Agent sandbox glossary
Answer in brief
Short, neutral definitions of 25 terms you will meet when comparing agent sandboxes — from isolation technologies like Firecracker and gVisor to operational ideas like cold start and egress control.
- Agent sandbox
- An isolated, disposable compute environment where an AI agent can run code, use tools and touch files without risking the host or other users.
- BYOC (bring your own cloud)
- A deployment model where the provider’s sandbox platform runs inside your own cloud account or VPC.
- Cloud Hypervisor
- An open-source, Rust-based virtual machine monitor for modern cloud workloads, governed under the Linux Foundation.
- Code interpreter
- A tool that lets a model write and execute code (usually Python) and see the output, typically for analysis, math and file conversion.
- Cold start
- The time from requesting a new sandbox to being able to run the first command in it.
- Computer use
- Agents that operate a graphical desktop or browser through screenshots, mouse and keyboard actions.
- Container isolation
- Isolation built from Linux namespaces, cgroups, capabilities and seccomp, where workloads share the host kernel.
- Egress control
- Rules that limit which network destinations code inside a sandbox can reach.
- Ephemeral sandbox
- A short-lived sandbox created for one task and destroyed afterwards, leaving no state behind.
- Firecracker
- An open-source virtual machine monitor from AWS, built on KVM, designed to run thousands of lightweight microVMs per host.
- Fork (branching)
- Creating one or more copies of a running sandbox from a snapshot so several agent attempts can proceed in parallel from the same state.
- gVisor
- An open-source application kernel from Google that intercepts a container’s system calls in user space, adding a boundary between the workload and the host kernel.
- Kata Containers
- An open-source runtime that runs each container (or pod) inside its own lightweight VM while keeping the standard container interface.
- MCP (Model Context Protocol)
- An open protocol for connecting AI applications to tools and data sources through a standard client–server interface.
- MicroVM
- A minimal virtual machine with a stripped-down device model that boots in milliseconds and gives each workload its own guest kernel.
- Pause and resume
- Suspending a sandbox so it stops consuming compute, then restoring it later with its state intact.
- Persistent (stateful) sandbox
- A sandbox whose files and configuration survive beyond a single session, often for days or indefinitely.
- Prompt injection
- An attack where instructions hidden in content an agent reads (a web page, file or issue) hijack what the agent does.
- RL environment
- A reproducible, resettable environment in which an agent takes actions and receives rewards, used to train or evaluate models.
- seccomp
- A Linux kernel feature that restricts which system calls a process may make.
- Secrets handling
- How API keys and credentials are made available to code in a sandbox without being exposed to the model or leaked.
- Self-hosted sandbox
- Running sandbox infrastructure on servers or clusters you operate, typically using open-source software.
- Snapshot
- A saved copy of a sandbox’s filesystem — and sometimes its memory and running processes — that can be restored later.
- V8 isolate
- A lightweight execution context inside the V8 JavaScript engine; many isolates can share one process with separate memory heaps.
- WebAssembly sandbox
- Running code compiled to WebAssembly in a runtime that only grants the capabilities you pass in.