Red Hat OpenShift

Openship is an open-source, self-hostable application deployment platform with built-in CI/CD. It takes a repository, detects or supports its stack, builds and ships the application as containers, and handles routing and TLS termination. Deployments can be controlled through a desktop app, web dashboard, or CLI; GitHub webhooks support push-to-deploy workflows, and the platform supports repeatable rollbacks. The control plane can run locally in the desktop app, as a self-hosted server, or through Openship Cloud. In Compose mode it runs the platform stack on a Docker host and can host deployed applications there; in bare mode it runs as a lightweight process and deploys to a server over SSH or to the cloud.

A managed inference service from Red Hat for running enterprise AI inference workloads without directly selecting or managing GPUs. It provides usage-based scaling while abstracting underlying GPU capacity.

Keycloak is an open-source identity and access management system for applications and services. It provides user federation, strong authentication, user management, fine-grained authorization, and support for identity protocols including OpenID Connect and SAML; in the described agent-security context, agents can be registered as OAuth2 clients. The project can be run from its distribution or Docker image and is licensed under the Apache License 2.0.

OpenShell is an open-source runtime from NVIDIA for running fleets of autonomous AI agents in isolated sandboxes. It lets agents read files, install packages, call APIs, and use credentials while enforcing declared filesystem, process, and network policies. Each agent runs in a sandbox where kernel-level controls govern file access, system calls, and network connections. OpenShell also uses formal verification to review policy changes before approval, flagging newly permitted access such as connections to additional hosts with credentials or calls to new API methods. Credentials are withheld from agents and added only to requests bound for approved endpoints. The project provides a CLI, local gateway, sandbox lifecycle management, policy tooling, inference-provider routing, Kubernetes deployment, extensibility APIs, and Python, TypeScript, Go, and Rust SDKs. OpenShell supports Linux, macOS on Apple Silicon, and experimentally Windows through WSL 2, with Docker, Podman, or host virtualization. It is licensed under the Apache License 2.0 and collects configurable anonymous operational telemetry.

Talos Linux is a modern, minimal Linux distribution built for running Kubernetes. Developed and supported by Sidero Labs, it is immutable and hardened, with all system management performed through an API rather than a shell or interactive console. API access uses mutual TLS authentication, while immutable infrastructure and atomic updates are intended to reduce configuration drift and support predictable Kubernetes and Linux updates. The project is fully open source and production-ready.