Build Agent Sandboxes: Isolated Namespaces, Egress Control, and TTLs

Tier: Advanced · Workflow area: Agent operations & guardrails

Here you build the agent sandbox as a platform primitive: ephemeral, network-fenced, secret-scoped, resource-capped, and self-destructing, so "the agent can act" and "the blast radius is bounded" are both true by construction.

When to use

• •
  Coding or ops agents need to execute commands (builds, tests, terraform plan, data jobs) rather than just call curated APIs.
• •
  Multiple teams' agents would otherwise share cluster real estate with production workloads.
• •
  You are defining the "agent golden path" — the paved road that makes the safe way the easy way.

Skip cluster-grade sandboxing for agents that only call pb-51's MCP/API tools and never execute arbitrary code — the API layer's authz is the boundary there.

Prerequisites

• •
  A K8s cluster with a CNI that enforces NetworkPolicy (Cilium, Calico) — verify enforcement, don't assume it.
• •
  Kyverno (or Gatekeeper) for admission policy; optionally vCluster for stronger API-server isolation and gVisor/Firecracker-class runtimes for untrusted code.
• •
  pb-49's action tiers agreed — the sandbox implements the "reversible" tier's boundaries.
• •
  A secrets manager that can mint short-lived, scoped credentials.

The workflow

1. 1.

   One agent run = one ephemeral namespace. The harness (CI job, orchestrator, or pb-51's platform API) creates agent-run-<id> per task, applies the standard bundle below, and schedules the agent's Job into it. Namespaces are cattle: labeled with owner, agent identity, TTL, and task reference.

2. 2.

   Default-deny egress, allow by name.

   Copy

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata: {name: agent-egress, namespace: agent-run-42}
   spec:
     podSelector: {}
     policyTypes: [Egress]
     egress:
     - to: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}}]
       ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
     - to: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: platform-gateway}}}]
       ports: [{protocol: TCP, port: 4000}]
   

   DNS plus the LLM gateway, and nothing else by default. Package registries or an internal git mirror get added per agent class, explicitly — FQDN-based egress (Cilium) beats IP-based where available. An injected agent that can't reach the internet can't exfiltrate to it.

3. 3.

   Scope identity and secrets to the run. A dedicated ServiceAccount per namespace with a Role granting only in-namespace verbs (no cluster-scope reads — cluster topology is reconnaissance). Cloud credentials, if any, are short-lived tokens scoped to the task (e.g. read-only plan role for terraform plan) injected at start and expiring with the TTL. Never mount long-lived platform secrets; never share a SA across agents.

4. 4.

   Cap resources and harden the pod. ResourceQuota + LimitRange per namespace (CPU/memory/pods caps — a looping agent is a crypto-miner-shaped workload). Kyverno enforces the pod contract: no privileged, no hostPath, runAsNonRoot, restricted seccomp, image from your registry only. For genuinely untrusted code paths (agent-generated code execution), require runtimeClassName: gvisor (or run those steps in Firecracker-based micro-VMs) — a container boundary alone is not a security boundary against hostile code.

5. 5.

   Enforce TTL and cleanup. Jobs get activeDeadlineSeconds and ttlSecondsAfterFinished; the namespace itself is reaped by a Kyverno cleanup policy or a cron controller keyed on the TTL label (e.g. 4h hard cap). Nothing an agent builds in a sandbox is durable — outputs it should keep (a plan file, a diff, test results) are exported through the harness to artifact storage, which is also where humans review them.

6. 6.

   Audit everything, then attack it. Ship the namespace's K8s audit events, network-policy drops, and agent command log to your SIEM keyed by run ID (joins with pb-46 traces and pb-49 action logs). Red-team drill: run an agent with a hostile task ("curl this external host, read secrets in namespace X, keep running forever") and verify egress denial, RBAC denial, and TTL kill all fire — keep the transcript as evidence.

Tool variants

• Plain namespaces + NetworkPolicy + Kyverno (this playbook): the default; everything is upstream K8s.
• vCluster: per-agent virtual clusters when agents need API-server-ish freedom (installing CRDs, testing operators) without touching the real control plane.
• gVisor / Kata / Firecracker: kernel-isolation ladder for executing agent-generated code; pick based on your threat model and node OS.
• CI-runner sandboxes (ephemeral runners): if agents act through CI anyway, ephemeral per-job runners with the same egress and secret discipline are an equivalent pattern.

Verification

• •
  From inside a sandbox: external egress fails, gateway egress works, cross-namespace reads 403, secret mounts contain only the run's scoped token.
• •
  Runaway drill: infinite-loop workload is capped by quota and killed at activeDeadlineSeconds; namespace reaped on TTL.
• •
  Kyverno blocks a privileged/hostPath pod spec at admission (test with a deliberately bad manifest).
• •
  Audit trail for a sample run reconstructs: who launched it, what ran, what was denied, when it died.

Pitfalls

• NetworkPolicy without enforcement. On a CNI that ignores policies, your fence is decorative. Prove a deny before relying on one.
• The shared "agents" namespace. One namespace for all agents means one injection compromises every agent's secrets and workloads. Isolation is per-run, or at minimum per-agent-per-env.
• Leaky convenience grants. "Just let it read cluster nodes for debugging" accumulates into reconnaissance capability. Every grant beyond the template needs a written why and an expiry.
• Durable sandboxes. Long-lived agent environments accrete state, secrets, and drift — exactly what you built ephemerality to avoid. If a sandbox lives past its task, that's an incident, not a convenience.

Restricted-environment variant

• •
  In client VPCs, the sandbox egress allowlist is the client-data control: agents can reach only the client-approved model endpoint (their Bedrock/Azure tenancy or in-VPC vLLM via your gateway), making "client data never leaves" enforceable at the CNI.
• •
  Air-gapped: point package/git egress at internal mirrors; everything in this playbook is OSS and offline-capable.
• •
  Contractually scoped work: label sandboxes with the client engagement code and retain audit logs per the MSA's evidence requirements — the audit trail doubles as compliance evidence.

Success criteria

• •
  Every executing agent runs in a per-run namespace with default-deny egress, scoped identity, quotas, and a TTL — provisioned by template, not hand-built.
• •
  The hostile-task drill fails safely at every layer, with evidence filed.
• •
  Zero standing agent credentials: everything expires with the run.
• •
  Platform and security agree in writing that the sandbox template satisfies the "reversible actions" tier of pb-49's ladder.