kubernetesPractitioner

Mastering Agent Sandbox: Running Stateful Workloads on Kubernetes

5 min read Kubernetes BlogMar 20, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

Agent Sandbox exists to address the complexities of managing singleton, stateful workloads in Kubernetes. With the rise of AI and other stateful applications, there’s a pressing need for a standardized, declarative API that simplifies deployment and management. This project, developed by SIG Apps, provides a robust framework for running these workloads while maintaining strong isolation and lifecycle management, especially for untrusted code.

At its core, the Agent Sandbox introduces a custom resource definition (CRD) that acts as a lightweight, single-container environment built entirely on Kubernetes primitives. This setup not only offers lifecycle management but also ensures stable identity for your workloads. One of the standout features is the SandboxWarmPool, which maintains a pool of pre-provisioned Sandbox pods. This effectively eliminates cold starts, allowing your applications to resume exactly where they left off. The flexibility to support different runtimes, such as gVisor or Kata Containers, enhances kernel and network isolation, making it suitable for multi-tenant environments.

In production, it’s crucial to remember that while the Agent Sandbox simplifies many aspects of running stateful workloads, you need to be mindful of the versioning when deploying. Use the provided commands to install the core components, ensuring you replace the version tag appropriately. Keep an eye on how your workloads scale and utilize the SandboxWarmPool to optimize resource usage effectively.

Key takeaways

→Utilize the Agent Sandbox for managing singleton, stateful workloads efficiently.
→Leverage the SandboxWarmPool to eliminate cold starts and improve performance.
→Implement strong isolation with runtimes like gVisor or Kata Containers for untrusted code.
→Apply the core components using the provided kubectl command with the correct version tag.

Why it matters

In production, efficient management of stateful workloads can significantly reduce resource costs and improve application responsiveness. The ability to scale idle environments to zero while maintaining state is a game-changer for resource optimization.

Code examples

Bash

1# Replace "vX.Y.Z" with a specific version tag (e.g., "v0.1.0") from
2# https://github.com/kubernetes-sigs/agent-sandbox/releases
3export
4VERSION
5=
6"vX.Y.Z"
7# Install the core components:
8kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/
9${
10VERSION
11}/manifest.yaml
12# Install the extensions components