STEPS — reproduce the OpenShell agent-security demo

All commands verified against the official OpenShell repo/docs (July 2026). If a command has changed, the source of truth is https://docs.nvidia.com/openshell/latest/get-started

0. Prerequisites

Docker or Podman running (needed for the MicroVM/container sandbox backend).
```
docker info   # or: podman info
```

1. Install the OpenShell CLI

Recommended (binary):

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

Or via uv:

uv tool install -U openshell

Verify:

openshell --version

2. Run an agent inside a sandbox

Supported agents out of the box: claude, opencode, codex, copilot.

openshell sandbox create -- claude
openshell sandbox list          # confirm it's running

📸 Screenshot the running sandbox → assets/01-sandbox-running.png

3. Apply the read-only-GitHub policy

openshell policy set <sandbox-name> --policy policies/readonly-github.yaml --wait

This allows GET to the GitHub API and blocks POST at layer 7. (Network/inference sections reload at runtime; filesystem/process lock at creation.)

4. Trigger a blocked action (the money shot)

Inside the sandboxed agent, ask it to do something the policy forbids, e.g.:

POST to the GitHub API (create an issue / gist) → should be denied
write a file outside /sandbox or /tmp → should be denied

📸 Screenshot the deny → assets/02-action-blocked.png

5. Export audit-log evidence

OpenShell records every allow/deny with destination, binary, and reason.

openshell sandbox logs <sandbox-name>     # confirm exact subcommand via `openshell sandbox --help`

📸 Screenshot the allow/deny log lines → assets/03-audit-log.png

6. Clean up

openshell sandbox list
openshell sandbox delete <sandbox-name>   # confirm exact subcommand via --help

7. Write it up

Turn assets/01–03 into a short bilingual post:

The risk (agent + shell + network = blast radius)
The fix (unmodified agent + YAML policy + kernel sandbox)
The proof (the deny + the audit line)
PM takeaway: this is governance-as-code — version-controlled, reviewable in PRs

⚠️ Commands to double-check against live docs

The install / create / policy-set commands are from the official repo & get-started page. The exact logs / delete subcommands should be confirmed with openshell sandbox --help on your machine before you publish, since CLI surface can shift between releases.