A sandbox should be a boundary. Not a bet.
Building isolated AI-agent sandboxes with Firecracker microVMs — a separate kernel per sandbox, explicit network policy and a capacity-aware host fleet.
Change the isolation model.
Agent code is not ordinary application code. Shared-kernel, pod-per-conversation execution placed different sandboxes on the same host kernel. The platform needed a more explicit execution boundary while keeping sandbox creation fast.
Platform Ownership
My platform work covered the microVM execution model, host hardening, network isolation, capacity and quota accounting, fleet orchestration, infrastructure automation and workspace persistence.
Separate the control plane. Make the boundaries visible.
Account before allocating
Transactional capacity coordination and tenant quota enforcement ensure safe, non-blocking burst provisioning without cluster resource starvation.
Hardware-level boundaries
Dedicated microVM instances with separate guest kernels enforce absolute tenant isolation and prevent noisy-neighbor or privilege escalation issues.
Immutable infrastructure
Standardized base machine images and declarative Terraform definitions establish reproducible, reliable host infrastructure across multi-region environments.
A kernel for each sandbox
Firecracker microVMs provide a separate kernel per sandbox. KVM and the jailer establish the execution boundary, with per-VM cgroups and seccomp constraining resources and system calls.
No implicit network trust
Each VM receives a TAP device. Firewall controls block access to cloud metadata, the VPC and other guests, keeping sandbox execution away from infrastructure and neighboring sandboxes.
Egress is policy, not an open route
A signed-policy HTTPS egress proxy uses an exact FQDN allow-list. Outbound destinations are explicit rather than inherited from host connectivity.
Advisory-lock leader election coordinates orchestration. Direct caller-to-host routing keeps execution traffic distinct from the control-plane allocation path.
The choices behind the architecture.
A stronger execution boundary, without a slow start.
The known provisioning result sits alongside the architectural change: isolated kernels, constrained egress and explicit fleet capacity. No percentile or uptime claim is attached to this timing.