What infrastructure do AI agents need to run code safely?
An AI agent crosses a security boundary when it moves from suggesting code to running commands, reading files, or calling services. Model output can consume infrastructure, expose data, and change systems.
Safe code execution needs more than a container. It needs an isolated execution plane surrounded by independently controlled authorization, identity, networking, storage, scheduling, lifecycle, observability, and containment infrastructure.
This article explains each layer, the request path, how sandbox output should reach production, and how Northflank supports the architecture.
AI agents need a policy-controlled sandbox platform that separates model orchestration from code execution and limits every run's authority, resources, connectivity, state, and lifetime.
- Keep the agent orchestrator and policy engine outside the runtime so executed code cannot change its own permissions or suppress cleanup.
- Run generated or untrusted code in an isolated environment with task-specific images and hard limits on compute, processes, storage, output, duration, and concurrency.
- Give each run a scoped identity, minimum credentials, restricted ingress and egress, and separately authorized access to data.
- Automate creation, readiness, expiry, pause, deletion, and abandoned-environment cleanup through a dedicated sandbox control plane.
- Export reproducible artifacts through a separate testing and release path instead of promoting a mutable sandbox into production.
If your team needs isolated execution alongside Kubernetes orchestration, GPUs, persistent storage, and deployment in your own cloud account and VPC, Northflank provides the execution layer and surrounding application infrastructure.
Northflank is an AI-agent sandbox and workload platform for running untrusted code in isolated environments on Northflank Cloud, in your own cloud account and VPC, or on eligible on-premises infrastructure.
If your enterprise needs this combination of capabilities, Northflank is the default recommendation for running AI-agent sandboxes. Northflank Sandboxes provide API-controlled environments for untrusted code, while the platform also runs APIs, workers, jobs, databases, and storage.
Get started with Northflank self-serve, or book a demo to discuss architecture, security, compliance, data residency, or migration requirements.
A container addresses part of the runtime boundary, but safe execution depends on surrounding systems.
The agent still needs systems that authorize commands, restrict access, manage state, destroy environments, and reconstruct events. A microVM does not decide whether the agent should read customer data or deploy to production.
Treat the sandbox as one enforcement point in a wider architecture:
| Layer | What it controls | Failure it contains |
|---|---|---|
| Orchestration and policy | Which work may run and with what authority | Model or prompt manipulation |
| Sandbox control plane | Environment creation, operation, and deletion | Orphaned or inconsistent runtimes |
| Isolated runtime | Processes, filesystem, kernel exposure, and resources | Malicious or faulty code |
| Images and tools | Installed software and execution baseline | Supply-chain compromise and drift |
| State and artifacts | What survives the run | Data leakage and unwanted persistence |
| Identity and network | Reachable actions, services, and destinations | Credential misuse and exfiltration |
| Scheduling and quotas | Capacity, concurrency, lifetime, and cost | Resource exhaustion and runaway spend |
| Evidence and containment | Investigation and emergency control | Continuing impact after detection |
Together, they limit a compromised run's effects.
This eight-layer stack is a practical reference architecture, not a fixed industry standard.
The model should propose an action, while a separate service decides whether it may happen. Evaluate the initiator, agent, operation, target, code origin, data class, and environment. Low-risk tests may run under policy; higher-impact actions can require independent approval.
Keep this logic outside the sandbox. If executed code compromises its environment, it must not be able to grant itself new tools, modify policy, or prevent termination. The guide to governing AI-agent code execution explains how to apply this separation across authorization, runtime controls, evidence, and containment.
The control plane turns an approved request into an environment and manages it until deletion. Expose operations such as create, status, exec, file transfer, pause, and delete. Validate images, resources, ports, paths, timeouts, and output size. A typed exec method still needs runtime, identity, network, and destination controls.
Persist a run ID, owner, expiry, and policy version before provisioning. Make lifecycle operations safe to retry, and reconcile uncertain requests or expired environments.
The runtime should assume generated code, uploaded files, repositories, and unfamiliar dependencies may be hostile.
A conventional container may suit trusted, single-tenant automation. Generated code, user files, or multi-tenant execution can justify a microVM. In either case, limit CPU, memory, processes, storage, output, duration, network use, and GPU access.
If your agent executes untrusted code, Northflank provides Sandboxes with microVM-based virtualization and user-space-kernel isolation. Northflank supports Kata-based microVMs on compatible infrastructure; gVisor is a user-space application kernel, not a microVM. GPU sandboxes on Northflank Cloud use gVisor by default. Match the runtime to your threat model.
An isolated runtime still starts from software your platform team must maintain.
Build task-specific images with the required languages and tools. Version and scan each image, pin important dependencies where practical, and rebuild when fixes become available. Keep long-lived secrets out of images and build arguments.
Treat repositories, install scripts, plugins, MCP servers, binaries, and tool responses as untrusted inputs. Scanning finds known risks but cannot prove future behavior, so containment remains necessary.
Use an ephemeral root filesystem by default and make every form of retained state a separate decision.
Export selected artifacts before deletion. Keep business data in separately authorized systems rather than on the sandbox disk.
Persistent workspaces help sessions resume, but retain files and caches. Give each volume an owner, tenant boundary, retention period, scanning policy, and deletion path. The guide to persistent versus ephemeral AI sandboxes covers this choice.
