Google Kubernetes Engine (GKE) Agent Sandbox provides kernel-level isolation for untrusted model-generated code by using gVisor. By combining GKE Agent Sandbox with Filestore agent volumes, you can deliver secure, isolated environments backed by persistent, high-density file storage.
This guide demonstrates how to configure a gVisor-enabled node pool, define a
SandboxTemplate with Filestore volume claim templates,
pre-warm sandboxes with SandboxWarmPool, and claim sandboxes with
SandboxClaim.
Before you begin
Complete the cluster and CSI driver setup in Set up GKE environment for Filestore agent volumes.
Create a gVisor-enabled node pool
Create a dedicated node pool configured with gVisor sandbox isolation:
gcloud container node-pools create gvisor-pool \
--cluster=CLUSTER_NAME \
--location=REGION \
--project=PROJECT_ID \
--image-type=cos_containerd \
--sandbox=type=gvisor \
--num-nodes=2 \
--machine-type=n2-standard-16 \
--enable-autoscaling \
--min-nodes=1 \
--max-nodes=10 \
--scopes=cloud-platform
Replace the following:
CLUSTER_NAME: the name of your GKE cluster.REGION: the region where the cluster resides.PROJECT_ID: your Google Cloud project ID.
Create a SandboxTemplate
Define a SandboxTemplate manifest named warmpool-filestore-template.yaml.
The template configures gVisor runtime settings, non-root security contexts,
and a volumeClaimTemplates block targeting the volume-pool-sc StorageClass:
apiVersion: extensions.agents.x-k8s.io/v1alpha1
kind: SandboxTemplate
metadata:
name: warmpool-filestore-template
namespace: default
spec:
podTemplate:
spec:
runtimeClassName: gvisor
automountServiceAccountToken: false
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
nodeSelector:
sandbox.gke.io/runtime: gvisor
tolerations:
- key: "sandbox.gke.io/runtime"
value: "gvisor"
effect: "NoSchedule"