Skip to content

Agent sandbox

An agent sandbox is a throwaway environment for running code that no person has read. The code arrives from a model, it runs once, and everything it touched is deleted when it stops.

The need comes from how agents work. An agent that picks from a fixed list of tools can only do what you thought of when you wrote the list. An agent that writes code can do whatever the language can express, which is the useful part and the risky part at the same time. That code is unreviewed, and what a model writes is shaped by what it has read — including text you did not write and never saw.

A sandbox does not try to decide whether the code is safe. It limits what the code can reach, so that the answer stops mattering.

The isolation model

Each boundary answers a different question. They do not substitute for each other, and a sandbox missing one of them is not a sandbox.

Boundary What it stops How
Identity The code acting as you against the cluster API No service account token mounted
Network Anything the code holds being sent anywhere Default-deny egress, then a named allow-list
Filesystem One run reading what the last run left behind Ephemeral volume, deleted with the pod
Resources One run taking the node down with it CPU and memory limits, and a deadline
Project The run reaching your other workloads Its own project, with its own quota

Identity is the boundary most often left out, because nothing looks wrong when it is missing. Code that finds a mounted token will use it, and a token can list secrets and create workloads.

The Kubernetes field behind each boundary
Boundary Field
Identity automountServiceAccountToken: false on the pod
Network A NetworkPolicy selecting the pod with no egress rule, then named allows
Filesystem An emptyDir volume rather than a PersistentVolumeClaim
Resources resources.limits for CPU and memory, plus activeDeadlineSeconds
Project A ResourceQuota and a LimitRange on the sandbox project

The step-by-step guide sets each one and shows how to check it held.

How it fits together

flowchart LR
    AGENT["Agent"] -->|submit code| SB
    subgraph SB["Sandbox project - own namespace and quota"]
        direction TB
        POD["Ephemeral pod<br/>no token · no secrets<br/>limits and deadline set"]
        VOL["Ephemeral volume"]
        POD --- VOL
    end
    SB -->|"results only"| AGENT
    SB -.->|default deny| NET(["Network"])
    SB -.->|named host, explicitly allowed| PKG["Package registry"]

Results come back to the agent. Nothing else crosses the boundary unless you open it deliberately, and opening it is the step to be careful about: most sandboxes need one host, a package registry, so allow that host and DNS by name rather than allowing egress generally.

The life of one run

A sandbox is created for a single run and destroyed after it. Nothing carries over, which is what stops one run reaching another.

stateDiagram-v2
    [*] --> Created: agent submits code
    Created --> Running: pod starts, nothing mounted
    Running --> Returned: stdout, stderr and artifacts go back
    Running --> Stopped: deadline or resource limit reached
    Returned --> [*]: pod and volume deleted
    Stopped --> [*]: pod and volume deleted

Because the pod and its volume are gone afterwards, a finished run cannot be opened up and inspected. Anything worth keeping has to leave as a returned artifact while the run is alive.

What a sandbox does not stop

A boundary you overestimate is worse than one you know is absent.

  • What you put in it. If the input file holds secrets, the sandbox holds secrets. The boundary limits what the code can reach on its own, not what you hand it.
  • What comes back out. Results go to the model and into its context, and the model talks to the outside world. Blocked egress does not block stdout.
  • Your allow-list. A package registry is, by definition, a place arbitrary code comes from.
  • Cost. Limits bound one run. Nothing here stops an agent from starting a thousand.

There is no managed sandbox service yet

The boundaries above are ordinary project, policy and quota objects, and you can build them today. What the platform does not run for you is a service that creates and tears down sandboxes on demand.