Community sandboxes

Use pre-built sandboxes from the OpenShell Community catalog, bring your own container image, or contribute your own sandbox.

Community sandboxes are ready-to-use environments published in the OpenShell Community repository. Each sandbox bundles a Dockerfile, policy, optional skills, and startup scripts into a single package that you can launch with one command.

Current catalog

Sandbox	Description
base	Foundational image with system tools and dev environment. The default sandbox for openshell sandbox create.
ollama	Ollama with cloud and local model support. Claude Code, OpenCode, and Codex pre-installed. Use ollama launch inside the sandbox to start coding agents with zero config.
openclaw	Open agent manipulation and control.
sdg	Synthetic data generation workflows.

Default base sandbox tools

The base sandbox includes the following tools:

Category	Tools
Agent	claude, opencode, codex, copilot
Language	python (3.13), node (22)
Developer	gh, git, vim, nano
Networking	ping, dig, nslookup, nc, traceroute, netstat

Use a community sandbox

Launch a community sandbox by name with the --from flag:

openshell sandbox create --from openclaw

When you pass --from with a community sandbox name, the CLI:

1. Resolves the name against the OpenShell Community repository.
2. Pulls the Dockerfile, policy, skills, and any startup scripts.
3. Builds the container image locally.
4. Creates the sandbox with the bundled configuration applied.

You end up with a running sandbox whose image, policy, and tooling are all preconfigured by the community package.

Bring your own container (BYOC)

The --from flag also accepts local directories and container image references, giving you full control over the sandbox environment.

Community catalog

openshell sandbox create --from openclaw
openshell sandbox create --from ollama

Names are resolved against the OpenShell Community catalog.

Local directory

Point to a directory on disk that contains a Dockerfile and optional policy or skills:

openshell sandbox create --from ./my-sandbox-dir

The CLI builds the image from the Dockerfile in that directory.

Container image

Use an existing container image directly:

openshell sandbox create --from registry.io/img:v1
openshell sandbox create --from my-registry.example.com/my-image:latest

No build step occurs — the image is pulled and used as-is.

GPU intent is inferred automatically for community images with gpu in the name. For other GPU-enabled images, add --gpu explicitly.

Contribute a community sandbox

Each community sandbox is a directory under sandboxes/ in the OpenShell Community repository.

1. Fork the repository

   Fork NVIDIA/OpenShell-Community on GitHub.

2. Create your sandbox directory

   Add a new directory under sandboxes/ with the following required files:

   • Dockerfile — defines the container image.
   • README.md — describes the sandbox and how to use it.

   You can also include:

   • policy.yaml — default policy applied when the sandbox launches.
   • skills/ — agent skill definitions bundled with the sandbox.
   • Startup scripts invoked by the Dockerfile or entrypoint.
3. Open a pull request

   Submit your sandbox directory as a pull request. Refer to the repository’s CONTRIBUTING.md for submission guidelines.

The community catalog is designed to grow. If you have built a sandbox that supports a particular workflow — data processing, simulation, code review, or anything else — consider contributing it back so others can benefit.

Next steps

Providers

Supply API keys and tokens to your sandbox.

Policies

Write custom network and filesystem rules for your sandbox.

Manage sandboxes

Create, connect to, and manage sandbox lifecycle.

OpenShell Community

Browse the full community catalog and contribute your own sandbox.