Sandbox Isolation: Why Agents Can't Run on Your Host
Autonomous agents execute arbitrary, model-generated shell commands. Running that on shared infrastructure is a supply-chain risk. Enterprise deployments isolate each agent session inside ephemeral gVisor or Firecracker microVMs with read-only base images, network egress allow-lists, and a hard wall-clock timeout per tool call.
sandbox:
runtime: firecracker
network_egress: allowlist
allowed_domains:
- api.github.com
- registry.npmjs.org
timeout_seconds: 120
fs_mode: read-only
writable_paths:
- /workspace
max_cpu: "2"
max_memory: "4Gi"Sandbox Hardening Checklist
- Ephemeral microVM per agent session, destroyed after task completion
- Network egress restricted to an explicit domain allow-list
- No credential injection beyond scoped, short-lived tokens
- Filesystem writes confined to a single workspace mount
- Resource ceilings enforced at the cgroup level, not the app level
| Architecture Strategy | Accuracy Score | P95 Query Latency |
|---|---|---|
| Naive RAG Vector Search | 61.4% | 240 ms |
| InexpensiveCoders Agentic RAG | 97.8% | 48 ms |
