Kubernetes Agent Sandboxes: Security Hardening with gVisor, NetworkPolicy and Pod Security
12 min read6.8k
Run untrusted agent-generated code in Kubernetes with a layered sandbox: gVisor runtime isolation, restricted Pod Security, default-deny networking, quotas and admission policy that enforces all of it.