{"resourceId":"andrew-ooo-openshell-review-20261003","versions":[{"version":"external-e75c31f6cfc25ef8290e923cb654a63763961db17ee7bd13dded58edbaaff9c0","resource":{"id":"andrew-ooo-openshell-review-20261003","title":"andrew.ooo: OpenShell hands-on review finds default-deny, binary-scoped L7 rules and credential brokering real, but v0.1.x production-shaped, not production-proven","organization":"andrew.ooo","sector":"Independent developer review","geography":"Global (English-language developer publication)","publishedAt":"2026-10-03T00:00:00Z","publicationDate":"2026-10-03","eventDate":"2026-09-28","sourceName":"andrew.ooo","sourceLabel":"Independent hands-on review / OpenShell","sourceUrl":"https://andrew.ooo/posts/openshell-review-nvidia-kernel-enforced-agent-sandbox/","evidenceClass":"independent-reporting","outcomeClass":"mixed","topics":["developers-agents","data-security","infrastructure","governance-procurement","operating-model"],"finding":"Oct 3, 2026 hands-on review of NVIDIA OpenShell v0.1.2 (released Sep 28). The walkthrough shows default-deny egress (curl to api.github.com returns 403 from the proxy), OCSF-formatted deny logs naming the binary, engine and reason, and binary-scoped L7 rules that allow GET but refuse POST to the same host; real credentials stay with the supervisor and are injected only into approved requests. The runtime needs no GPU or NVIDIA hardware; Sentry needs a BlueField DPU. Stated limitations: v0.1.x with experimental interfaces that can change in a patch release; macOS sandboxes run inside Docker Desktop's VM and Windows/WSL 2 is experimental; Kubernetes deployments silently lose network enforcement if the CNI ignores NetworkPolicy; L7 inspection terminates TLS; telemetry is on by default (scoped, can be disabled); policy events log at INFO so a warn-level filter drops the audit trail; budget about a day per non-trivial agent for policy writing. Recommendation: pilot in audit mode, export events to a SIEM, and do not make it the only control before production.","sledRelevance":"Gives campus and agency security teams concrete deployment checks (CNI enforcement, TLS termination for regulated data, INFO-level audit events, default telemetry) before an OpenShell pilot, plus a realistic policy-authoring effort estimate.","evidence":"Opened the andrew.ooo review (metadata date Oct 3, 2026; header says repository facts checked Oct 4). Contains command transcripts, policy YAML and log lines from the reviewer's walkthrough, plus a limitations section and FAQ.","architectureImplications":"OpenShell can run on existing CPU fleets without NVIDIA hardware; Kubernetes rollouts must verify the CNI enforces NetworkPolicy, and L7 rules put a TLS-terminating proxy in the data path.","governanceImplications":"Telemetry defaults, TLS termination over regulated data, and log-level routing are governance decisions to document before pilots touch FERPA, CJIS or HIPAA-scoped data.","securityPrivacyImplications":"Credential brokering keeps secrets out of the sandbox, a real improvement; but TLS termination exposes request contents to the proxy and INFO-level policy events can be dropped by common SIEM filters.","caveats":"Single reviewer's walkthrough without published benchmarks or a long-run soak; the page states 537 open issues in the body but 344 in its Oct 4 repository-facts header, so issue counts are inconsistent; community-reaction quotes are second-hand.","streamIds":["nvidia"],"roles":{"sales":"Open with what is concretely true: an Oct 3 hands-on review shows OpenShell enforcing default-deny egress, GET-but-not-POST rules per binary, and credential brokering, with no NVIDIA hardware required. It also calls v0.1.x production-shaped, not production-proven. That is a credible, low-cost pilot story for campus and agency teams running agents with credentials. Ask whether they can pilot in audit mode and route OCSF events to a SIEM. Do not claim certifiable security or Sentry availability.","engineering":"Fit is strong for teams that need method-level egress control and credential brokering beyond plain Docker. Checks before trusting it: