Agent Sandbox adds a Sandbox Custom Resource Definition (CRD) and controller to Kubernetes, developed under SIG Apps. A Sandbox is a single, long-running, stateful pod with a stable identity and persistent storage, a shape that fits neither the stateless replicas of a Deployment nor the numbered pods of a StatefulSet. Use cases include runtimes that execute untrusted, LLM-generated code for AI agents, high-throughput sandboxes for reinforcement learning and evaluation loops, developer environments, notebook sessions, and single-instance services.
Agent Sandbox is a sandbox orchestrator rather than an isolation layer. It delegates container isolation to secure sandbox runtimes such as gVisor or Kata Containers by creating pods configured for them through a RuntimeClass, and follows the standard Kubernetes controller pattern: you declare a Sandbox resource and the controller manages the pod, its lifecycle, scheduled deletion, and pausing and resuming.
An extensions module builds on the core API. SandboxTemplate defines reusable Sandbox specs, SandboxWarmPool keeps pre-warmed Sandboxes ready to hand out, and SandboxClaim takes a Sandbox from a warm pool without the caller knowing its configuration. Go and Python SDKs consume the API from code, and an optional Sandbox Router reverse-proxies HTTP traffic from SDKs and external clients to sandbox pods where direct port-forwarding is unavailable. Planned characteristics include deep hibernation, automatic resume on network connection, and memory sharing across sandboxes.
Features
- Sandbox CRD: a declarative API for one stateful pod with a stable hostname and network identity
- Persistent storage: storage that survives Sandbox restarts
- Lifecycle management: creation, scheduled deletion, pausing, and resuming handled by the controller
- Runtime isolation: delegates kernel and network isolation to runtimes such as gVisor or Kata Containers
- SandboxTemplate: reusable templates for creating many similar Sandboxes
- SandboxWarmPool: a pool of pre-warmed Sandboxes for low-latency allocation
- SandboxClaim: claims a Sandbox from a warm pool without exposing its configuration
- SDKs: Go and Python clients for creating and using Sandboxes programmatically
- Sandbox Router: an optional HTTP reverse proxy that routes SDK and external traffic to sandbox pods
- Performance tuning: controller flags, warm-pool refill shaping, multi-pool sharding, and API Priority and Fairness insulation for high-throughput use
