NVIDIA OpenShell

OpenShell is NVIDIA's kernel-isolated runtime for autonomous AI agents. Each sandbox gets a static filesystem_policy when it is created; the policy blocks every path except the declared read-only and read-write sets.

AIStor Memory mounts a Memory Bucket on the OpenShell host, and the policy allows that path. The agent sees a writable workspace whose files are stored in your AIStor, so they survive when the sandbox is deleted. The next sandbox mounts the same bucket and finds the same files.

Prerequisites

• aimem and openshell installed on the OpenShell host.
• An existing Memory Bucket, my-project in the examples below.
• Signing credentials exported on the host: AIMEM_ACCESS_KEY and AIMEM_SECRET_KEY, plus AIMEM_SESSION_TOKEN for temporary credentials.

Quick start

On the OpenShell host, download the example, then run bring-up.sh from that directory:

mkdir aimem-openshell && cd aimem-openshell
base=https://docs.min.io/aimem/examples/openshell
for f in bring-up.sh policy.yaml; do
  curl -fsSLO "$base/$f"
done
chmod +x bring-up.sh

./bring-up.sh my-project https://aistor.example.com -- /path/to/agent

The script mounts AIStor Memory at /sandbox/aimem-workspace, creates and registers a policy for that path, and starts the agent in a sandbox under that policy. The agent writes to the mount, and AIStor Memory writes through its local staging directory to the Memory Bucket.

To prepare the mount and policy without starting the agent:

./bring-up.sh my-project https://aistor.example.com

If your image needs different paths or a different policy name, set these variables:

MOUNTPOINT=/sandbox/custom-workspace \
STAGING_DIR=/var/cache/aimem-custom \
POLICY_NAME=aimem-custom \
./bring-up.sh my-project https://aistor.example.com -- /path/to/agent

STAGING_DIR is AIStor Memory's required local staging directory. The script passes it to aimem as --local.

The policy

The script generates this default policy:

# Generated default policy; see policy.yaml.
version: 1
filesystem_policy:
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /lib64
    - /bin
    - /sbin
    - /etc
    - /proc
  read_write:
    - /tmp
    - /sandbox/aimem-workspace
landlock:
  compatibility: hard_requirement
process:
  run_as_user: sandbox
  run_as_group: sandbox

What the agent sees

Landlock denies everything else. The agent can read what the policy allows, and write only in /tmp and the workspace mount.

On each mount, the agent receives the aimem skill in two ways: a short usage preamble added to instruction files read from the workspace, and a copy of the skill installed in the agent's home directory ($HOME/.agents/skills/aimem/ and $HOME/.claude/skills/aimem/). An agent that runs outside the sandbox can install it with npx skills add minio/skills/aimem. See SKILLS.

Reference

• bring-up.sh and policy.yaml: the example.
• OpenShell policy schema: docs.nvidia.com/openshell.