agent-sandbox

Overview of agent-sandbox

What it is

agent-sandbox is a Kubernetes project under SIG Apps that provides a Sandbox Custom Resource Definition (CRD) and controller. It enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and reinforcement learning (RL). The Sandbox CRD offers a declarative, standardized API for managing workloads that require a long-running, stateful, singleton container with a stable identity, similar to a lightweight single-container VM built on Kubernetes primitives. It delegates low-level container isolation to secure Sandbox Runtimes (such as gVisor or Kata Containers) by managing Pods configured to use these runtimes via RuntimeClass.

Key features

• Stable identity: Each Sandbox has a stable hostname and network identity.
• Persistent storage: Sandboxes can be configured with persistent storage that survives restarts.
• Lifecycle management: The Sandbox controller manages pod creation, scheduled deletion, pausing, and resuming.
• Extensions: Additional CRDs include SandboxTemplate (reusable templates), SandboxClaim (create Sandboxes from a warm pool), and SandboxWarmPool (pre-warmed Sandbox pool for quick allocation).

Use cases

• AI agent runtimes - Reinforcement learning (RL) environments - Any workload requiring a stateful, singleton container with stable identity and persistent storage

Getting started

Install the controller (core + extensions) with: sh kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/sandbox-with-extensions.yaml Or pin to a specific version. After installation, create a simple Sandbox: ```yaml apiVersion: agents.x-k8s.io/v1beta1 kind: Sandbox metadata: name: my-sandbox spec: podTemplate: spec: containers:

• name: my-container image: ``` For more examples, see the examples/ directory in the repository.

License and pricing

Licensed under Apache-2.0. Open source.

Based on the project's public README and repository metadata.