NVIDIA OpenShell

AIStor Memory is the memory your agent keeps inside an OpenShell sandbox. The sandbox is disposable, but the work and knowledge the agent builds there should not be. AIStor Memory mounts a cortex — a MinIO AIStor Memory Bucket — as the agent's writable workspace, so everything it writes persists to your own object store and the next sandbox re-mounts the same state at full fidelity: the real files, byte for byte, not session residue.

OpenShell is NVIDIA's kernel-isolated runtime for autonomous AI agents. Sandboxes inherit a static filesystem_policy at creation; the policy locks every path except declared read-only and read-write sets. AIStor Memory slots in at that seam: the host mounts the cortex at a known path, the policy allows that path, and the agent sees a writable workspace whose contents live in the durable cortex.

AIStor Memory mounts only a cortex — never a plain S3 bucket. Before bring-up the target must already be a cortex (aimem cortex create my-project), the mount must carry real signing credentials (AIMEM_ACCESS_KEY / AIMEM_SECRET_KEY; anonymous or default-chain mounts are rejected), and the backend must be a paid-tier AIStor that serves the Memory API. aimem verifies this at mount by probing GetCortex over the endpoint; a plain bucket, a free-tier server, or missing credentials fails the mount with no opt-out.

Integration shape

1. The OpenShell host runs bring-up.sh <cortex> <endpoint> -- <agent>.
2. The script mounts AIStor Memory at /sandbox/aimem-workspace, generates and registers a policy for that exact path, and launches the sandbox under it.
3. The agent writes to the AIStor Memory mount; AIStor Memory writes through the local store to the cortex.

# Generated default policy; see examples/openshell/policy.yaml.
version: 1
filesystem_policy:
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /lib64
    - /bin
    - /sbin
    - /etc
    - /proc
  read_write:
    - /tmp
    - /sandbox/aimem-workspace
landlock:
  compatibility: hard_requirement
process:
  run_as_user: sandbox
  run_as_group: sandbox

Quick start

Run this on the OpenShell host after aimem and openshell are installed, the cortex my-project exists, and signing credentials are exported (AIMEM_ACCESS_KEY / AIMEM_SECRET_KEY, plus AIMEM_SESSION_TOKEN if using temporary creds) so aimem can verify and mount the cortex:

./examples/openshell/bring-up.sh my-project https://aistor.example.com -- /path/to/agent

To prepare the mount and policy without launching the agent yet:

./examples/openshell/bring-up.sh my-project https://aistor.example.com

Use environment overrides only when the provider image differs from the defaults:

MOUNTPOINT=/sandbox/custom-workspace \
STAGING_DIR=/var/cache/aimem-custom \
POLICY_NAME=aimem-custom \
./examples/openshell/bring-up.sh my-project https://aistor.example.com -- /path/to/agent

STAGING_DIR is AIStor Memory's mandatory local store — the script passes it as --local. AIStor Memory requires exactly one local store, supplied via --local, the AIMEM_LOCAL env var, or the local: key in a --config YAML; the bring-up script wires the --local form for you.

What the agent sees

Everything else is denied by Landlock — the agent can read what the policy allows and write only inside the workspace mount.

The aimem skill is not served on the mount. It reaches the agent two ways automatically on every mount: a read-time preamble overlay prepended to instruction files read from the workspace, and a create-only install of the skill into the agent's home directory ($HOME/.agents/skills/aimem/ and $HOME/.claude/skills/aimem/). Agents whose reasoning runs outside the sandbox can also pull it with npx skills add minio/skills/aimem. See the SKILLS section for the full model.

Reference

• examples/openshell/ — the full template.
• OpenShell policy schema: docs.nvidia.com/openshell.