This page gets you from zero to a running, policy-enforced sandbox in two commands.

Before you begin, make sure you have:

• Docker Desktop running on your machine.

For a complete list of requirements, refer to {doc}../reference/support-matrix.

Run the install script:

$ curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

If you prefer uv:

$ uv tool install -U openshell

After installing the CLI, run openshell --help in your terminal to see the full CLI reference, including all commands and flags.

:::{tip} You can also clone the NVIDIA OpenShell GitHub repository and use the /openshell-cli skill to load the CLI reference into your agent. :::

Create a sandbox and launch an agent inside it. Choose the tab that matches your agent:

::::{tab-set}

:::{tab-item} Claude Code

Run the following command to create a sandbox with Claude Code:

$ openshell sandbox create -- claude

The CLI prompts you to create a provider from local credentials. Type yes to continue. If ANTHROPIC_API_KEY is set in your environment, the CLI picks it up automatically. If not, you can configure it from inside the sandbox after it launches. :::

:::{tab-item} OpenCode

Run the following command to create a sandbox with OpenCode:

$ openshell sandbox create -- opencode

The CLI prompts you to create a provider from local credentials. Type yes to continue. If OPENAI_API_KEY or OPENROUTER_API_KEY is set in your environment, the CLI picks it up automatically. If not, you can configure it from inside the sandbox after it launches. :::

:::{tab-item} Codex

Run the following command to create a sandbox with Codex:

$ openshell sandbox create -- codex

The CLI prompts you to create a provider from local credentials. Type yes to continue. If OPENAI_API_KEY is set in your environment, the CLI picks it up automatically. If not, you can configure it from inside the sandbox after it launches. :::

:::{tab-item} OpenClaw

Run the following command to create a sandbox with OpenClaw:

$ openshell sandbox create --from openclaw

The --from flag pulls a pre-built sandbox definition from the OpenShell Community catalog. Each definition bundles a container image, a tailored policy, and optional skills into a single package. :::

:::{tab-item} Community Sandbox

Use the --from flag to pull other OpenShell sandbox images from the NVIDIA Container Registry. For example, to pull the base image, run the following command:

$ openshell sandbox create --from base

:::

::::

Running openshell sandbox create without a gateway auto-bootstraps a local one. To start the gateway explicitly or deploy to a remote host, choose the tab that matches your setup.

:::::{tab-set}

::::{tab-item} Brev

:::{note} Deploy an OpenShell gateway on Brev by clicking Deploy on the OpenShell Launchable. :::

After the instance starts running, find the gateway URL in the Brev console under Using Secure Links. Copy the shareable URL for port 8080, which is the gateway endpoint.

$ openshell gateway add https://<your-port-8080-url>.brevlab.com
$ openshell status

::::

::::{tab-item} DGX Spark

:::{note} Set up your Spark with NVIDIA Sync first, or make sure SSH access is configured (such as SSH keys added to the host). :::

Deploy to a DGX Spark machine over SSH:

$ openshell gateway start --remote <username>@<spark-ssid>.local
$ openshell status

After openshell status shows the gateway as healthy, all subsequent commands route through the SSH tunnel.

::::

:::::