Day 16: Agent Sandboxing — AI System Engineer

Celkový progres 53%

🎯 Cieľ dňa

Implementovať bezpečné prostredie pre AI agentov — od Docker hardening po Firecracker microVMs.

core practice

MicroVMs, gVisor, isolation strategies. Komprehenzívny guide.

Docker, gVisor, Firecracker pre AI tools. Praktické setup instructions.

Running AI-generated code safely. Firecracker boots v ~125ms, <5 MiB overhead.

Open-source: Firecracker-based sandbox s jedným riadkom Python/JS. Cold start ~150ms.

Isolation Levels — Container (basic) → gVisor (syscall interception) → Firecracker microVM (dedicated kernel). Trade-off: security vs overhead.

Firecracker — Lightweight VMs, ~125ms boot, <5 MiB overhead, vlastný Linux kernel per VM. Gold standard.

gVisor — User-space kernel (Sentry) interceptuje syscalls. Lepšie ako container, menej overhead ako VM.

Resource Limits — CPU, memory, disk, network limity pre agentov. Prevencia resource exhaustion.

Network Policies — Kontrola čo agent môže kontaktovať. Whitelist endpoints, block egress.

Nastav sandboxed execution environment pre agenta.