GKE Sandbox (gVisor and microVM)
Google Kubernetes Engine's sandboxed Pods for untrusted and agent-generated code: gVisor, or (GA since 2026-10-07) Kata Containers microVMs on Cloud Hypervisor.
Tags
Description
Two isolation types on GKE: gVisor (user-space kernel intercepting syscalls; start under ~200 ms) and microVM (each Pod in its own lightweight VM with a full Linux guest kernel, via Kata Containers and the Cloud Hypervisor VMM; fixed overhead of 250 mCPU and 130 MiB per Pod, start in about 1–2 s). The microVM type became generally available on 2026-10-07 for clusters on 1.37.0-gke.4713000 and later; Google names AI agent runtimes as a target use case. MicroVM node pools need nested virtualization enabled; see the how-to guide for node pool and Pod settings. Billed as normal GKE compute; the underlying Kata Containers and gVisor are open source.
Related
- gVisor: Google's application kernel for containers that intercepts syscalls in user space, giving untrusted (e.g. agent-generated) code a stronger sandbox.
- Agent Sandbox (Kubernetes SIG Apps): Kubernetes CRD and controller for isolated, stateful, singleton sandbox pods for agent runtimes and RL, with templates, claims and warm pools.
- Firecracker: AWS's open-source virtual machine monitor for secure, fast-booting microVMs; the isolation layer under many agent code sandboxes.
Sources
- https://docs.cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods
- https://docs.cloud.google.com/kubernetes-engine/docs/release-notes
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)