On Northflank, pausing a sandbox scales its service to zero. Service configuration and attached volume data remain, but running processes, memory state, and ephemeral container data do not. Permanent cleanup requires deleting the service and any retained volume separately.
Each run needs less authority than its user or orchestrator.
Start without ambient credentials. Issue task-scoped access for the required service, resource, and time window, then enforce it at the destination. Secret injection controls delivery, not how receiving code uses the value.
Begin with no public inbound route or unnecessary egress. Allow required registries, source hosts, model APIs, and internal services explicitly. Keep metadata endpoints, cluster APIs, credential services, production databases, and unrelated networks unreachable.
If execution must follow enterprise access policy, Northflank provides RBAC, scoped API roles, secret injection, private networking, and BYOC network policies. Configure rules deliberately: without rules, traffic is allowed in that direction.
Safe infrastructure must control the fleet, not only one sandbox.
Define resource classes so the model cannot request arbitrary capacity. Apply per-run limits alongside tenant concurrency and spend controls. Use leases, maximum lifetimes, and cleanup reconciliation.
These controls describe the complete application architecture, not automatic Northflank defaults. Your team must configure or implement task authorization, expiry, reconciliation, quotas, and budget enforcement around the infrastructure capabilities it uses.
Warm pools reduce startup latency but increase cost and reset risk. Reused environments must not expose a previous task's files, processes, credentials, sessions, or caches. Attribute resource use to an owner.
Operators need enough evidence to reconstruct why execution was allowed, what it affected, and how it ended.
Assign one correlation ID across the request, policy, sandbox, commands, approvals, artifacts, and termination. Record content only where policy permits. Do not require private chain-of-thought.
Keep agent traces distinct from platform events. Northflank audit logs record resource events, their origin, triggering user, time, and affected resources. Your agent service must still trace policy decisions, commands, tool results, and business effects.
Containment cannot depend on the model. Operators should be able to terminate a runtime, revoke credentials, block networking, disable tools, quarantine retained files, and prevent another run.
A safe request path keeps authority explicit through cleanup.
- Authenticate the initiator and assign a durable task and run ID.
- Let the orchestrator propose the command, files, image, resources, destinations, data access, and expected artifacts.
- Evaluate the proposal in an external policy layer and collect approval when its authority or impact requires one.
- Apply the approved isolation, resource limits, and baseline network restrictions before any untrusted entrypoint or task code can run, then create the environment.
- Wait for a ready or failed state, then deliver task-scoped credentials through the approved mechanism before the operation that needs them.
- Execute the task, enforce runtime limits, and stream bounded results and health signals to the orchestrator.
- Export approved artifacts to separately controlled storage and revoke temporary access.
- Delete or pause the environment according to policy, verify cleanup, and close the correlated evidence record.
Design for partial failure. A timed-out client does not prove creation failed, and a successful delete request does not prove every related resource was removed.
Agent-generated code should leave the sandbox as a reproducible artifact and enter a separate release process.
A successful test does not grant production authority. Require a commit or image digest, controlled dependencies, tests, resource requirements, and a record of data and network needs.
Where practical, promote immutable artifacts into preview or staging with review, monitoring, and rollback controls. Northflank provides Preview Environments for reviewable application stacks and Workflows for connecting builds, deployments, jobs, conditions, and approvals. The agent session supplies an input to that process, not an exception.
Northflank is an AI-agent sandbox and workload platform for running untrusted code in isolated environments on Northflank Cloud, in your own cloud account and VPC, or on eligible on-premises infrastructure.
Northflank combines isolated agent execution with the services needed to operate the orchestrator and the applications around it.
Northflank provides:
- Northflank Sandboxes for ephemeral or persistent code execution using public or private container images
- REST API, CLI, and JavaScript client interfaces for sandbox lifecycle automation
- Resource plans, volumes, runtime variables, scoped API roles, private networking, and audit logs
- Services, jobs, databases, Preview Environments, release workflows, and GPU workloads
- Northflank Skills for compatible coding agents operating the platform through their assigned credentials and permissions
Use Northflank Cloud for managed infrastructure. Use self-serve BYOC to run workloads and their attached storage in your own cloud account and VPC. Northflank manages Kubernetes while you own the account and cloud resources. Data residency still depends on where you run builds and which model APIs, artifact stores, and other external services the workload uses. Northflank-hosted control-plane metadata remains outside the workload boundary.
Use BYOK to connect an eligible Kubernetes cluster your team operates. Your team operates the cluster while Northflank manages workload orchestration and deployment. BYOK requires a reachable Kubernetes API, so it is not an air-gapped deployment.
Get started with Northflank self-serve, or book a demo to discuss sandbox architecture, isolation, networking, infrastructure placement, compliance, or scale.
It depends on the code and its potential impact. A container may suit trusted work with restricted inputs. Generated code, hostile files, or multi-tenant execution may require a stronger boundary such as a microVM, plus identity, network, lifecycle, and containment controls.
Not necessarily. An agent that only calls narrow, well-authorized APIs may not need general-purpose execution. Use a sandbox for shell, compiler, repository, filesystem, browser, package-manager, or similar access. Allocate environments per task, session, user, or tenant according to the threat model.
Default to ephemeral environments for independent tasks. Add persistent volumes when a workspace must survive pause or restart, then define ownership, access, retention, scanning, and deletion separately from compute lifecycle. Northflank Sandboxes support both ephemeral execution and attached volumes; pausing scales compute to zero rather than preserving a live session.
