Miyoung Choi
574ef18dfc
* initial doc filling * improvements * stage provided get started, and add clean tutorials * pull in Kirit's content and polish * improve observability * moving pieces * move TOC around * drop support matrix from concepts * fix links * minor fixes and fix badges * minor fixes * incorporate missed content * minor improvements * clean up * run dori style guide review * clean up * updates impacting docs * incorporate feedback * minor fix * some edits * enterprise structure * update cards * improve * add some emojis * improve landing page with animated getting started code * fix the animated code * small improvements * refresh content based on PR 156 and 158 * README as the source of truth for quickstart * update README * run edits * change to the new prod name, text only, code swipe later * add Home * incorporate dev feedback on README * krit's edits * edit and improve index pages * fix build * revert README * revert quickstart to not pull from README
3.3 KiB
title, description, keywords, topics, tags, content
| title | description | keywords | topics | tags | content | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Install the OpenShell CLI and create your first sandboxed AI agent in two commands. |
|
|
|
|
Quickstart
This page gets you from zero to a running, policy-enforced sandbox in two commands.
Prerequisites
Before you begin, make sure you have:
- Python 3.12 or later
- Docker Desktop running on your machine
Install the OpenShell CLI
pip install nemoclaw
Create Your First OpenShell Sandbox
Choose the tab that matches your agent:
::::{tab-set}
:::{tab-item} Claude Code
$ nemoclaw sandbox create -- claude
✓ Runtime ready
✓ Discovered Claude credentials (ANTHROPIC_API_KEY)
✓ Created sandbox: keen-fox
✓ Policy loaded (4 protection layers active)
Connecting to keen-fox...
The CLI detects your ANTHROPIC_API_KEY, creates a provider, builds the sandbox, applies a default policy, and drops you into an interactive session. No additional configuration is required.
:::
:::{tab-item} Community Sandbox
$ nemoclaw sandbox create --from openclaw
The --from flag pulls a pre-built sandbox definition from the NemoClaw Community catalog. Each definition bundles a container image, a tailored policy, and optional skills into a single package.
:::
::::
What Happens Behind the Scenes
When you create a sandbox, OpenShell activates the following protection layers.
| Protection Layer | Description |
|---|---|
| Filesystem isolation | The agent can only read and write paths that the policy explicitly permits. |
| Network enforcement | Outbound connections are denied by default. The policy allowlists specific hosts, ports, and binaries. |
| Process restrictions | The agent runs as a non-root user inside the container. |
| Inference privacy | LLM API traffic is routed through a privacy-aware proxy. Credentials never leak outside the sandbox. |
A single YAML policy file controls all four layers. You can hot-reload network and inference rules on a running sandbox without restarting it.
:::{note} For OpenCode or Codex, the default policy does not cover the required endpoints. Follow the Run OpenCode with NVIDIA Inference tutorial for agent-specific setup. :::
Next Steps
You now have a working sandbox. From here, you can:
- Follow the Tutorials for step-by-step walkthroughs with Claude Code, OpenClaw, and OpenCode.
- Learn how sandboxes work in Sandboxes.
- Write your own policies in Safety and Privacy.