Nvidia Donates OpenShell to CNCF, Betting on Infrastructure-First AI Agent Security

Nvidia transferred OpenShell, its open-source runtime designed to secure and govern AI agents, to the Cloud Native Computing Foundation this week. The platform teams already operating it in production maintain close ties with Kubernetes and other CNCF initiatives, according to Ali Golshan, Nvidia's senior director of AI software and the project's leader.

The announcement came Tuesday during KubeCon + CloudNativeCon North America in Salt Lake City. OpenShell, which Nvidia first unveiled at its GTC conference in March, entered the CNCF as a Sandbox project—the foundation's introductory classification for nascent efforts. The CNCF formally approved the project in late September.

The CNCF currently maintains 262 projects across its portfolio, with 155 residing at the Sandbox tier. However, alternative venues existed for OpenShell. The Linux Foundation, which oversees the CNCF, also operates the Agentic AI Foundation (AAIF), a separate home for agentgateway, the Model Context Protocol (MCP), and the Agent2Agent (A2A) protocol. Last month, the AAIF welcomed OpenSandbox, a sandbox environment for AI agents that Alibaba contributed.

Securing and creating trust around AI is really infrastructure. That's really where you need to start.

Ali Golshan, Nvidia

Golshan explained to The Silicon Ledger that this perspective guided the decision. The CNCF represented the natural destination because agent security fundamentally constitutes an infrastructure challenge requiring foundational solutions.

The platform team is the user

OpenShell executes agents within a sandbox environment while applying restrictions on file access, network connections, credentials, and model endpoints those agents can utilize. According to the CNCF, this enforcement occurs at the infrastructure layer surrounding the agent. The initiative is adopting Cedar, another CNCF initiative, to serve as its policy language.

Securing agents demands an integrated stack solution, Golshan noted, and Nvidia lacked the capacity to construct that stack incrementally. "We can't go build OpenShell and then go build the next pieces of it," he explained. "And a lot of those pieces, from an infrastructure standpoint, already existed in CNCF." He referenced Kubernetes itself, the streamlined K3s variant, and service mesh technologies as examples of complementary initiatives already in place.

As development progressed, the intended operator profile became apparent to Golshan. The role aligned with the DevSecOps professional responsible for deploying the remainder of an organization's infrastructure. He pointed to SAP as an example of an enterprise where DevOps and infrastructure personnel manage substantial agent deployments.

While engineers or researchers may interact with agents directly, the operators represent "the same teams that are spinning up Kube and Linux and that whole stack," Golshan said. In an ideal scenario, those end users remain unaware of OpenShell's presence. "You don't really see Kubernetes," he noted. "You just get that environment."

Jonathan Bryce, the CNCF's executive director, frames the question of where technology belongs around identifying "where are the people who are going to be making the decision about deploying, using, contributing to a specific technology?" Agent development began with individuals running OpenClaw on Mac Minis in home settings, Bryce observed, but persistent, SaaS-oriented agents resemble conventional software operating in data centers. Prior to OpenShell's CNCF arrival, much early adoption originated from neoclouds—GPU cloud providers seeking to manage workloads their customers execute on their systems.

Because OpenShell integrates with Kubernetes and broader ecosystem components, Bryce explained, organizations already maintaining that infrastructure can readily incorporate it into their contained workloads.

Where agent projects live

Agents will permeate the entire technology stack, Bryce stated, and the open-source initiatives supporting them will distribute across multiple foundations, each attracting distinct contributor communities.

The PyTorch Foundation, which houses PyTorch, vLLM, DeepSpeed, and Ray, serves as the venue for engineers possessing advanced AI knowledge. Bryce compared them to "the people who write Postgres."

The CNCF represents "the very broad set of folks who understand how to take mature systems and deploy, scale, observe, secure them," Bryce characterized it.

The AAIF, through protocols such as MCP and A2A, concentrates on the user-facing aspects of agents. Bryce drew parallels to HTTP and JavaScript—the standards that enabled countless web applications to flourish.

These foundations function as "Venn diagrams" rather than isolated compartments, Bryce emphasized, "and I think that's good." He highlighted KubeRay, which operates Ray workloads atop Kubernetes, and llm-d, which combines vLLM with Kubernetes. The AAIF's agentgateway similarly collaborates with Kubernetes.

