Q30: Code Execution Sandboxes for Coding Agents: gVisor, Firecracker & Docker Isolation - AI Engineering & LLMs (50 Qs)

1. The Danger of Local Code Execution

Coding agents (Claude Engineer, SWE-bench agents, OpenCodeInterpreter) routinely generate and execute shell commands and Python code. Executing untrusted LLM-generated code directly on host servers or developer laptops is a critical security vulnerability:

Malicious prompt injections can execute rm -rf /, exfiltrate ~/.ssh/id_rsa keys, or install cryptominers.
Accidental bugs can launch local fork-bombs or saturate network ports.

2. Isolation Technologies Comparison

Technology	Startup Latency	Isolation Boundary	Resource Overhead	Production Example
Standard Docker Container	~1 second	Shared Linux Kernel (namespaces/cgroups)	Very Low	Vulnerable to kernel privilege escalation CVEs
gVisor (Google)	~100–200 ms	User-space virtualized kernel intercepting syscalls	Low	Google Cloud Run, production agent code runners
Firecracker MicroVMs (AWS)	~5–20 ms	Hardware-level KVM virtualization per sandbox	Extremely Low	AWS Lambda, Modal, Fly.io
WebAssembly (WASM)	< 1 ms	Memory-safe bytecode runtime	Minimal	Client-side or edge compute (limited language support)

3. Production MicroVM Sandbox Architecture

vbnet

   Agent Host (Untrusted LLM Output)
             │
             ├── Sends code payload: "import os; os.system('cat /etc/passwd')"
             │
             ▼
   [ Firecracker MicroVM / gVisor Sandbox ]
   ┌────────────────────────────────────────────────────────┐
   │ • Ephemeral Guest Kernel (KVM / Isolated System Calls) │
   │ • Network: Egress blocked to internal 10.0.0.0/8 VPC   │
   │ • Filesystem: Copy-on-Write tmpfs (destroyed on exit)  │
   │ • CPU / RAM Quotas: Max 1 Core, 512 MB                 │
   │ • Wall-Clock Timeout: 5.0 seconds                      │
   └────────────────────────────────────────────────────────┘
             │
             ▼
      Returns stdout/stderr safely to Agent without host exposure