--- title: Kubernetes Agent Sandbox: What It Is and How to Deploy... description: Kubernetes Agent Sandbox is a Kubernetes SIGs project that gives AI coding agents kernel-isolated, disposable environments as first-class Kubernetes resources... canonical: https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi | daily.dev og:description: Kubernetes Agent Sandbox is a Kubernetes SIGs project that gives AI coding agents kernel-isolated, disposable environments as first-class Kubernetes resources... og:url: https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj og:image: https://api.daily.dev/og/posts/LxrGu9EVJ.png og:image:alt: Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi **[Pulumi](https://daily.dev/sources/pulumi)** · 10 min read · 1 upvotes · 0 comments ## Summary Kubernetes Agent Sandbox is a Kubernetes SIGs project that gives AI coding agents kernel-isolated, disposable environments as first-class Kubernetes resources using a `Sandbox` CRD backed by gVisor or Kata Containers. The post explains why standard containers aren't sufficient security boundaries for AI agents (shared kernel, CVE-2019-5736), how gVisor's userspace kernel mitigates this, and how Agent Sandbox addresses the cold-start latency problem with warm pools and memory snapshots. A step-by-step Pulumi deployment on GKE is provided covering: creating a gVisor node pool, installing the Agent Sandbox controller, programmatically creating per-developer sandboxes, setting egress NetworkPolicies to block private IPs and metadata servers, and enabling private access via Tailscale with per-user ACLs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Kubernetes Agent Sandbox project and how does it differ from GKE Sandbox? Agent Sandbox is a Kubernetes SIGs project providing a Sandbox custom resource, backed by gVisor or Kata Containers, that gives AI agents disposable, kernel-isolated environments. GKE Sandbox is Google's underlying gVisor RuntimeClass feature that predates Agent Sandbox and provides per-pod kernel isolation; Agent Sandbox is the lifecycle layer sitting on top, with its runtime selection pointing down at gVisor or Kata. _Teams standing up isolated AI agent infrastructure can track releases like this via daily.dev._ ### Why isn't a Docker container secure enough to run an AI coding agent in? A Docker container shares the host kernel, exposing over 450 syscalls to every container on the machine, so it isn't a strong security barrier. CVE-2019-5736 showed a malicious container tricking runc into overwriting the host's runc binary, letting every subsequent docker run execute as root — a serious risk when a prompt-injectable AI agent is inside that container. _Developers weighing container versus kernel-level isolation for agents can follow this debate on daily.dev._ ### By default, does creating a Kubernetes Sandbox resource directly apply any network egress restrictions? No, creating a Sandbox directly installs no NetworkPolicy at all, leaving egress wide open despite kernel isolation. The sandbox-with-extensions.yaml manifest verified against the v0.5.2 release shows networkPolicyManagement defaults to Managed only for SandboxTemplate-created sandboxes; a directly-created Sandbox gets neither, so restricting egress is left to the operator to configure manually. _Anyone locking down AI agent network access on Kubernetes can keep tabs on gotchas like this via daily.dev._ ## Similar posts on daily.dev - [Open-Source Agent Sandbox Enables Secure Deployment of AI Agents on Kubernetes](https://daily.dev/posts/open-source-agent-sandbox-enables-secure-deployment-of-ai-agents-on-kubernetes-ichq19lcg) · InfoQ · 1 upvotes · 0 comments - [Google Cloud: A Deep Dive into GKE Sandbox for Agents](https://daily.dev/posts/google-cloud-a-deep-dive-into-gke-sandbox-for-agents-keoxzofzg) · The New Stack · 3 upvotes · 0 comments - [Why sandboxing your agent is not enough](https://daily.dev/posts/why-sandboxing-your-agent-is-not-enough-m5nc5kdyk) · CNCF · 13 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#containers](https://daily.dev/tags/containers), [#pulumi](https://daily.dev/tags/pulumi) [View this post on daily.dev](https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi","url":"https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj"},"datePublished":"2026-07-21T12:06:57.762Z","dateModified":"2026-09-13T20:05:38.013Z","description":"Kubernetes Agent Sandbox is a Kubernetes SIGs project that gives AI coding agents kernel-isolated, disposable environments as first-class Kubernetes resources...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0bac28035677d9a08696316ff06e89df?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0bac28035677d9a08696316ff06e89df?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Pulumi","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Pulumi","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/9792c211dccf434c8b469efac5b7b2ec","url":"https://daily.dev/sources/pulumi"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,containers,pulumi","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Pulumi","item":"https://daily.dev/sources/pulumi"},{"@type":"ListItem","position":3,"name":"Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-lxrgu9evj#faq","mainEntity":[{"@type":"Question","name":"What is the Kubernetes Agent Sandbox project and how does it differ from GKE Sandbox?","acceptedAnswer":{"@type":"Answer","text":"Agent Sandbox is a Kubernetes SIGs project providing a Sandbox custom resource, backed by gVisor or Kata Containers, that gives AI agents disposable, kernel-isolated environments. GKE Sandbox is Google's underlying gVisor RuntimeClass feature that predates Agent Sandbox and provides per-pod kernel isolation; Agent Sandbox is the lifecycle layer sitting on top, with its runtime selection pointing down at gVisor or Kata. Teams standing up isolated AI agent infrastructure can track releases like this via daily.dev."}},{"@type":"Question","name":"Why isn't a Docker container secure enough to run an AI coding agent in?","acceptedAnswer":{"@type":"Answer","text":"A Docker container shares the host kernel, exposing over 450 syscalls to every container on the machine, so it isn't a strong security barrier. CVE-2019-5736 showed a malicious container tricking runc into overwriting the host's runc binary, letting every subsequent docker run execute as root — a serious risk when a prompt-injectable AI agent is inside that container. Developers weighing container versus kernel-level isolation for agents can follow this debate on daily.dev."}},{"@type":"Question","name":"By default, does creating a Kubernetes Sandbox resource directly apply any network egress restrictions?","acceptedAnswer":{"@type":"Answer","text":"No, creating a Sandbox directly installs no NetworkPolicy at all, leaving egress wide open despite kernel isolation. The sandbox-with-extensions.yaml manifest verified against the v0.5.2 release shows networkPolicyManagement defaults to Managed only for SandboxTemplate-created sandboxes; a directly-created Sandbox gets neither, so restricting egress is left to the operator to configure manually. Anyone locking down AI agent network access on Kubernetes can keep tabs on gotchas like this via daily.dev."}}]} ```