In simple English
This tool helps you run separate, secure computer environments inside a Kubernetes cluster. Each environment gets its own storage and network identity so it can keep working across restarts. It is meant for running unpredictable software like artificial intelligence agents or training loops that might need special safety boundaries. You need an existing Kubernetes cluster to run it. It costs you the server resources you assign to your sandboxes and the time to manage Kubernetes settings.
What it is
Agent Sandbox is an open-source Kubernetes controller and custom resource definition that manages isolated, long-running single pods. It delegates low-level container security to sandbox runtimes such as gVisor or Kata Containers.
What it is good for
Solo builders running artificial intelligence agent execution loops or reinforcement learning tasks who need safe, persistent, and fast-starting container environments inside Kubernetes without complex manual setup.
- Provides stable network identity and persistent storage for each sandbox.
- Includes warm pools to quickly hand out pre-warmed sandbox environments.
- Supports secure container runtimes like gVisor and Kata Containers for strong isolation.
- Requires an existing Kubernetes cluster and familiarity with cluster administration.
- Memory and processor demands depend entirely on the workloads and isolation runtimes you choose.
- Using advanced features requires learning custom Kubernetes resources and controllers.
cumbersome manual combinations of Kubernetes StatefulSets, Services, and PersistentVolumeClaims
gVisor
- kubernetes/kubernetes129k stars
The core container orchestrator that runs agent-sandbox controllers and pods.
- kata-containers/kata-containers9.0k stars
A secure container runtime that agent-sandbox can delegate isolation to.
- google/gvisor20k stars
A kernel isolation runtime often used alongside sandbox environments for added safety.
- caprover/caprover15k stars
A web page that installs apps and databases onto one rented computer, and sorts out the addresses and certificates.
- google/slo-generator564 stars
Turns a written reliability target into a measured number and a remaining budget.
- vectordotdev/vector23k stars
One collector that gathers logs and numbers from machines and sends them to one or more monitoring services.
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/sandbox-with-extensions.yaml