> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/openshell/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/openshell/_mcp/server.

# Isolation Backends

> Understand the runtime boundary used to launch and supervise sandboxed workloads.

An isolation backend connects the OpenShell supervisor to the runtime that
launches and controls a sandboxed workload. It defines how the supervisor
starts processes, attaches terminal streams, forwards signals, reports exit
status, and applies runtime-specific isolation.

OpenShell separates this interface from compute drivers. A compute driver
provisions the workload environment, while the isolation backend controls
process execution inside that environment. This boundary lets runtimes evolve
without changing the gateway API or policy model.

The OpenShell runtime backend implements the authenticated OpenShell Sandbox
Protocol used by the supervisor and `openshell-sandbox`. Backend selection and
capabilities remain internal to the workload runtime; users create and manage
sandboxes through the same gateway API.

For the deployment-level runtime architecture, refer to
[Sandbox Runtime](/kubernetes/sandbox-runtime). For driver-specific workload
behavior, refer to [Runtimes](/reference/sandbox-compute-drivers).