Introduction to Kubernetes Agent Sandbox: State Persistence and Isolation Management for AI Agents

As AI workloads evolve from simple inference (AI v1) to autonomous agents (AI v2), state persistence and isolation management have become complex with existing Kubernetes resources alone. Agent Sandbox is a CRD and controller project released by Kubernetes SIG Apps to address these issues.

Limitations of Namespace Isolation and Kernel Security

Namespace provides logical separation at the API level, but it assumes that code inside the container is trusted. If an AI agent executes arbitrary code from external input, Namespace isolation alone cannot prevent escape due to the nature of containers sharing the host OS kernel. Agent Sandbox is designed to selectively apply kernel-level isolation by specifying gVisor or Kata Containers as the runtimeClassName.

Key Resources and Operation

Agent Sandbox consists of the Core API and Extensions API. The Sandbox in the Core API is a single agent execution environment that provides stable network IDs and Scale-to-Zero functionality. The SandboxWarmPool in the Extensions API pre-provisions Sandboxes to eliminate cold start latency, allowing immediate allocation via SandboxClaim.

Operational Precautions

As of March 2026, the latest release is v0.4.2, and it is still an open-source project at the v1alpha1 stage. It is built for Kubernetes 1.35 and does not guarantee operation on clusters below 1.32. Additionally, if runtimeClassName specifies gVisor but it is not installed on the node, Pods may remain in a Pending state, so caution is required.