Isolating AI Agent Execution Environments on AWS EKS: A Guide to Configuring Agent Sandbox and gVisor

As the development of AI agents within organizations increases, security risks associated with running unverified code on shared clusters have emerged. To address this, we present design principles and configuration methods for isolating execution environments by combining Amazon EKS, Agent Sandbox, and gVisor.

Agent Sandbox Architecture and Resources

Agent Sandbox is an open-source project managed by Kubernetes SIG Apps that declaratively manages isolated environments for executing code generated by AI agents. The core concept involves a controller managing the lifecycle through the Sandbox custom resource and specifying strong isolation runtimes like gVisor or Kata Containers via RuntimeClass.

The key resource components are as follows:

• Sandbox: Manages the lifecycle of a single Pod, headless Service, and PVC
• SandboxTemplate: Includes Pod specifications, security defaults, and NetworkPolicy
• SandboxWarmPool: A pool of pre-launched standby Sandboxes
• SandboxClaim: A request to allocate a Sandbox from the Warm Pool

Test Environment and Installation Order

The tests were conducted based on an EKS 1.36 cluster and Agent Sandbox v1.0.5. The installation process involves creating a dedicated gVisor node group, registering the RuntimeClass, and then enabling NetworkPolicy in the VPC CNI. The sandbox-router is deployed as a Go implementation, acting as a reverse proxy that forwards requests to the corresponding Sandbox Pod.

Isolation Effects and Performance Comparison

Comparing runc sandboxes and gVisor sandboxes under identical security checks and performance measurements revealed that gVisor mediates host kernel access and reduces file system exposure. The failure of kubectl port-forward is due to the absence of a connection socket on the host side, resulting from gVisor's user-space kernel structure (Sentry); this is a structural characteristic rather than an access control issue and can be bypassed via the router.

When executing untrusted code, Pod Security settings and controller defaults block most threats, while gVisor provides an additional kernel isolation layer to minimize the attack surface. Part 2 will cover NetworkPolicy, DNS, Warm Pool operations, and strategies for optimizing isolation costs.