> This page is for version v0.1.5.
> For other versions, use one of these documentation indexes:
> - Latest (v0.1.5) (default): https://docs.nvidia.com/openshell/latest/llms.txt
> - Dev: https://docs.nvidia.com/openshell/dev/llms.txt
> - v0.1.5: https://docs.nvidia.com/openshell/v0.1.5/llms.txt
> - v0.1.4: https://docs.nvidia.com/openshell/v0.1.4/llms.txt
> - v0.1.3: https://docs.nvidia.com/openshell/v0.1.3/llms.txt
> - v0.1.2: https://docs.nvidia.com/openshell/v0.1.2/llms.txt
> - v0.1.1: https://docs.nvidia.com/openshell/v0.1.1/llms.txt
> - v0.1.0: https://docs.nvidia.com/openshell/v0.1.0/llms.txt
> - v0.0.116: https://docs.nvidia.com/openshell/v0.0.116/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/openshell/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/openshell/_mcp/server.

# Isolation Backends

> Understand the runtime boundary used to launch and supervise sandboxed workloads.

The supervisor uses the `IsolationBackend` RPC service to discover and bind an
isolation backend, then uses the Sandbox Protocol to launch and control the
agent workload. The built-in `openshell-sandbox` runtime and external backends
implement the same services, allowing different isolation mechanisms without
changing the gateway API or policy model.

![The supervisor uses its OpenShellRuntimeBackend client to communicate with the workload-side openshell-sandbox runtime over the Sandbox Protocol.](/openshell/_fern-files/openshell.docs.buildwithfern.com/4257d0f47f5734404c2c9b59bd273dcf98d80efddc6eac2a2a9b84b5f3da319c/pages-v0.1.5/images/openshell-isolation-backend.svg)

## The protocols

The services are defined in
[`isolation_backend.proto`](https://github.com/NVIDIA/OpenShell/blob/main/proto/isolation_backend.proto)
and
[`sandbox_protocol.proto`](https://github.com/NVIDIA/OpenShell/blob/main/proto/sandbox_protocol.proto).
The supervisor's concrete RPC client, `OpenShellRuntimeBackend`, lives in
[`openshell-sandbox-backend`](https://github.com/NVIDIA/OpenShell/tree/main/crates/openshell-sandbox-backend).

| RPC                                                   | What it does                                                               |
| ----------------------------------------------------- | -------------------------------------------------------------------------- |
| `IsolationBackend.Describe`                           | Negotiates the protocol and capabilities.                                  |
| `IsolationBackend.OpenBoundary`                       | Binds a provisioned resource to an authenticated launch.                   |
| `IsolationBackend.SuspendBoundary` / `ResumeBoundary` | Optionally retains and restores workload state.                            |
| `SandboxProtocol.Exchange`                            | Carries admission, process control and I/O, TCP decisions, and relay data. |
| `SandboxProtocol.Mediate`                             | Carries the DNS mediation handshake, queries, and responses.               |

The admission sequence is Attach, Confirm, then StartAgent. No workload code
runs before StartAgent.

External compute drivers advertise `openshell.compute.isolation-backend` to
accept an operator-selected `IsolationBackendRegistration`, including its Unix,
TCP, or vsock endpoint. The driver provisions the resource and delivers the
backend's trusted launch metadata to the supervisor.

## Who Owns What

| Component         | Owns                                                                                                                              |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Supervisor        | Policy decisions. Policy, credentials, DNS resolution, and approved external connections stay outside the agent workload.         |
| Compute driver    | Placement and fencing. The driver creates runtime resources, installs the outer egress fence, and supplies a verified descriptor. |
| Isolation backend | Enforcement. The backend implements the RPC contracts and enforces the admitted policy inside its provisioned resource.           |

For how `openshell-sandbox` enforces the boundary, refer to [Inside the Sandbox Boundary](/about/architecture#inside-the-sandbox-boundary). For driver-specific
workload behavior, refer to [Runtimes](/how-it-works/sandboxes/runtimes).