Skip to main content
Version: Next

Agent Sandboxing

Agent Sandboxing is how Agent Manager isolates a running agent's code from the underlying host. A spectrum of increasingly strict runtime tiers, chosen per environment, that only applies to Platform-Hosted agents (the platform doesn't control the runtime of an Externally-Hosted agent).

Three Tiers​

TierIsolation mechanismTrade-off
runc (default)Standard container runtime; shares the host kernelNo special hardware needed; every agent gets this by default (hardened security context, network policy, warm pool)
gVisorA userspace kernel (runsc) intercepts syscalls before they reach the host kernelStronger isolation than runc, no special hardware, but adds syscall interception overhead
Kata ContainersEach agent boots in its own lightweight VM with a separate guest kernelStrongest isolation — no shared kernel at all — but requires nested virtualization (/dev/kvm) on the node

Isolation Tier Is an Environment-Level Setting​

You don't choose a tier per agent — you choose it once when creating an environment, and every agent deployed or promoted into that environment runs under that tier. Adding a stronger-tier node to your cluster doesn't affect existing runc environments; only new environments (or environments explicitly configured for that tier) schedule pods onto it.

Under the hood, the tier is implemented as a Kubernetes RuntimeClass: deploying or promoting an agent into a gVisor or Kata environment sets runtimeClassName on its pod spec, and that RuntimeClass's own scheduling rules place the pod on a node dedicated to that tier.

Stronger agent isolation tiers

Agents run sandboxed under the standard runc runtime by default. Agent Manager also supports stronger per-environment isolation tiers — gVisor (userspace kernel) and Kata Containers (per-agent VM) — but they have hardware/OS requirements and need a dedicated node. For more information, see the gVisor and Kata Containers setup guides.

For the setup steps and hardware requirements for each tier, see gVisor and Kata Containers in Guides.