has a specific Apple Silicon containment report
Release v0.0.116 was published on August 28, 2026. Open issue 3095 reports that its packaged Apple Silicon VM guest returned ENOSYS when queried for the Landlock ABI. Under the issue's hard_requirement setting, sandbox creation failed instead of continuing without filesystem containment. That is the correct fail-closed outcome, but it also means the packaged VM backend did not meet the reporter's required policy on that host. Apple Silicon buyers should reproduce this exact check.
Issue 3077 describes a different boundary in a driver-controlled Windows runtime. A live policy revision could be accepted and stored by the gateway while the active runtime kept enforcing its creation-time policy. The report says deletion and recreation is the current workaround. Because the finding came from code review without native Windows execution, it should be verified on the target driver. A security control that reports desired state separately from enforced state needs explicit acknowledgement tests before production.
September activity is high, while the public contract remains alpha
GitHub recorded 8,472 stars, 553 open issues and pull requests, and a push on September 1, 2026. The combined count includes planned engineering work and pull requests, so it is not a defect total. Releases were frequent in August, with v0.0.115 followed by v0.0.116 one day later. That pace shows active maintenance and also raises the cost of qualifying every binary, driver, guest image, and chart as a matched set.
OpenShell enables anonymous operational telemetry by default. The README says events exclude prompts, credentials, provider names, paths, and user content. Operators can set OPENSHELL_TELEMETRY_ENABLED=false, disable it in Helm, or build Rust components without the telemetry feature. Combined with Apache-2.0 licensing, those controls make a private deployment feasible. The alpha label, 3 setup errors in our test command, and current platform reports still call for a staged rollout with denied-request tests and a verified escape path.