Toss Designs Agent Platform for Network-Segmented Environments: Ensuring Task Continuity via bubblewrap Isolation and Session State Persistence

• Designed a structure that executes agent code in a sandbox and permits only the file and system access required for tasks, tailored to network segmentation requirements
• Used bubblewrap inside Kubernetes Pods to configure per-harness Linux namespaces, isolating file mounts and network communication at the process level
• Stored work files and conversation states in Persistent Volumes to enable resuming sessions in the same harness after Pod replacement and continuing previous analysis criteria
• Enhanced security by not passing authentication information directly to the harness, instead substituting header placeholder values with actual keys through the OpenSandbox authentication proxy

Isolation and Access Control Methods

• Harnesses run as users with reduced privileges and have capabilities removed to prevent changes to isolation settings
• Network is isolated from the Pod, and requests are routed only through the Runtime HTTP proxy via a dedicated Unix domain socket
• The Runtime proxy inspects request destinations, and the OpenSandbox egress policy further restricts access to business services

Session Management and Record Structure

• Conversations for the same agent share work files, but conversation states are stored separately per Session
• Upon session resumption, the harness directly reads the unique state file it saved to process the next request
• A common execution record in OpenResponses format is used for history lookup and task handover to other harnesses