OpenShell explained: where an AI agent is allowed to act
Choosing OpenShell for agent isolation
Compare the actual control boundary with simpler and heavier alternatives
What you will learn
- Define the threat model
- Check runtime fit
- Run a comparative pilot
Before you start
- One disposable workload and a supported compute runtime
- Authority to inspect policy and provider configuration
Turn the documented controls into a small reviewable operational report
Key takeaways
- Threat model precedes product choice.
- Kubernetes needs more than a running gateway pod.
- The verdict depends on a local pilot, not a feature list.
Define the threat model
OpenShell is relevant when an agent needs useful file and network capabilities but those capabilities must be constrained by policy. A plain container with no network may be enough for an offline batch task.
If the agent must reach external services with credentials, evaluate whether a trusted mediator, reviewed policy updates and a gateway justify their operational complexity. Name the assets and forbidden paths before choosing.
Check runtime fit
The pinned support matrix covers Linux and Apple Silicon paths, while Windows WSL 2 remains experimental. Kubernetes requires a working CNI NetworkPolicy for the outer fence.
Compare your deployment platform, package management, policy review staff and incident process with those requirements. A security design you cannot test or maintain may be a poor fit even if the project supports your OS in principle.
Run a comparative pilot
Use the same disposable agent task under OpenShell and your existing isolation method. Record denied file access, credential exposure, outbound connectivity, startup time and cleanup.
Choose only after those observations. This article did not run a side-by-side test and does not rank OpenShell against other products.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Write assets, allowed actions and forbidden actions.
- 2
Reject unsupported or untestable runtime combinations.
- 3
Compare the same task with measured security and operating results.
Copy-ready example
task: one disposable agent job
assets: files + provider credentials
controls: filesystem, network, policy review
measure: denied access, startup, cleanup
decision: compare with current isolationFrequently asked questions
Would an offline container be simpler?
Often. If the task needs no external access or credentials, a smaller boundary may suffice.
Is Windows a supported production path?
The pinned support matrix labels WSL 2 experimental.
Sources
- OpenShell / README.mdSource checked 2026-10-04
- OpenShell / docs/about/support-matrix.mdxSource checked 2026-10-04
- OpenShell / docs/about/architecture.mdxSource checked 2026-10-04