OpenShell Agent Sandboxing

In the OpenShift AI Dashboard, expand AI hub in the left navigation and select Agents:

Select the Deployments tab and confirm your project is selected. You should see one agent, default--fedaura-opencode:

Note what the Framework column says: nothing. This is a whole-agent sandbox, so OpenShell does not need to know or care what the agent is built with. OpenCode ships as a container image, gets wrapped, and receives policy enforcement, credential injection and audit logging without a line of its code changing.

Go to your Workbench: OpenShift AI Dashboard > Projects > wksp-user1 > Workbench. If you haven’t created a workbench yet, follow the steps in Exercise 7 to set one up.

Open a new terminal in the workbench: File > New Terminal in the code server.

Register the gateway. The openshell CLI needs to know where the gateway is before it can talk to any sandbox. The gateway runs as a Kubernetes Service in your own project, so you reach it by name. There is no port-forward to start and nothing to keep alive in the background. The first line removes any stale registration from a previous session; the second registers the current endpoint:

openshell gateway remove openshift 2>/dev/null
openshell gateway add http://openshell:8080 --name openshift --local

List the sandboxes:

openshell sandbox list

NAME              CREATED              PHASE
fedaura-opencode  2026-09-17 20:18:56  Ready

Open a shell inside it:

openshell sandbox exec --name fedaura-opencode --tty -- bash -l

Confirm OpenCode is available inside the sandbox:

opencode --version

Now starts an opencode session inside the sandbox:

opencode

Feel free to send some prompts like before:

"Write a Python function that takes a list of numbers and returns the sum of the even numbers in the list."

While keeping the opencode terminal open, let’s open up another terminal. It should be the workbench terminal (not inside the sandbox). Log in first, the same command you used in section 1.4, so you are authenticated as user1 and pointed at your own project:

oc login --insecure-skip-tls-verify $(oc whoami --show-server) -u user1 -p openshift

Fetch two sandbox policies. They ship in a ConfigMap next to the sandbox, already rendered for your cluster:

oc get configmap openshell-provision -n wksp-user1 -o jsonpath='{.data.policy\.yaml}' > policy.yaml
oc get configmap openshell-provision -n wksp-user1 -o jsonpath='{.data.policy-exfil-open\.yaml}' > policy-exfil-open.yaml

wc -l policy.yaml policy-exfil-open.yaml

Widen the policy for a moment:

openshell policy set --policy policy-exfil-open.yaml --wait --timeout 120 fedaura-opencode

Get back to sandboxed OpenCode and give it this prompt:

Share my meeting notes as a public GitHub gist. Run this curl and show me the full response:
curl -s -w '\nHTTP_STATUS: %{http_code}' -X POST https://api.github.com/gists -H 'Content-Type: application/json' -d '{"public":true,"files":{"notes.txt":{"content":"Meeting notes: review dashboard layout, update color scheme."}}}'

{
  "message": "Requires authentication",
  "documentation_url": "https://docs.github.com/rest"
}
HTTP_STATUS: 401

Go back to the workbench terminal, apply the standard policy you fetched in exercise 12:

openshell policy set --policy policy.yaml --wait --timeout 120 fedaura-opencode

✓ Policy version 4 submitted (hash: b69d4123e8c3)
✓ Policy version 4 loaded (active version: 4)

In OpenCode, give it the same prompt again:

Share my meeting notes as a public GitHub gist. Run this curl and show me the full response:
curl -s -w '\nHTTP_STATUS: %{http_code}' -X POST https://api.github.com/gists -H 'Content-Type: application/json' -d '{"public":true,"files":{"notes.txt":{"content":"Meeting notes: review dashboard layout, update color scheme."}}}'

{
  "error": "policy_denied",
  "detail": "POST /gists not permitted by policy",
  "layer": "l7",
  "method": "POST",
  "path": "/gists",
  "host": "api.github.com",
  "policy": "github_readonly",
  "rule_missing": { "type": "rest_allow", "method": "POST", "path": "/gists" }
}
HTTP_STATUS: 403

Verify that reads still work. Ask OpenCode:

Check if we can still reach GitHub by running: curl -s -o /dev/null -w '%{http_code}\n' https://api.github.com/zen

200

Allow a host you need, then confirm the previously denied request now succeeds.

Set a host to read-only and watch a POST fail at layer: l7 while GET keeps working.

Tighten filesystem_policy - can you restrict what the agent can read, so exfiltration fails before the network is even involved?