ExOShell¶

Run Codex, Claude Code, or OpenCode against your local projects in disposable NVIDIA OpenShell sandboxes. ExOShell brings together the image, provider profiles, policies, and launcher for everyday agent work with rootless Podman.

Get started Explore integrations

A focused workspace for each session¶

• Share the project you choose. Mount one directory, opt into a larger source tree, or work in a disposable workspace with no host project mount.
• Keep tools consistent. Start with pinned coding agents and supporting CLIs already installed in the image.
• Keep supported credentials outside the agent. Providers supply placeholders; OpenShell resolves them only for permitted requests.
• Start fresh. The sandbox and agent runtime state are removed on exit. Changes to your mounted project remain on the host.

Understand the boundaries¶

OpenShell provides isolation; ExOShell supplies a reusable setup. The sandbox runs as a non-root user, and policies constrain filesystem and process access. The portable baseline audits general network traffic; provider endpoints enforce credential and request boundaries. It is not a blanket network deny policy. See policies to tailor access.

An agent can modify the project you share. Credentials in an explicitly mounted kubeconfig remain readable, and interactive login flows can write readable credentials inside the sandbox. Use the documented provider integrations and read sessions and credentials before adding services.

Find your next step¶