---
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
title: "Quickstart"
description: "Install the OpenShell CLI, connect to a gateway, and create your first sandboxed AI agent."
keywords: "Generative AI, Cybersecurity, AI Agents, Sandboxing, Installation, Quickstart, Gateway, Docker, Kubernetes, Podman"
position: 1
---

This page gets you from a reachable OpenShell gateway to a running, policy-enforced sandbox.

## Prerequisites

Before you begin, make sure you have:

- A reachable OpenShell gateway.
- At least one compute driver configured for the gateway: Kubernetes, Docker, Podman, or MicroVM.
- The OpenShell CLI installed on your workstation.

For a complete list of requirements, refer to [Support Matrix](/reference/support-matrix).
If you have not chosen a compute driver yet, refer to [Installation](/about/installation).

## Install the OpenShell CLI

Run the install script:

```shell
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
```

The install script uses Homebrew, RPM, or a Debian package based on your machine. It starts the local gateway server after installation.

After installing the CLI, run `openshell --help` in your terminal to view the full CLI reference.

<Tip>
Install the public OpenShell agent skills with `npx skills add NVIDIA/OpenShell`. The `openshell-cli` skill guides your agent through common workflows and uses the installed CLI help as the command reference; no OpenShell source checkout is required.
</Tip>

## Import a Provider Profile

A provider profile describes the credentials, endpoints, and client binaries a
provider needs. A gateway serves only the profiles you imported, so import one
before creating a sandbox that uses a provider.

The OpenShell repository ships example profiles in
[`providers/`](https://github.com/NVIDIA/OpenShell/tree/main/providers). Download
the one matching your agent and import it at platform scope:

```shell
curl -LsSfO https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/claude-code.yaml
openshell provider profile import -f claude-code.yaml --global
```

Use `codex.yaml` for Codex, or `openai.yaml` for OpenCode. Confirm the catalog:

```shell
openshell provider list-profiles
```

<Tip>
Read the comment header at the top of each file before importing it. It names
the client binaries the profile expects and the image layout those paths assume.
If your sandbox image installs the agent somewhere else, edit `binaries` first —
otherwise the profile matches nothing and the credential is never injected.
</Tip>

## Create Your First OpenShell Sandbox

Create a sandbox and launch an agent inside it.
Choose the tab that matches your agent:

<Tabs>
<Tab title="Claude Code">

Run the following command to create a sandbox with Claude Code:

```shell
openshell sandbox create --provider claude-code -- claude
```

`--provider` names the profile to use. If no provider by that name exists yet,
the CLI prompts you to create one from local credentials; type `yes` to continue.
If `ANTHROPIC_API_KEY` is set in your environment, the CLI picks it up automatically.
If not, you can configure it from inside the sandbox after it launches.

<Note>
`ANTHROPIC_API_KEY` is an API key from [console.anthropic.com](https://console.anthropic.com), not a subscription token. Subscription users must generate a separate API key.
</Note>
</Tab>

<Tab title="OpenCode">

Run the following command to create a sandbox with OpenCode:

```shell
openshell sandbox create --provider openai -- opencode
```

`--provider` names the profile to use. If no provider by that name exists yet,
the CLI prompts you to create one from local credentials; type `yes` to continue.
If `OPENAI_API_KEY` or `OPENROUTER_API_KEY` is set in your environment, the CLI picks it up automatically.
If not, you can configure it from inside the sandbox after it launches.
</Tab>

<Tab title="Codex">

Run the following command to create a sandbox with Codex:

```shell
openshell sandbox create --provider codex -- codex
```

`--provider` names the profile to use. If no provider by that name exists yet,
the CLI prompts you to create one from local credentials; type `yes` to continue.
If `OPENAI_API_KEY` is set in your environment, the CLI picks it up automatically.
If not, you can configure it from inside the sandbox after it launches.
</Tab>

<Tab title="Base Sandbox">

Use the `--from` flag to create a sandbox from the base container:

```shell
openshell sandbox create --from base
```

</Tab>

</Tabs>