Webinar Description
Key Takeaways
- Live panel comparing container isolation technologies for AI agents and untrusted code on Kubernetes
- Technical comparison of Kubernetes Agent Sandbox, Kata Containers, gVisor and Edera runtime architectures
- Focus on shared kernel security risks and isolation boundary differences between userspace kernels, microVMs and hypervisor runtimes
- Production considerations including performance, eBPF and Falco observability, GPU isolation and fleet scale operations
About the Event
Pick Your Sandbox: Isolating AI Agents and Untrusted Code on Kubernetes is a live panel discussion scheduled for 29 October 2026. The session addresses a critical challenge facing platform teams: determining what actually isolates a container when running AI agents, untrusted code and multi-tenant workloads.
The panel examines how the term “sandbox” has taken on different meanings across the container ecosystem, and why the architectural choices behind each isolation approach determine whether a cluster contains a breach or allows it to spread.
Container Isolation Technologies
Panelists will compare four distinct approaches to container isolation: Kubernetes Agent Sandbox, Kata Containers, gVisor and Edera. The discussion covers where each technology draws its isolation boundary and how these boundaries hold up under production workloads.
A central theme is the shared kernel model that sits at the heart of container security risk. The session explains architectural differences between userspace kernels, microVMs and hypervisor-isolated runtimes, clarifying how Kubernetes Agent Sandbox relates to the underlying runtime technologies.
Production Tradeoffs
The panel addresses practical considerations teams face when selecting a sandbox technology: performance overhead, compatibility with eBPF and Falco for observability, GPU workload isolation and the challenges of operating isolation at fleet scale. Attendees will learn what to test before committing to a sandbox approach.
Who Should Attend
This session is designed for platform engineers, Kubernetes administrators and security teams responsible for running AI agents or untrusted code in containerised environments. It is particularly relevant for organisations operating multi-tenant clusters where workload isolation is a security requirement.