For those running AI agents in production on Kubernetes, what isolation boundary are you actually using between agents? Most deployments seem to place them in ordinary pods, which works well for conventional services, but an agent's next action can come from a model, tool output, or untrusted web content. That makes the shared host kernel a potentially important boundary between the agent, the node, and neighboring workloads.
This becomes more concerning in multi-agent workflows where planners, researchers, and executors share files, credentials, or runtime access. Our team currently uses one microVM per agent with Kata so each agent gets its own kernel. I'm interested in how others are approaching this: gVisor, Kata, Firecracker, sandboxed runtime classes, strong namespaces and policies, or something else? What level of startup time and resource overhead would you accept for VM-level isolation per agent?
6 Answers
The isolation layer should not be your only defense. Use least-privilege RBAC, narrowly scoped cluster roles, network policies, and service-level controls so a compromised agent cannot access unrelated workloads or cluster resources. Namespaces alone are not a strong security boundary.
Agent Sandbox is worth evaluating because it provides an abstraction over multiple isolation backends, including gVisor and Kata Containers. That lets you choose based on the workload’s security and performance requirements instead of tying the platform to one runtime.
Kata with Firecracker-style microVM isolation seems like a reasonable direction for stronger boundaries. In testing, gVisor can run into syscall and filesystem edge cases with agent tooling, while microVM startup can stay below a second if snapshots or warm pools are tuned. Plain namespaces feel insufficient when agents execute untrusted or model-generated actions.
There are several newer projects taking different approaches to this, including Agent Sandbox, OpenShell, and Agent Substrate. The space is still changing quickly, so practical testing against your own workloads is probably more useful than picking a winner based on architecture diagrams alone.
I’ve had a pretty good experience with OpenShell so far.
It’s also worth questioning whether every agent needs unrestricted OS access or a long-lived environment. Code execution can be exposed as an ephemeral tool with no host access, outbound requests can pass through a controlled gateway, and credentials can remain inside the tools rather than being handed to the agent. Making the agent itself relatively powerless often reduces the impact of a prompt injection or compromised tool.
A hardened platform approach can go beyond just installing an operator. LLMSafeSpaces, for example, focuses on read-only hardened base images while still allowing system packages to be installed. It currently supports a limited set of agent harnesses, but the model could be useful for teams that want stronger image and runtime controls.
The tradeoff depends heavily on the workload. More substantial workloads may not benefit from checkpointing in the same way as lightweight ones, so it’s worth measuring boot time, memory use, and snapshot behavior with the actual tools you plan to run.