NVIDIA/OpenShell ? reverse-engineered prompt

Build me a tool to safely run autonomous AI agents on my machine. I'd like to create isolated sandbox environments for agents like Claude or Copilot where I can control exactly what they're allowed to do. The main goal is security and privacy. I want to use simple policy files, maybe using YAML, to lock down filesystem access so the agent can't read my private keys or other sensitive files.

I also need to control its network access. For example, I should be able to write a rule that lets it GET from the GitHub API but blocks it from POSTing data or connecting to other random addresses. The tool should also handle API keys securely, injecting them into the sandbox environment at runtime instead of saving them to disk. It should be a command-line app that uses Docker to manage the sandboxes. Finally, please include experimental support for passing an NVIDIA GPU through to the sandbox for local model inference.