Sandboxing Your AI Agents Is Necessary. It's Not Enough.
Cloud Platform EngineeringThe default security response to deploying AI agents in production is to sandbox them. Give each agent an isolated execution environment, limit its capabilities, and contain the blast radius if it misbehaves. That’s the right instinct — and it solves the wrong half of the production problem.
What Sandboxing Solves
The agent-sandbox project (Kubernetes SIGs) addresses the security requirements that agent isolation requires: strong identities per agent, persistent storage across task execution, lifecycle management, and security boundaries enforced through Kubernetes CRD primitives.
Sandboxing answers “what can this agent do and what can it affect?” — the containment problem. For organizations deploying agents that touch file systems, databases, or external APIs, containment is non-negotiable. The sandbox controller prevents an agent from taking unintended actions beyond its scope.
What Sandboxing Doesn’t Solve
The resource problem is orthogonal to the security problem, and it becomes the binding constraint when you scale from a few agents to hundreds.
A sandboxed agent requires an active runtime environment. The straightforward implementation keeps each agent running as a persistent pod — wasting significant compute resources on idle agents waiting for tasks. The alternative, spinning agents up and down per-task, adds latency and infrastructure overhead that compounds across a large fleet.
Neither approach scales cleanly to “hundreds of dormant agents” without either burning money on idle pods or paying per-spawn overhead at every task.
The Complementary Layer: agent-substrate
agent-substrate (currently independent of CNCF, referenced in the analysis) addresses this specifically by treating agents as serverless workloads. Using lightweight runtimes — gVisor or Kata Containers — agents pause when idle and resume with persisted state, allowing many dormant agents to share minimal infrastructure.
The CNCF reference implementation using kagent demonstrates the architecture: six agents sharing a single worker pod, scaling horizontally only when concurrency actually demands it. The security boundary from agent-sandbox remains intact; the resource model shifts from “one pod per agent” to “shared pool with on-demand activation.”
Why Platform Teams Need Both
The security argument for sandboxing and the efficiency argument for serverless-style runtimes are not in tension — they operate at different layers of the stack. A platform that implements isolation without efficiency runs agents securely but bankrupts the compute budget at scale. A platform that optimizes for efficiency without isolation runs agents cheaply but removes the containment that makes production deployment safe.
The current CNCF tooling status:
- agent-sandbox: security isolation, Kubernetes-native, active development
- agent-substrate: resource efficiency, independent project, gVisor/Kata backends
- kagent: reference orchestration layer that integrates both
The So What
If your team is planning production AI agent deployments on Kubernetes and your security review stops at “we’ll sandbox them,” you’ve solved half the architecture. Build the resource efficiency layer into the design before the first fleet deployment — retrofitting it after you’ve established pod-per-agent patterns means re-architecting under production load. The CNCF blog post is worth reading as a canonical framing of why these are two distinct problems that require two distinct solutions.
Source: CNCF Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →