Agent Sandboxing

Index for agent-sandboxing approaches — routes to the right sub-skill based on host OS, isolation tier, and deployment scale. Use when picking a sandboxing strategy for an AI coding agent, comparing kernel-level isolation (gVisor) vs microVM isolation (Kata, Apple Container, Docker), choosing between Kubernetes-orchestrated and single-host CLI approaches, or unsure which agent-sandboxing skill to load next.

Install Kata Containers on a self-managed GKE node pool to run microVM-isolated agent workloads via kubernetes-sigs/agent-sandbox. Use when managed GKE Agent Sandbox (gVisor-only) is not enough, when running Claude Code or similar agents on GKE with hardware-level isolation, or when configuring N2 Intel Ubuntu nodes with nested virtualization for the upstream kata-gke-sandbox recipe.

Install Kata Containers on a local kind cluster via the kata-deploy DaemonSet, registering the kata-qemu RuntimeClass so agent-sandbox SandboxTemplates can request microVM isolation. Use when standing up a Linux dev loop for microVM-isolated pods, verifying nested-KVM prerequisites, or pairing kind with kubernetes-sigs/agent-sandbox for local hacking.

Run microVM-isolated Kubernetes workloads on Apple Silicon using kina, the Kubernetes-in-Apple-Containers analogue of kind. Use when developing kubernetes-sigs/agent-sandbox workloads on macOS where Kata Containers cannot run, when each k8s node must be an Apple Container microVM, or when applying SandboxTemplates without a per-pod runtimeClassName because the cluster itself is the microVM isolation tier.

Install and operate the kubernetes-sigs/agent-sandbox controller and CRDs for per-session, isolated AI agent pods on Kubernetes. Use when authoring SandboxTemplate / SandboxClaim manifests, configuring SandboxWarmPool for sub-second provisioning, applying default-deny NetworkPolicy, choosing between Kata Containers and gVisor as the RuntimeClass, or comparing managed GKE Agent Sandbox to the upstream open-source path.

Package Claude Code as an OCI image using mise and deploy it as a kubernetes-sigs/agent-sandbox SandboxTemplate workload. Use when building a mise-driven Dockerfile for Claude Code, configuring the ~/.claude named volume for session persistence, injecting ANTHROPIC_API_KEY per SandboxClaim, applying per-pod egress allowlists for api.anthropic.com, or running Claude Code headlessly inside a Kata or gVisor isolated pod.

Reference for the alpha agent-substrate/substrate project as an alternative ultra-scale control plane that shares snapshot and runtime primitives with kubernetes-sigs/agent-sandbox. Use when comparing agent-sandbox vs Substrate, evaluating the WorkerPool + ActorTemplate multiplexing model, reviewing the kubectl-ate CLI, or deciding which control plane fits a workload that needs millions of sub-second agent tool calls.