One sandbox per step

The obvious isolation boundary for an agent platform is the run: spin up a container, execute the flow inside it, tear it down. That is what we built first. It is not what we ship.

We ship one container per step. Group one, step one, gets a pod. It runs its tools, writes its conclusion, and the pod is gone before step two’s pod exists. A five-step flow is five containers, none of which ever see each other.

Why per step

Because a step is the unit at which capability changes. Step one might hold a credential that step three must not have. Step three might be allowed to write to the site repository; step one is only allowed to read it. If both run in the same container, the credential is on the filesystem for the whole run, and “step one cannot use it” is a rule we ask the model to follow rather than a fact about the machine.

Per-step pods make it a fact. The pod for a step contains exactly the agent’s folder, the secrets named in that agent’s file, and the conclusions of the groups before it. A step with no write tool has no write tool, whatever it is told.

What we measured

The reason people do not do this is the cold start. A container per step sounds like it should add seconds to every step and minutes to every flow.

So we measured gVisor on the box we actually run on. Warm start, pod ready to execute: about 0.75 seconds. First hit after an image pull: about 2.6 seconds. Against steps that typically take thirty seconds to several minutes of model time, a three-quarter-second floor is invisible. We wrote the number down and stopped worrying about it.

What a pod can reach

The network policy on a run pod denies every private address range and the cloud metadata endpoint. That includes the platform’s own API and its database: a run cannot call the thing that launched it. Workspace files come in and go out through presigned URLs, so there is no object-store credential in the sandbox to steal.

What a pod can reach is the public internet, as itself. That is deliberate. Agents fetch pages, call APIs and send mail; a sandbox that cannot do those is a sandbox for toys. The trade is: the pod can talk to the world, and cannot talk to us.

The one thing per-step did not solve

Isolation between steps does not help when the step that holds the dangerous tool is itself talked into misusing it. On 2026-09-04 a publisher step with a legitimate tool to apply links applied a hundred and forty of them, none of which a person had chosen, because it read the wrong proposal file. The sandbox worked perfectly. The lesson was about capability, not isolation, and it has its own post.