Project
Open-source container sandbox runtime (runsc) that implements a user-space kernel to isolate workloads from the host, used in GKE Sandbox and other platforms.
HISTOR started 12,915 npm and PyPI MCP servers in a sandbox, and 5,259 (41%) never answered, according to its own post. About 24% were broken or not stdio servers at all. Another 16% depended on keys, flags or runtimes a client config can supply.
Reality
Agent37 runs agent sandboxes for an average $0.37 per customer per month, roughly 10% of typical providers' charges, according to a dev.to analysis. The same post ranks bare-metal hosting as the largest saving, so memory sharing explains only part of the gap.
Reality
Kubernetes' project blog says NVMe-backed node swap, generally available since v1.34, packed up to 3x more pods onto memory-bound nodes in benchmarks. The gain comes from paging out memory that agent sandboxes hold idle between prompts, so swap-based budgets depend on how much of each pod is truly dormant.
Reality
Modal made multi-node GPU clusters generally available on October 1st, requested through one Python decorator and billed by the second. Dropping a reserved cluster for it means trusting a gang scheduler to place every node at once on one network.
Reality
Microsoft made Azure Container Apps Express generally available on a sandbox layer that starts isolated microVMs from prewarmed pools in under a second. The agent-oriented engineering sits in that layer, while Express on top keeps a narrow slice of Container Apps features.
Reality
Google says GKE Pod snapshots, which restore saved CPU and GPU memory, cut startup latency by up to 89% and load a 70B model in 37 seconds. When a snapshot stops matching its node, the Pod starts cold with no error, so teams must keep snapshots valid across upgrades.
Reality
Google open-sourced AX, an Apache 2.0 runtime on Kubernetes that checkpoints idle agents and is designed to resume them in under a second. Its savings depend on how long each agent waits on models, tools or people.
Reality
GKE Agent Sandbox is generally available and publishes provisioning numbers a team can plan against. The scheduling and durability layers stacked on top of it rest on one public demo, and the deprecation argument lands there.
Reality
Benchling runs agent-written scientific code in a separate AWS account with no internet gateway and no NAT gateway, so the remaining way out of the VPC was a name lookup. The resolver policy answers the endpoints Benchling listed and blocks everything else.
Reality
Roughly 130 pull requests, most of them refactoring, retire the Kubernetes Deployment that used to sit under every kagent agent. The tag string on the release says alpha1 and GitHub's flag on it says prerelease false.
Reality
A dev.to walkthrough on sandboxing LLM tool calls names old web-app failure modes and old web-app controls. The delta is when you apply them: at registration, not after the first exfiltration.
Reality
The open-source demo treats the model as untrusted and pushes controls outward: signed database writes, a gVisor sandbox with no network, and a deterministic gateway in front.
Reality