Kubernetes Agent Sandbox
Open-source Kubernetes controller and CRDs for isolated, stateful sandbox pods for AI agents, with first-class support on GKE. The leading open, Kubernetes-native way to self-host agent sandboxes, especially on GKE.
Overview
Agent Sandbox is a Kubernetes SIG Apps project that adds Sandbox, SandboxTemplate, SandboxClaim and SandboxWarmPool resources for running isolated, singleton, stateful pods for agents. Warm pools hand out pre-started sandboxes on demand.
Isolation comes from whatever sandbox runtime your cluster uses; on GKE that is gVisor (GKE Sandbox) or microVMs, with Pod snapshots for suspend and resume.
Notable
- v1.0 released; latest v1.0.10 published 2026-11-06.
- Default-deny network policy for templated sandboxes.
Kubernetes Agent Sandbox specifications
| Attribute | Details |
|---|---|
| Isolation | Delegates to the cluster RuntimeClass — typically gVisor or Kata Containers. On GKE: GKE Sandbox (gVisor) or microVMs. Without a sandbox runtime, pods have only container isolation |
| Deployment | Open-source project · BYOC available · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | Kubernetes CRDs, Python, kubectl |
| Cold start (vendor claim) | GKE docs: under one second with a SandboxWarmPool |
| Max session length | Not documented |
| Persistence | Persistent storage across restarts; pause/resume lifecycle. On GKE, Pod snapshots (gVisor only, may be preview) |
| GPU | On GKE, GPUs and TPUs with the gVisor runtime on supported models |
| Networking | Default-deny NetworkPolicy created per SandboxTemplate |
| Pricing | Free and open source; you pay for the underlying cluster compute |
| Free tier | Open source |
| Compliance | Not documented |
| Regions | Any Kubernetes cluster; any GKE region |
Facts from Kubernetes Agent Sandbox’s public documentation, verified November 8, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You already run Kubernetes and want sandboxes inside your own cluster
- You need GPUs or TPUs alongside sandboxing (on GKE with gVisor)
- You want an open, vendor-neutral API
Trade-offs
- You operate the controller, runtime and cluster yourself
- Isolation is only as strong as the RuntimeClass you configure
- More moving parts than a hosted SDK
Best for: Platform teams that want to run agent sandboxes on their own Kubernetes or GKE clusters.
Where Kubernetes Agent Sandbox ranks
How Kubernetes Agent Sandbox compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Kubernetes Agent Sandbox | gVisor or Kata | Yes | Yes / Yes | <1 s (warm pool) | Not documented | Yes / Yes | Yes | Kubernetes CRDs, Python, kubectl |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Daytona | Containers or VMs | No | Not documented / Yes | <90 ms | Unlimited | Yes / Yes | Yes | Python, TypeScript, Ruby, Go, Java |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Northflank Sandboxes | Cloud Hypervisor microVM | No | No / Yes | <1 s | Unlimited | Not documented / Yes | Yes | JavaScript/TypeScript, Python |
Frequently asked questions
What is Kubernetes Agent Sandbox?
How does Kubernetes Agent Sandbox isolate code?
Is Kubernetes Agent Sandbox open source?
How much does Kubernetes Agent Sandbox cost?
What are the best Kubernetes Agent Sandbox alternatives?
Sources
Cite this page
Agent Sandboxes. (2026). Kubernetes Agent Sandbox. agentsandboxes.org. Last reviewed November 8, 2026. https://agentsandboxes.org/sandboxes/gke-agent-sandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.