GitHub - kubernetes-sigs/agent-sandbox: agent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes.

kept by eddie may 26

Kubernetes SIG Apps introduces agent-sandbox, a CRD and controller for managing isolated, stateful, singleton workloads like AI agent runtimes.

A field guide to sandboxes for AI
Sandboxing tools for AI agents differ fundamentally by boundary (containers, gVisor, microVMs, Wasm), not just by policy, and picking the wrong one creates either leaks or excessive cost.
also on gVisor, Kubernetes, #ai-agents, #developer-tools
How we contain Claude across products
Anthropic details how it contains AI agent blast radius across three products using sandboxes, VMs, and human-in-the-loop controls, while documenting missed risks like pre-trust code execution and user-mediated prompt injection.
also on gVisor, #ai-agents, #software-engineering, #developer-tools
When does MCP make sense vs CLI?
The Hacker News discussion weighs the trade-offs between MCP and CLI for AI agent tool calling, finding that each has valid use cases depending on context.
also on Kubernetes, #ai-agents, #software-engineering, #developer-tools
GitHub - clawkwork/clawk at console.dev
clawk gives coding agents their own disposable Linux VM, letting them install packages and run code while keeping host files, keys, and network strictly isolated.
also on Kubernetes, #open-source, #software-engineering, #developer-tools