NVIDIA-backed OpenShell CNCF sandbox adds Kubernetes controls

OpenShell is a CNCF Sandbox runtime that enables secure execution of AI agents on Kubernetes by sandboxing each agent and routing requests through a trusted supervisor that enforces fine-grained filesystem, process, network, and credential controls. Platform engineers can combine OpenShell with Kubernetes objects and Kyverno admission policies to govern agent behavior, inspect requests, and maintain production security. Alternatively, Agent Substrate offers a contrasting CNCF approach focused on density and low-cost execution for idle agents using worker pools and snapshots. Open article →