The CNCF maintains flexibility regarding project placement and permits maintainers to "choose their own adventure to some extent," he noted. Bryce also acknowledged that Nvidia's perspective on how organizations deploy AI workloads is "unparalleled," and the company regularly brings newly developed projects to each KubeCon. "Some of those end up in a foundation," he said. "Some of them don't."

Governance and a security committee

Golshan joined Nvidia in 2025 following the company's acquisition of Gretel, the synthetic data platform he had co-founded. Previously, he also co-founded StackRox, the Kubernetes security firm that Red Hat purchased in 2021.

The individuals who developed OpenShell had previously contributed to CNCF initiatives and possessed firsthand knowledge of its governance structure, Golshan noted. That framework aligned with the team's objectives: a focused mission for OpenShell and integration within a broader ecosystem.

Security governance remains under development, he indicated. OpenShell currently holds Sandbox status, and Golshan stated the team is "spending a bunch of time thinking through" establishing an autonomous security committee. "One of the things that I think becomes very important is how do you manage things like disclosures, vulnerabilities," he said. Should OpenShell mature into critical infrastructure, it requires participation from numerous stakeholders, "not necessarily us."

Nvidia's engineering staff will maintain responsibility for the project's foundation, though Red Hat, Docker, and Canonical have functioned as core contributors alongside Nvidia since inception. When Nvidia made OpenShell available for early access in March, approximately 10 to 15 companies participated in development, Golshan reported. The project reached version 0.1.0 in September, shedding its alpha designation, and the CNCF's project listing now identifies roughly 380 contributing organizations.

There are a lot of people who will engage at a certain level without it being in neutral governance. But once it makes that move to fully neutral governance, then that engagement gets a lot deeper.

Jonathan Bryce, CNCF

Adoption timelines that previously required two to three years now compress into six to 12 months, Bryce observed, and he characterizes neutral governance as "rocket fuel" for integration and adoption. "llm-d came into CNCF in March of this year, and they now have their 1.0 release," he noted regarding the distributed inference framework, "and they have a whole set of companies that are actually running it in production, including some of the neoclouds."

What Nvidia wants from the community

OpenShell requires a surrounding ecosystem of complementary tools before reaching production scale, Golshan stated. Approximately 50 to 60 organizations, spanning startups and major vendors, have constructed solutions on top of it to date. OpenShell has established extension points for compute, credential administration, inference suppliers, and policy implementation, and Golshan anticipates the CNCF community will leverage these as templates for integrating OpenShell with the broader cloud-native landscape.

"It would be amazing if within the next six months we could support everything from Istio to Envoy to K3s for edge," Golshan stated.

Following the 0.1.0 release, early implementers transitioning agents from experimental phases into operational deployments have requested guidance on security, privacy, and observability solutions that integrate seamlessly with OpenShell, Golshan reported. They additionally seek assistance in refining the agents and execution environments running within it.

Golshan recounted a recent discussion in Berlin with someone possessing extensive Datadog and distributed tracing expertise. "I don't even know what to observe for an agent," Golshan recalled the person saying. He aspires for community insights gained from these scenarios to feed back into OpenShell's core development, mirroring the pattern that occurred with Kubernetes. "It's pretty easy these days to say I'm going to bet my company on Kube," he observed. "Nobody's going to get fired for that." He harbors similar ambitions for OpenShell.

An unsettled agent stack

The technology stack for model training has solidified, and the inference stack has largely stabilized, Bryce noted, but the agent stack remains "not at all" settled.

"If there's not a clear stack, then the industry can't come together on the most significant problems and actually make really fast, rapid progress," he stated. Over the subsequent six to 12 months, he anticipates experimentation will yield conclusions regarding OpenShell's integration with Kata Containers, gVisor, Agent Substrate, and current OpenTelemetry initiatives. Following that resolution, he forecasts agents will accelerate comparable to inference growth over the preceding eight months.

Two of those initiatives represent recent CNCF additions. Google contributed Agent Substrate, its platform for executing persistent agents on Kubernetes, and the gVisor sandbox runtime during this week's KubeCon. Nvidia indicated it is collaborating with Google on connecting OpenShell with Agent Substrate.