Third partiesGitHub · Jira · Claude API, etc.
OpenShell gateway (control plane)
API serverauth · sandbox lifecycle · issues JWTs
Persistent statesandboxes · policies · providers (real credentials)
compute driver: dockercreates two containers and the socket between thembuilds the boundary, judges no requests
sandbox (one per step instance)
supervisor containertrusted side · bridge network
- policy decisions
- placeholders → real credentials
- DNS and proxy · TLS re-signing
- keeps the gateway session (JWT)
workload container · untrusted · network none
harness processclaude -p or bash · untrusted
· Landlock limits the file system
· env vars hold only credential placeholders
· seccomp blocks TCP and DNS
· the run's workspace is under /sandbox/
No egress at allonly a Unix socket to the supervisor
openshell CLI: create, delete sandboxes (myorch worker)
import providers (compose's providers service)
read/write
creates
gets policy
+ credentials
Unix
socket
policy-allowed egress
placeholders swapped
for real credentials
call
path of egress requests
data read/write