AI agents write code and run it, and reinforcement learning rollouts run model-written commands by the thousand. That code is untrusted: it may run as root, try to escape, scan the network or exhaust resources. So the first question for the sandbox that runs it is: what isolates it?

The short version:

For untrusted code, use microVMs (Firecracker, for example). Each sandbox has its own kernel, and what it can attack is a handful of virtual devices rather than every system call of the host kernel. The cost: you need KVM, and every VM carries a guest kernel and its memory.

Without KVM (an ordinary cloud VM without nested virtualization) but wanting more than a container, use gVisor. It implements a Linux-compatible kernel in user space and needs no hardware virtualization. The cost: compatibility, and performance for system-call-heavy work.

For trusted code, GPUs, or the highest density, use containers.…