How to Sandbox Claude Code and Codex in NVIDIA OpenShell

Running autonomous coding agents with --dangerously-skip-permissions muscle memory is a quiet disaster waiting to happen. One poisoned README or a malicious issue comment, and your agent has full access to your shell, your ~/.ssh keys, and your ~/.aws/credentials. While built-in sandboxes help, they often leave critical gaps.

To solve this, you can move your coding agents into NVIDIA OpenShell, an Apache-2.0 runtime open-sourced by NVIDIA specifically for running agents under strict security policies. Through our platform integrations at n1n.ai, we always advocate for robust multi-layer security when deploying high-capability models. Below is a detailed breakdown of how it isolates workloads, installation steps, and practical workarounds for the current 0.1.x line.

Architecture and Enforcement

The OpenShell architecture divides components into a gateway (control plane), a supervisor (the trusted side), and the isolated sandbox where your agent executes. On Linux systems, enforcement relies on native kernel mechanisms:

• Filesystem: Powered by Landlock. The default policy grants read-only access to /bin, /usr, /lib, /proc, /dev/urandom, /etc, and /var/log, with read-write access restricted strictly to the working directory, /tmp, and /dev/null. Your home directory is completely absent.
• Network: Zero outbound traffic by default. Direct egress is blocked at the runtime level. TCP connection attempts and DNS queries are intercepted via seccomp user notifications and handed to the supervisor for policy evaluation.
• Per-binary Rules: The sandbox identifies the calling executable from /proc. You can write rules like "/usr/bin/gh may GET api.github.com" while denying general curl requests.
• Secrets Management: The agent environment holds an opaque placeholder instead of your raw API key. The proxy injects the real value only for authorized endpoints. If leaked elsewhere, requests fail with a 403 credential_endpoint_mismatch.
• Process Isolation: Workloads run as a non-root user with zero Linux capabilities.

If the supervisor connection drops, the sandbox immediately freezes the agent, failing closed.

Installation and Setup

1. Installing OpenShell

The runtime provides an installation script, though you should always inspect installation scripts from external repositories:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

Telemetry is enabled by default. To disable it on your local gateway:

export OPENSHELL_TELEMETRY_ENABLED=false

2. Building Custom Agent Images

Because the base image (nvcr.io/nvidia/base/ubuntu:24.04) does not include agent CLIs out of the box, and prebuilt agent images were archived, you must build your own container image.

Note that @anthropic-ai/claude-code requires Node >= 22.0.0, whereas Ubuntu 24.04 packages Node 18. Pull Node 22 via NodeSource:

FROM nvcr.io/nvidia/base/ubuntu:24.04
RUN apt-get update && apt-get install -y curl ca-certificates git \
 && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 && apt-get install -y nodejs \
 && rm -rf /var/lib/apt/lists/*
RUN npm install -g @anthropic-ai/claude-code @openai/codex
USER 1000

Build the local image:

docker build -t agents:local .

3. Configuring Providers and Profiles

OpenShell uses provider profiles to manage API keys securely without exposing them to the agent environment. Download and adapt the reference profiles:

curl -LO https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/claude-code.yaml

Because npm global installs place binaries under /usr/lib/node_modules/, update the binary paths in your profile:

binaries: 
  - /usr/bin/claude
  - /usr/local/bin/claude
  - /usr/lib/node_modules/@anthropic-ai/**

Lint, import, and create the provider:

openshell provider profile lint -f claude-code.yaml
openshell provider profile import -f claude-code.yaml --global
openshell provider create --name my-claude --type claude-code --from-existing

Running the Sandbox

Launch your isolated sandbox and mount your workspace:

openshell sandbox create --name claude-box --from agents:local \
  --provider my-claude \
  --upload ./src:/workspace/src

openshell sandbox connect claude-box
# Inside the container:
claude

Security Comparison Matrix

Conclusion and Next Steps

Securing your coding environment is essential for modern development workflows. While tools like n1n.ai provide high-speed, reliable LLM endpoints, combining them with runtime isolation frameworks like NVIDIA OpenShell ensures your underlying infrastructure remains secure against prompt injections and supply chain attacks.

Get a free API key at n1n.ai