Secure AI Agent Sandboxing With OpenStack Zun and Kata Container
Talkat KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China 2026 · 2026-09-07..09-09·
summary
A secure sandbox built natively on OpenStack runs hundreds of ephemeral Kata-backed containers managed by Zun, using Glance for images and Neutron for tenant-isolated networking, and integrates with an agent platform for heterogeneous GPU scheduling and dynamic skill discovery. Cold sandbox create P50 is ~5s while warm pool P50 0.1s (P99 0.2s) and 85% warm-pool hit reduces latency; runtime overhead is ~5% vs bare metal. Image injection, SNAT-only egress, strict cross-plane proxying, and TTL-enforced teardown are implemented and production-proven.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:01AI agents need sandboxing
- 3:53OpenStack and Kata Containers
- 5:44System architecture
- 7:10Zun over Nova and Docker
- 8:36Hardware isolation with Kata
- 10:19Network isolation design
- 13:12Image lifecycle and injection
- 14:36Sandbox state machine and failures
- 15:42Warm pool optimization
- 17:28End-to-end request flow
- 19:17AI agent platform integration
- 21:05Python SDK and Jbox client
- 22:32MCP server integration
- 23:17Sandbox agent skill enforcement
- 23:40Performance benchmarks
- 26:07Lessons learned
- 27:14Future plans
- 27:35Q&A
related talks
29mSandbox for Agentic Application With Cloud Native Stack
07mLightning Talk: Production-Grade AI Isolation: K0s + Kata Containers for Zero-Tru...
14mTaming Agentic AI: Run Rogue Code Safely on Kubernetes with Agent Sandbox
34mZero Secrets: Building Secure Infrastructure for AI Agents
25mAgentic Zero Trust: at Rest, in Transit, and at Runtime
32mLLMs Behind Bars: Sandboxes at Scale for AI on a Short Leash
19mSandbox to confidential containers: A brief on the evolution of container isolation
40mArrakis: How To Build An AI Sandbox From Scratch