Building Effective Sandboxes for Running Untrusted LLM-Generated Code
As AI code-generation tools shift from auto-complete to autonomous code execution (code mode agents), platform engineers face a critical challenge: How do you safely execute arbitrary, untrusted code on your infrastructure?
In this talk, we will analyze the trade-offs of modern sandboxing mechanisms.
As AI code-generation tools shift from auto-complete to autonomous code execution (code mode agents), platform engineers face a critical challenge: How do you safely execute arbitrary, untrusted code on your infrastructure?
In this talk, we will analyze the trade-offs of modern sandboxing mechanisms.
Containers vs. MicroVMs vs. V8 Isolates: Performance, boot times, memory footprint, and security boundaries.
Deep Isolation: Exploring Linux security primitives like seccomp, eBPF, and ptrace-based sandboxes (sydbox).
Commercial & Open Source Ecosystem: A quick survey of tools like Docker Sandboxes, Apple Containers, E2B, and Daytona.
Decision Framework: A practical rubric to help platform teams choose the right isolation boundary for their specific latency and security profile.
Vagmi Mudumbai is a technical leader, DevOps architect, and platform engineer with over 24 years of experience. He builds efficient distributed systems and platforms for software delivery.
Vagmi specializes in providing the architectural clarity and technical guardrails that allow companies to scale without breaking. He is a hands-on practitioner with deep mastery across a diverse stack including Rust, Go, Ruby on Rails, and TypeScript paired with the infrastructure expertise (Kubernetes, Terraform) across multiple clouds required to build resilient, production-ready environments.
He is currently the CTO at Urai. At Urai, he designed and built microVM and V8 isolate sandboxes for AI code execution engines.