AI sandbox: isolation, code execution, and costs

Описание и применение

Руководство по выбору и использованию изолированной среды для выполнения кода ИИ, включая проверку среды Firecracker, ограничение ресурсов и безопасную работу с ключами.

Задача

Choosing a runtime for an AI agent that can run code while ensuring isolation, resource limits, and cost control.

Результат

The example demonstrates a secure, cost‑aware execution of a Python task in a Firecracker sandbox, with runtime checks and output validation.

Рабочий процесс

• Receive task from backend
• Ask model to produce code
• Create sandbox with specified size and timeout
• Verify sandbox runtime is Firecracker
• Write Python script to /tmp/task.py
• Execute script inside sandbox
• Collect stdout, stderr, exit code
• Validate and sanitize output
• Stop and clean up sandbox

Доказательства

An AI sandbox is an isolated environment where an AI agent can run code, install packages, and work with files.

Источник

Lizard Sandboxes use Firecracker. Older volumes or snapshots, and a fallback after a failed Firecracker start, can use the container runtime.

Источник

Keep the model provider key and the sandbox management key in your backend. Giving generated code a management key would let it request more resources using your account.

Источник