Today at KubeCon + CloudNativeCon North America, the Cloud Native Computing Foundation (CNCF) welcomes OpenShell as a Sandbox project. NVIDIA has contributed OpenShell, an open source runtime for securing and governing autonomous AI agents, to the foundation’s community-led home.

As organizations put AI agents to work, they need to give agents real capability without giving them unchecked access to data, secrets, or networks. This requires enforcement outside of the agents, right within the infrastructure that the agents run on. 

OpenShell does exactly that: it manages and monitors agent behavior, provides and enforces policy-based boundaries for what it can do. OpenShell is adopting Cedar, another CNCF project, as its policy language. It’s a great example of CNCF projects building on one another.

Why this belongs in the cloud native community

Agents are becoming part of cloud native infrastructure, and the layer that governs them should be shared, vendor-neutral, and open to everyone who depends on it. OpenShell already reflects that spirit. Core contributors from NVIDIA, Red Hat, Docker, and Canonical have worked on the project since its inception. Their early involvement, alongside many additional organizations adopting OpenShell shows broad industry agreement on the need for dependable controls for agentic systems.

“Open source is the foundation of enterprise trust. As agents become part of cloud native infrastructure, the controls around them need to be open, auditable, and built together with the ecosystem. Bringing OpenShell to the CNCF puts governance of the project in the hands of the community. Red Hat has always believed that innovation thrives where collaboration is open, and we’re excited to help steward OpenShell alongside NVIDIA and the broader ecosystem.”

— Chris Wright, Chief Technology Officer and Senior Vice President of Global Engineering, Red Hat

Contributing OpenShell to the CNCF as a neutral foundation is a natural next step to expand and grow the OpenShell project. It has adopted the CNCF Code of Conduct, runs a public RFC process, and follows a governance model with explicit vendor-neutrality commitments. By contributing OpenShell alongside partners and maintainers from across the industry, NVIDIA aims to make secure AI available to all, under the same open governance model that supports other CNCF projects.

Built for an ecosystem

No two organizations run agents the same way. They use different infrastructure, secret stores, inference providers, and governance practices, and those choices change over time. OpenShell is designed to fit this variety through well-defined extension points for providers, compute, governance and approval workflows, policy enforcement, isolation, and credential management. Teams can adopt it incrementally and swap in what they already run. It also gives vendors, integrators, and end users clear places to contribute.

What changes, and what doesn’t

OpenShell is moving from NVIDIA’s GitHub repository to a neutral organization, ai-openshell. Working groups and special interest groups will form around integrated components and cross-cutting topics such as observability.

The core engineering efforts from NVIDIA will continue, while we welcome contributions from other interested parties.

Ways to participate

Whether your organization already uses OpenShell or is just exploring it, contributing is the best way to shape its future. Areas where help is especially welcome include:

  • Extension implementations. Reference implementations for compute, credential management, inference, and logging, along with shared documentation and conformance tests so third-party integrations behave consistently.
  • Policy and governance patterns. Real-world approval flows, egress rules, and per-tenant policies, shared as examples or a policy library, plus feedback on the Cedar-based policy approach.
  • Isolation and platform coverage. Broader support across Linux, macOS, and Kubernetes, security reviews, adversarial testing, and vendor-neutral confidential computing work.
  • Observability. Consistent metrics, traces, and audit events aligned with OpenTelemetry.
  • Packaging and release engineering. Package maintenance, reproducible builds, SBOMs, signing, and CI, all of which support Incubation requirements.
  • Deployment at scale. Multi-tenancy, identity and access integration, and policy management workflows drawn from your own deployments.

Get involved

Contributors, end users, and people who are both are welcome. We look forward to building the future of open agent governance together.