My AI Agent Deploys Code to My Server. Here’s What Keeps It in a Box.

Description and use

An AI agent deploys code to a Linux server. Standard Docker containers share the host kernel, risking escape. By installing gVisor and configuring agentic‑hosting to always use the runsc runtime with strict capability, filesystem, and network limits, deployments are sandboxed, protecting the host from buggy or malicious code.

Problem

When an AI agent deploys code to a server, there is a risk that buggy dependencies, misbehaving code, or malicious behavior could compromise the host system.

Outcome

Deployments are now confined to a gVisor sandbox, preventing container escape and limiting resource usage, thereby protecting the host from agent‑generated code failures or attacks.

Workflow

• 1. Install gVisor’s runsc runtime on the server. 2. Register runsc with Docker via daemon.json. 3. Verify gVisor is available with docker info and a hello‑world test. 4. Deploy agentic‑hosting (ah) which checks for runsc on startup. 5. Agent registers and requests a service via the /v1/services API. 6. ah starts the container with runsc, drops all capabilities, sets no‑new‑privileges, read‑only root FS, limited scratch space, process, memory, CPU caps, and a private internal network. 7. Traefik routes external traffic through a separate network; app‑to‑app traffic is disabled. 8. Use the /v1/system/health/detailed endpoint to confirm gVisor is installed. 9. Inspect the container’s Docker inspect output to verify runtime, capabilities, and filesystem settings.

Evidence

Most apps today ship as containers. A container feels like its own small computer, with its own files and processes. It isn't one.

Source

gVisor is an open‑source project from Google that adds that wall. It gives each container its own kernel, written in Go, that runs as an ordinary program on the host.

Source

ah starts the container with these settings. They’re hardcoded in internal/docker/client.go, so you can read them yourself.

Source

In production, if Docker doesn’t list runsc, ah exits with this error: FATAL: gVisor runtime (runsc) not found in Docker daemon.

Source