AI agents need sandboxes to run tools, execute generated code, train with reward functions, and work through multi-step tasks.
2
Arrakis uses Linux microVMs, isolated networking, overlay filesystems, and preinstalled browser access to provide self-hosted code execution and computer-use environments.
3
Snapshot and restore let agents return to a good checkpoint after failure instead of repeating an entire workflow.
Summary
Abhishek Bhardwaj explains why AI agents need isolated Linux environments for tool calls, code execution, reinforcement learning, and computer use. He builds the case for microVMs by comparing them with containers and traditional virtual machines. Containers package dependencies and isolate processes with namespaces and cgroups, but a kernel vulnerability can let malicious code reach the host. MicroVMs provide a separate guest kernel with a smaller device surface and faster startup than traditional VMs. Arrakis uses Cloud Hypervisor, an overlay filesystem, per-sandbox networking, port forwarding, a code execution server, Chrome, and VNC access. Its snapshot system saves guest memory and the writable filesystem so agents can backtrack after failed plans. The talk also walks through the REST API, Python SDK, Docker customization, MCP integration, and a demo where Claude creates and modifies a collaborative Google Docs clone.
AI agents need sandboxes because their tools execute untrusted work
Abhishek Bhardwaj connects sandboxes to several parts of modern AI systems. Models such as o3 use tool calls for search and code execution during inference. Reinforcement learning needs sandboxes to run reward functions at scale. A coding agent with a full Linux environment can inspect processes with commands such as ps and lsof, run an application, debug it, and try a new plan. The security problem is similar to running code copied from GitHub or Stack Overflow on a production host. Generated code may be buggy or malicious, gain root access, and read the user's or a client's data.
Arrakis combines self-hosting with fast startup and agent-friendly access
Arrakis is an open-source service for spawning and managing sandboxes for code execution and computer use. Bhardwaj says it boots in less than 7 seconds, compared with 40 seconds for a traditional VM on macOS, and that work was underway to get below a second. Snapshots take single-digit seconds. The service handles port forwarding, so code servers and VNC sessions can be reached through public URLs without manually configuring IP tables or firewalls. Chrome and a VNC server are preinstalled, which gives computer-use agents access to a browser GUI. Arrakis also provides Python, Go, OpenAPI, MCP, and Docker-based configuration options.
Containers isolate views of resources but still share the host kernel
Bhardwaj describes containers as packages containing an application's dependencies and business logic. On Linux, they use namespaces for resources such as processes, mounts, and networking. A process inside a container can see its own process IDs and filesystem view, while the host can inspect the child namespace. Cgroups control how much CPU and memory a container can use. The security limit is that container processes remain native processes running on the host kernel. If malicious code exploits a kernel vulnerability, it may gain root and access data on the machine. Linux capabilities and seccomp filters can reduce the available system calls and privileges, but they do not create a separate kernel.
Virtual machines reduce the path from guest code to the host kernel
A traditional virtual machine has its own guest user space and guest kernel. Bhardwaj explains that a virtual machine monitor, such as QEMU, CrossVM, or Firecracker, talks to the Linux KVM device to create the VM and provide access to privileged resources. Guest code runs in a hardware virtualization context. When it needs disk or network access, the VMM handles a VM exit, communicates with the host device, and resumes the guest. CPU-bound work can run directly on the processor, while frequent device access can add overhead. This gives virtualization a smaller host-kernel attack surface than containers, with a possible performance cost for some workloads.
MicroVMs make virtualization smaller by limiting code and devices
MicroVMs came from the CrossVM project and focus on a smaller, security-oriented virtual machine monitor. CrossVM, Firecracker, and Cloud Hypervisor use Rust for memory safety and isolate emulated devices so a compromised block device does not automatically gain network-related system calls. They support fewer architectures and a smaller set of devices than QEMU, which means fewer code paths during boot and less memory at runtime. Arrakis chooses Cloud Hypervisor because it provided device hot plugging, GPU support, and snapshot support when the choice was made. Bhardwaj also compares gVisor, which is closer to a container and makes GPU access easier, but offers different security guarantees.
Arrakis gives each sandbox a protected base filesystem and a private writable layer
Each sandbox uses a shared read-only root filesystem with its own read-write overlay layer. The base layer can be reused across sandboxes, while files created by an agent go into that sandbox's writable layer. This protects the root filesystem from code that deletes or changes important files. When Arrakis snapshots a sandbox, it only needs to persist the writable layer rather than copying the shared read-only data. Inside the guest, the sandbox still looks like an ordinary Linux filesystem. An init script sets up the overlay filesystem before the first process becomes PID 1.
Networking connects isolated guests to useful services without manual firewall work
Every Arrakis sandbox runs in a virtual machine with isolated networking. The host creates a unique TAP device for each sandbox, connects those devices to a Linux bridge, and applies forwarding rules. Arrakis also handles port forwarding into the code server and VNC server. Its networking code creates and activates the bridge, configures firewall rules, and uses IP tables with destination NAT to forward traffic. This allows a VNC client on a laptop to reach the browser GUI inside a sandbox. Agents can also call external tools and APIs from the sandbox when networking is enabled.
Snapshotting lets agents explore plans and recover from late failures
Large agent tasks can fail near the end even when the work is divided into smaller steps. Arrakis lets an agent return to its last good checkpoint, replan, and continue without starting over. A snapshot contains the guest memory and the writable filesystem, so created files, running processes, and open GUI windows can return to their previous state. The implementation pauses the VM, dumps guest memory through the VMM snapshot API, copies the writable overlay filesystem, and resumes the VM. Bhardwaj describes this as a way to explore multiple execution paths. The project was considering btrfs to support more efficient incremental snapshots.
The API makes sandbox creation and restoration a small application-level workflow
Arrakis can be self-hosted and controlled through its Python SDK. A client lists running VMs, starts a sandbox, runs commands, reads output or errors from JSON fields, creates a snapshot with an identifier, and destroys the VM when finished. Restoring later requires the VM name and snapshot identifier. The bundled execution server exposes file upload and download operations plus a command endpoint. In the demo, Claude uses the MCP server to create a collaborative Google Docs clone, add dark mode, and then restore the earlier snapshot. Because the sandbox includes networking, the result supports real shared access rather than only a client-side imitation.
"I'm much more confident about this code not escaping out and we can be relaxed with it versus if we were running directly on top of our host OS."31:28
Who should watch
You are building a coding or computer-use agent that needs to run generated code without exposing the host or another tenant's data.
Your agent performs long, multi-step tasks and needs to recover from late failures or test several execution paths.
You want to understand the Linux systems work behind microVM sandboxes, including VMMs, overlay filesystems, TAP networking, and snapshotting.
