Policy vs. Computer: How OpenShell and SmolVM Solve Agent Sandboxing Differently

What should an AI agent be allowed to do — and what computer should it get? Those are two different infrastructure problems. NVIDIA OpenShell and SmolVM approach agent sandboxing from different layers: 🔒 OpenShell focuses on policy. It controls what an agent can access: network destinations, files, credentials, processes, and model endpoints. 💻 SmolVM focuses on the computer. It gives the agent an isolated environment it can actually work inside: Linux microVMs, Windows 11, macOS desktops, browser sandboxes, and snapshots. This difference becomes concrete pretty quickly. For a coding agent with access to proprietary source code, you may want to restrict which APIs and domains it can reach. That is where OpenShell's policy model is useful. For a computer-use agent that needs to operate a Windows-only ERP or desktop application, policy alone is not enough. It needs a Windows computer. SmolVM treats that disposable computer as the sandbox boundary. So I don't think the interesting question is: OpenShell vs SmolVM — which one wins? The more useful way to look at the stack is: Agent ↓ Policy + credentials ↓ Computer runtime ↓ VM isolation OpenShell puts more emphasis on the upper layers. SmolVM puts more emphasis on the computer and VM layers. For production agents, I suspect we will need both. I wrote a deeper comparison across isolation, security policies, microVMs, persistence, Windows support, browser automation, and architecture. https://lnkd.in/evah6YMg 🔗

NVIDIA OpenShell and SmolVM approach AI agent sandboxing from different layers of the infrastructure stack. OpenShell focuses on policy, controlling what an agent can access — including network destinations, files, credentials, processes, and model endpoints — through declarative YAML policies enforced at runtime. SmolVM focuses on providing the computer itself, giving agents an isolated environment to work inside, including Linux microVMs, Windows guest support, browser sandboxes, and snapshot/resume capability. This distinction becomes practically relevant depending on the agent's use case: a coding agent with access to proprietary source code may primarily need restricted API and domain access, which fits OpenShell's policy model, while a computer-use agent operating a Windows-only application needs an actual computer environment, which is what SmolVM's disposable VM approach provides. Rather than treating the two as competitors, they can be understood as emphasizing different layers of the same stack — agent, policy and credentials, computer runtime, and VM isolation — with OpenShell weighted toward the upper layers and SmolVM toward the computer and VM layers, suggesting that production agent systems may ultimately need both.