Skip to content

Sandboxes Aren't Optional: Runtime Isolation Patterns for Coding Agents at Scale#

AI Engineer World's Fair 2026 digest Program Core pick 29 June – 2 July 2026

Recording

Speakers: Robert Brennan (OpenHands, per abstract)

Play the recording: Sandboxes Aren't Optional: Runtime Isolation Patterns for Coding Agents at Scale

  • Why: When agents write code, run tests, make API calls, and push commits, security is a runtime isolation problem, not a prompt-engineering problem — and the isolation patterns (egress control, multi-tenant RBAC, audit) map directly onto the PM's Kubernetes and multi-tenancy concerns.
  • What: The isolation patterns OpenHands follows: Docker and Kubernetes isolation, per-agent filesystem scoping, network egress controls, RBAC for multi-tenant deployments, and full audit trails; the three most common failure modes when teams skip isolation (including an agent committing secrets to a public repo, and the opening story of an agent wiping a production database during a code freeze). Includes a live demo of 50 parallel sandboxed agents with resource limits, timeout enforcement, and graceful degradation, plus a sandbox checklist and reference Kubernetes config (from abstract only).
  • How: Container-level isolation with scoped filesystems and egress policy, per-agent identity and permissions, audit logging, and defined degradation paths when agents hit unexpected states.
  • Where applicable: Broadly applicable — the patterns are from an open project and reference configs are provided. Most valuable to teams running coding agents against real codebases in shared or production-adjacent infrastructure.