The safeguards map / 3.1 Execution sandboxes
Agent Sandbox
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A Kubernetes Sandbox resource and controller for isolated, stateful workloads such as AI agent runtimes, delegating isolation to runtimes like gVisor or Kata Containers.
Where it sits
3.1 Execution sandboxes (primary): Manages single-pod sandboxes for agent runtimes through a Sandbox resource and delegates low-level isolation to secure runtimes such as gVisor or Kata Containers.
It delegates low-level container isolation to secure
captured
Isolated environments for executing untrusted, LLM-generated code.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- agent
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
- Can the agent bypass it
- depends
Handoffs
None recorded. A mapped entry with no handoff is here for its foundation home.
Collector's note
A Kubernetes SIG project with no CNCF page of its own; home and maturity are Kubernetes' (Graduated), sourced by that page plus the repository's statement that the project sits under a Kubernetes SIG. The project calls itself a sandbox orchestrator, and the isolation boundary comes from the runtime the owner selects.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.