Kubernetes Agent Sandbox CRD: SIG Apps Standardizes Stateful Agent Runtimes

By Vatsal Shah | March 24, 2026 | 7 min read | Source: Kubernetes Blog

Lead Paragraph

SAN FRANCISCO, CA — On March 20, 2026, the Kubernetes SIG Apps group announced the publication of a draft proposal for the Agent Sandbox Custom Resource Definition (CRD) and associated controller architecture. Designed specifically to handle the ephemeral, stateful, and untrusted execution profiles of modern AI agents, the Sandbox CRD establishes a uniform API boundary for running language model tool-calls, sandbox codes, and browser sessions securely on Kubernetes clusters. Almost immediately following this announcement, Google Cloud revealed preview support for the GKE Agent Sandbox in Google Kubernetes Engine versions 1.35.2+. This managed integration couples SIG Apps' spec with Google's gVisor-based container sandboxing and introduces a native SandboxWarmPool controller that slashes container cold starts to under 800 milliseconds. The move standardizes agent compute infrastructure and marks a significant shift in platform engineering away from ad-hoc virtual machine wrappers toward native Kubernetes orchestrations.

The Problem: Securely Executing Untrusted Agent Code

As autonomous AI agents shift from passive text generators to active tools capable of writing and running their own code, platform engineers face a major security bottleneck. When an agent generates a Python script to analyze a dataset or runs a shell command to patch a repository, that code must execute in an isolated environment. Executing untrusted code inside a standard Kubernetes Pod is dangerous: if an agent executes a malicious container escape payload, it could compromise the underlying node and gain access to cluster credentials.

Historically, organizations solved this using two inefficient approaches:

1. Ad-Hoc Virtual Machine Pools: Spin up micro-VMs (e.g., using AWS Firecracker or separate compute instances) for each agent run. This provides excellent isolation but incurs high overhead, with startup latencies stretching from 5 to 15 seconds.
2. Unsafe Pod Reuse: Run code within standard Kubernetes pods using namespaces for isolation. While fast, a single Linux kernel vulnerability could lead to host compromise.

The Kubernetes SIG Apps community designed the Agent Sandbox CRD to solve these issues. By standardizing sandboxing policies, Kubernetes can natively coordinate runtime isolation layers like gVisor or Kata Containers while managing pod lifecycles, file mounts, and network access boundaries under a single unified controller.

Technical Architecture of the Sandbox CRD

The Agent Sandbox model introduces a new custom resource, AgentSandbox, which sits alongside traditional workloads like Deployments and StatefulSets. Unlike standard Pods, an AgentSandbox is designed for quick provisioning, aggressive scale-to-zero configurations, and strict isolation policies.

Explaining the Sandbox Lifecycle

The lifecycle of an Agent Sandbox is managed by a specialized controller that coordinates pod templates, volume attachments, and pre-warm configurations to reduce startup delay.

When a user submits an AgentSandbox resource, the controller checks the SandboxWarmPool for a pre-initialized container running the requested base image. It binds the container, mounts the workspace directories, and boots the runtime in under a second. Once execution finishes, the container is destroyed, preventing state pollution between agent runs.

Example AgentSandbox Manifest

Below is an example of an AgentSandbox manifest targeting a GKE cluster configured with gVisor isolation and an ephemeral volume mount:

apiVersion: apps.k8s.io/v1alpha1
kind: AgentSandbox
metadata:
  name: python-executor-agent-4f2a
  namespace: agent-runtimes
spec:
  runtimeClassName: gvisor
  warmPoolRef:
    name: standard-python-311-pool
  executionTimeoutSeconds: 300
  resources:
    limits:
      cpu: "2"
      memory: "2Gi"
    requests:
      cpu: "500m"
      memory: "512Mi"
  storage:
    type: EphemeralVolume
    mountPath: /workspace
  networkPolicy:
    egress:
      # Restrict egress access only to public API endpoints
      - to:
        - ipBlock:
            cidr: 0.0.0.0/0
        ports:
        - protocol: TCP
          port: 443

GKE's Implementation: gVisor and the SandboxWarmPool

Google Cloud’s preview of GKE Agent Sandbox on version 1.35.2 represents the first major cloud provider implementation of this draft standard. Google’s design focuses on two areas: gVisor-based isolation and the SandboxWarmPool caching controller.

1. gVisor Kernel Isolation

gVisor is an open-source container sandbox that provides a user-space kernel. It intercepts all application system calls and runs them in user space, isolating the host kernel from potential escapes. In GKE, running an AgentSandbox with runtimeClassName: gvisor ensures that untrusted Python, Bash, or JavaScript run in a secure sandbox, preventing access to the underlying host.

2. SandboxWarmPool: Sub-Second Starts

The primary disadvantage of secure runtimes like gVisor is the initialization overhead. Creating a new pod, mounting volumes, and starting the sandbox engine typically takes 3 to 5 seconds—too slow for interactive AI agents waiting on tool executions.

To solve this, GKE introduced the SandboxWarmPool controller. This controller maintains a pool of pre-warmed, paused pods. When an agent requests code execution, the controller assigns a paused pod from the pool, attaches the ephemeral workspace volume, and resumes the container. This reduces cold starts from seconds to milliseconds.

Comparison: Micro-VMs vs. Kubernetes Agent Sandbox

For platform engineers choosing an isolation strategy for agent runtimes, the trade-offs between traditional Micro-VMs (like Firecracker) and the new K8s Agent Sandbox CRD are significant:

While Micro-VMs offer slightly stronger security boundaries due to hardware virtualization, the Kubernetes Agent Sandbox provides a better balance of density, scheduling convenience, and startup speed for high-volume enterprise agents.

Implications for the Agentic Ecosystem

Standardizing the runtime layer under the SIG Apps Sandbox specification will accelerate the adoption of autonomous agents in enterprise environments. By decoupling the execution runtime from the agent framework, developers can build agents using tools like LangGraph, CrewAI, or AutoGen while relying on platform engineers to provide secure execution sandboxes.

Additionally, this runtime standardization aligns with the connectivity protocols of the Model Context Protocol. By running MCP servers inside dedicated AgentSandbox instances, platform teams can safely expose internal databases to LLMs without risking host compromise. To understand how MCP is standardizing the data access layers, read our guide on MCP 1.0 and the Foundation of Agentic AI.

For architecting secure enterprise agent topologies, engineers must also coordinate these runtime sandboxes with broader system routing. For a complete guide on designing these topologies, check our technical blog on Multi-Agent Orchestration in Production.

Key Takeaways

• Standardization: SIG Apps has proposed the Agent Sandbox CRD to unify secure AI agent execution on Kubernetes.
• Active Support: GKE has previewed Agent Sandbox on version 1.35.2+, combining gVisor isolation with pre-warmed pod pools.
• Performance: The SandboxWarmPool controller reduces startup times to under 800ms, making it suitable for interactive tool execution.
• Security: gVisor intercepts system calls at the user-space level, preventing untrusted code from escaping to the host node.
• Next Steps: Platform teams can begin testing the v1alpha1 API specifications in preview channels to secure agentic code-execution nodes.

FAQ

Vatsal Shah

Technical Project Manager & Solution Architect

I write code, ship agentic systems, and advise boards from India and global HQ — 15+ years across BFSI, GCC, and Fortune-scale cloud programs. If you need architecture that survives audit, start here.

View credentials →