GKE Agent Sandbox
https://docs.cloud.google.com/kubernetes-engine/docs/how-to/agent-sandbox
GKE Agent Sandbox is a managed GKE add-on, built on the open-source kubernetes-sigs/agent-sandbox project, that runs untrusted AI-generated code in isolated, stateful, single-replica Pods with persistent storage and kernel-level isolation via gVisor. It is used by AI agent runtimes, code interpreters, and development environments that need to execute code safely.
| Pricing model | No additional charge for Agent Sandbox; standard GKE resource pricing (per-second, vCPU/memory/storage) applies |
|---|---|
| Pricing The headline compute price as the provider states it. Sorting ranks prices stated per vCPU over time, converted to hourly. Other pricing models sort after, unranked. | No Agent Sandbox surcharge; standard GKE vCPU/memory/storage rates apply (see GKE pricing) |
| Free while idle Whether a stopped, paused, or sleeping sandbox costs nothing. | ✕ |
| Elastic Resources flex with what the sandbox actually uses, and the bill follows: yes when the provider bills on active or observed use, no when capacity is reserved or allocated and billed while it runs. | – |
| Memory snapshots Whether RAM state survives a pause and resume, not just disk. | ✓ |
| Wake on request Whether a stopped sandbox wakes automatically on inbound traffic. | ✕ |
| Start / resume Typical time from create or resume to running. Sorting ranks stated times, converted to seconds; claims with no figure sort after, unranked. | ~200 ms typical (90% of allocations under 200 ms; up to 300 sandboxes/sec/cluster; pre-warmed pods enable sub-second creation) |
| Max runtime The longest a sandbox may run. | Configurable TTL (no fixed maximum documented) |
| Isolation The isolation technology between sandboxes. | gVisor (also supports Kata Containers and other OCI-compatible runtimes; runtimeClassName: gvisor) |
| GPUs Whether GPU instances are available for sandboxes. | ✓ |
| Docker Whether Docker containers can run inside the sandbox. | ✓ |
| SDKs | Python, Go |
✓ yes · ✕ no · – no cited public fact.
GKE Agent Sandbox implements a Default Deny network security posture for all sandboxed environments.
Sources
- https://docs.cloud.google.com/kubernetes-engine/docs/how-to/agent-sandbox
- https://docs.cloud.google.com/kubernetes-engine/docs/how-to/how-install-agent-sandbox
- https://agent-sandbox.sigs.k8s.io/docs/
- https://github.com/kubernetes-sigs/agent-sandbox
- https://www.infoq.com/news/2026/05/gke-agent-sandbox-hypercluster/
- https://cloud.google.com/blog/products/containers-kubernetes/bringing-you-agent-sandbox-on-gke-and-agent-substrate
- https://docs.cloud.google.com/kubernetes-engine/docs/concepts/machine-learning/agent-sandbox
- https://github.com/kubernetes-sigs/agent-sandbox/issues/694
- https://docs.cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods
- https://cloud.google.com/kubernetes-engine/pricing
- https://gvisor.dev/docs/tutorials/docker-in-gke-sandbox/
- https://cloud.google.com/blog/products/containers-kubernetes/reduce-your-agents-costs-with-gke-agent-sandbox
- https://docs.cloud.google.com/kubernetes-engine/docs/how-to/agent-sandbox-pod-snapshots
Last verified 2026-08-09. Corrections land through the update log.