Skip to main content
All work
Open-source runtime

Openrind Shell

openrind/openrind-shell · branch nemo

WootzApp Research

Openrind Shell runs Claude Code in an isolated OpenShell sandbox with a PostgreSQL-backed native project filesystem. Project files live on a FUSE mount at /sandbox/work, so every file operation in the workspace passes through one daemon that OpenShell supervises and keeps behind its default-deny network policy.

Project filesystem at /sandbox/work
FUSE
Sparse file chunks in PostgreSQL
256 KiB
Per workspace, lease-fenced
1 writer
Network policy for the daemon
Default-deny

Data path

From the agent's syscall to a committed row.

  1. 01Claude, git, compilers, editors, language servers
    POSIX syscalls
  2. 02Linux VFS · /sandbox/work
    ↓
  3. 03Kernel FUSE channel · supervisor-owned FD
    ↓
  4. 04openrind-shell-fused · sandbox UID + Landlock + seccomp
    HTTP CONNECT only, no direct-dial fallback
  5. 05OpenShell local proxy · binary-attributed endpoint policy
    Raw CONNECT tunnel, PostgreSQL TLS end to end
  6. 06PostgreSQL · _openeral.fs_* namespace

Boundary

What the runtime enforces.

  • The agent receives neither /dev/fuse nor mount capability.
  • After the supervisor installs its TSYNC seccomp prelude, mount and unmount are denied.
  • The FUSE daemon reaches PostgreSQL only through the OpenShell proxy; a valid proxy environment is mandatory.
  • One writable daemon per workspace, enforced by a PostgreSQL advisory lock and an expiring, fenced lease.
  • Committed data survives daemon, container, and sandbox replacement.

Status

Version 1 scope.

  • The FUSE capability is a default-off OpenShell patch pinned under vendor/openshell, pending a released upstream OpenShell version.
  • Claude and the daemon share the sandbox UID. A separate storage UID and a supervisor-mediated secret channel are planned hardening.
  • Built on NVIDIA OpenShell; no NVIDIA endorsement implied.