confirm the Kubernetes CNI enforces NetworkPolicy, accept that rest-protocol rules terminate TLS at the proxy, route INFO-level policy events to the SIEM, and decide whether to disable default telemetry. Prerequisites are Docker or Podman, a SIEM path, and policy owners. Proof of value: an audit-mode week, then enforce-mode deny drills with logs arriving in the SIEM.","delivery":"Delivery runs a two-phase pilot: one week in audit mode to inventory what each agent reaches, then enforce mode with narrow binary-scoped rules. Budget about a day of policy work per non-trivial agent, as the review suggests. Security operations owns log ingestion; the platform team owns gateway upgrades. Checkpoints: CNI verification, TLS-termination review for regulated endpoints, and the telemetry decision. Proposed acceptance: every deny event visible in the SIEM within minutes. Risks are silent non-enforcement and dropped audit logs."},"roleDetails":{"sales":{"customerProblem":"Agent containment today is mostly prompt instructions; buyers need an enforceable, auditable boundary they can pilot cheaply.","stakeholders":["CISO","security operations","AI platform lead","privacy officer"],"discoveryQuestions":["Do agents hold real credentials today?","Is there a SIEM that accepts OCSF?","Will regulated data pass through agent HTTP calls?"],"valueHypothesis":"An audit-then-enforce OpenShell pilot can replace prompt-only controls with logged, method-level policy at low licence cost.","potentialEngagement":"Fixed-scope OpenShell pilot covering two agents, the audit-to-enforce transition, and SIEM integration.","unsupportedClaims":["Certifiable or production-proven security","Sentry hardware availability","Zero policy-authoring effort"]},"engineering":{"fit":"Good fit for multi-agent or credentialed agents on Linux hosts or Kubernetes with an enforcing CNI.","architectureIntegration":"Gateway as control plane, supervisor holds credentials and mediates egress, OCSF events to SIEM; L7 proxy terminates TLS for rest rules.","prerequisites":["Docker/Podman or VM host","CNI that enforces NetworkPolicy","SIEM ingestion for OCSF","Policy owners per agent"],"constraints":["v0.1.x experimental interfaces","Windows WSL 2 experimental","TLS termination for L7 rules","Telemetry on by default"],"security":"Credential brokering removes secrets from sandboxes; TLS termination and log-level filtering must be reviewed for regulated data.","proofOfValue":["Deny drill with SIEM receipt","CNI enforcement test","Audit-mode dependency inventory","Telemetry-disabled config check"]},"delivery":{"work":"Two-phase audit-to-enforce pilot with SIEM integration and documented policy per agent.","dependencies":["Security operations","platform engineering","agent owners","privacy office"],"ownership":"Security operations owns monitoring; platform engineering owns the gateway and upgrades.","skillsAdoption":"Train agent owners on policy authoring and the advisor loop; budget about a day per non-trivial agent.","governanceCheckpoints":["CNI verification","TLS-termination review for regulated endpoints","Telemetry decision","Enforce-mode go-live"],"acceptanceCriteria":["All deny events visible in SIEM (proposed)","Written policy per agent before enforce (proposed)"],"risks":["Silent non-enforcement on non-enforcing CNI","Audit trail dropped by warn-level filters","Patch-level interface churn"]}},"retrievedAt":"2026-10-05T03:05:06Z","enrichedAt":"2026-10-05T03:13:11Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Policy authoring is skilled work; smaller IT shops may need templates or partner help to reach enforce mode.","procurementImplications":"No licence fee for the runtime; cost sits in engineering time and SIEM integration, which should be scoped explicitly.","operatingModelImplications":"Ongoing policy maintenance per agent becomes a recurring security-operations task.","sourceVerification":{"openedUrl":"https://andrew.ooo/posts/openshell-review-nvidia-kernel-enforced-agent-sandbox/","referenceExcerpt":"It is production-shaped, not yet production-proven.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}