← back
From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI
Takeaway
Design agent sandbox clouds around isolation, persistent state, and the distinct performance needs of training and products.
Summary
- Tool execution lets models solve verifiable coding and math problems, but generated code must run inside a controlled environment.
- Sandboxes protect hosts and other tenants against malicious or accidental behavior, including privilege escalation and data theft.
- Research prioritizes rollout throughput, while products prioritize startup and execution latency; both require security and reliability.
- The sandbox-cloud design centers on secure runtimes, persistent disks, and orchestration across large fleets.
sandboxesagent-infrastructurecode-execution
Original description
Sandboxes unleash agents by giving them secure, fully functional computers where they can tackle diverse tasks with minimal setup. This talk explores the architectural challenges of building an agent sandbox cloud. We compare runtime isolation technologies and their trade-offs, examine persistence and storage as the next major unlock for agent capabilities, and discuss the key decisions involved in orchestrating and scaling sandboxes. Abhishek Bhardwaj works on Agent and Reinforcement Learning Infrastructure at OpenAI. He builds systems that enable large-scale model training in RL environments, as well as secure and scalable cloud sandboxes for OpenAI’s agents. Before joining OpenAI, he created Arrakis, an open-source sandbox for AI agents. Previously, he worked at Google on ChromeOS and foundational microVM technologies, and at Replit on core infrastructure and early versions of Replit Agent. Timestamps 0:00 Introduction and motivation for AI agent sandboxes 1:31 Why AI models need tools and execution environments 3:51 Product-side challenges: Security and the need for sandboxing 6:44 Comparing research vs. product sandbox requirements 8:24 Overview of the three pillars: Runtime, Persistence, and Orchestration 9:05 First principles of Linux execution: System calls and security vectors 11:15 Evaluating fork() and exec models 12:06 Understanding containers: Namespaces and cgroups 16:26 GVisor as an application kernel alternative 18:29 Hardware-level virtualization (Virtual Machines) 20:34 How VMMs (Virtual Machine Monitors) work with KVM 23:16 Evolution of modern VMMs and Rust-based safety 24:32 What defines a "microVM"? 25:43 Orchestrating microVMs via APIs 27:16 Trade-offs of microVMs (performance vs. security) 30:05 The need for persistent storage in agent sandboxes 31:40 Use cases for persistence: Reliability, long-running tasks, and research 34:36 Design choices for disk snapshotting 36:03 First principles of Linux block storage and file systems 37:25 Implementing always-on vs. explicit persistence 41:20 Scaling and orchestrating sandboxes at fleet level