# Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi

DevFeed: [Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi](<https://devfeed.tech/articles/kubernetes-agent-sandbox-what-it-is-and-how-to-deploy-it-with-pulumi-19011.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/kubernetes-agent-sandbox/>)

Author: Adam Gordon Bell

Published: 2026-07-21T00:00:00Z

Content type: tutorial

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [gcp](<https://devfeed.tech/tags/gcp.md>), [gke](<https://devfeed.tech/tags/gke.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [pulumi](<https://devfeed.tech/tags/pulumi.md>), [security](<https://devfeed.tech/tags/security.md>), [tutorials](<https://devfeed.tech/tags/tutorials.md>)

## AI overview

This tutorial explains Kubernetes Agent Sandbox, a Kubernetes resource for running coding agents in disposable, kernel-isolated environments using gVisor or Kata Containers. It describes common deployment patterns and shows how to deploy the sandbox on GKE with Pulumi.

## Source excerpt

When you use a coding agent, it can seem like there's a trade-off between autonomy and permissions. If you approve every command, it's safe but slow. Let it do whatever it likes and it works more autonomously, but as the nx supply-chain attack showed, that can go badly. The fix is to give the agent a sandbox: a box it's allowed to wreck, with limited permissions and scoped network access. The only files are the checkout you handed it, the only credentials are the task's own, and trashing the machine just means a disposable pod gets garbage-collected early. Pulumi Neo works this way, and if you want to scale that pattern up inside your own organization, the Kubernetes project Agent Sandbox is a great path to building your own. This post is what it is and how to deploy it on GKE with Pulumi. What is Agent Sandbox? Agent Sandbox is a Kubernetes SIGs project that gives AI agents isolated, disposable environments as Kubernetes resources: a Sandbox custom resource, backed by gVisor or Kata Containers for kernel-level isolation. You could build Agent Sandbox yourself. You'd need gVisor support, a userspace kernel that sits between the agent's code and your host. With that in place, you could approximate a sandbox for every agent by stringing together a StatefulSet of size one, a headless Service, and a PersistentVolumeClaim, plus some lifecycle machinery to keep warm pools of nodes around. Agent Sandbox wraps all of that up as a CRD, so you can run a Kubernetes cluster where each sandbox is a disposable, kernel-isolated environment a coding agent runs in. apiVersion: agents.x-k8s.io/v1beta1 kind: Sandbox metadata: name: demo-sandbox spec: podTemplate: spec: runtimeClassName: gvisor containers: - name: agent image: ubuntu:24.04 # swap in your coding-agent image command: ["sleep", "infinity"] The Sandbox CRD, the whole idea in one manifest. There are two common patterns for using it. In the first, every coding agent session in the organization maps to its own pod with a pers