Core CRDs: SandboxTemplate and SandboxWarmPool under the agents.x-k8s.io API enable pre-configured, hardened sandboxes and a pool of warm sandboxes for sub-second claim.

Intro: Autonomous AI agents require fast, isolated execution; traditional pods risk kernel escapes and slow startup when running code-generating agents.

Sub-second park-and-resume with Pod Snapshots: GKE Pod Snapshots serialize a running sandbox’s memory, heap, and filesystem to GCS, suspend the pod, and restore state to resume with zero or minimal reinitialization.

Production architecture checklist: Enforce egress zero-trust via ClusterNetworkPolicy, use short-lived execution-scoped tokens, separate orchestrator from sandbox, enable OpenTelemetry tracing for end-to-end latency visibility.

Solution overview: GKE Agent Sandbox provides kernel-level isolation via gVisor (and Kata Containers) with a declarative Kubernetes API for isolated, stateful, single-replica agent execution, now GA on GKE.

Conclusion: The combination of SandboxTemplate, SandboxWarmPool, gVisor, and Pod Snapshots enables safe, fast, and scalable execution for autonomous agents without exposing the cluster to risk or prohibitive costs.

Example workflow: Using k8s-agent-sandbox SDK to claim a sandbox, execute untrusted code, suspend with snapshot, wait for human approval, resume from snapshot, and continue execution with preserved state.

Problem space: Standard Kubernetes uses a shared host kernel via cgroups/namespaces, creating risks of privilege escalation, state bleed, and latency from cold starts; per-task VMs are too slow and expensive.

SandboxTemplate specifics: Enforce gVisor runtime, disable mounting of API credentials, strict securityContext, hard resource quotas to prevent fork-bombs/DoS.

Golden-Snapshot Warm Pools: Pre-import heavy libraries and caches into a memory snapshot to jump straight into running code upon resume.

SandboxWarmPool behavior: Keeps a minimum number of pre-warmed sandboxes ready for instant claims, with defined max sandboxes.