Lesson 12: Sandbox Deployment Options — From Cloud Providers to Self-Hosted Kubernetes

This lesson covers the four main options for deploying agent sandboxes: cloud-hosted providers, custom Kubernetes backends, self-hosted NemoClaw/OpenShell on Kubernetes, and hybrid approaches. We compare security features, credential handling, and when to use each option.

Primary sources: LangChain DeepAgents Sandboxes | OpenShell Kubernetes Setup | OpenShell Helm Chart

1. The Four Deployment Options

2. Option A: Cloud Sandbox Providers (LangChain Native)

Architecture

Code Example

# Using LangSmith Sandbox with DeepAgents
from deepagents import create_deep_agent
from deepagents.backends import LangSmithSandbox
from langsmith.sandbox import SandboxClient

client = SandboxClient()
ls_sandbox = client.create_sandbox()
backend = LangSmithSandbox(sandbox=ls_sandbox)

agent = create_deep_agent(
    model="anthropic:claude-sonnet-4-20250514",
    system_prompt="You are a coding assistant with sandbox access.",
    backend=backend,
)

try:
    result = agent.invoke({
        "messages": [{"role": "user", "content": "Create and run a Python script"}]
    })
finally:
    client.delete_sandbox(ls_sandbox.name)

What You Get

When to Use

• Quick prototyping and development
• When you don't want to manage infrastructure
• When basic filesystem/process isolation is sufficient
• When you can keep credentials outside via external tools

3. Option B: Custom Kubernetes Backend

Architecture

Implementation

from deepagents.backends.sandbox import BaseSandbox, ExecuteResult
import kubernetes

class KubernetesSandbox(BaseSandbox):
    """Custom sandbox backend that runs commands in Kubernetes pods."""

    def __init__(self, pod_name: str, namespace: str = "default"):
        self.pod_name = pod_name
        self.namespace = namespace
        self.k8s_client = kubernetes.client.CoreV1Api()

    def execute(self, command: str, timeout: int = 300) -> ExecuteResult:
        """Execute command in the K8s pod via kubectl exec."""
        response = kubernetes.stream.stream(
            self.k8s_client.connect_get_namespaced_pod_exec,
            self.pod_name,
            self.namespace,
            command=["/bin/bash", "-c", command],
            stdout=True,
            stderr=True,
            stdin=False,
            tty=False,
        )
        return ExecuteResult(
            output=response,
            exit_code=0,  # Parse from response
        )

Pod Template with Security

# sandbox-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: agent-sandbox-${SESSION_ID}
  namespace: sandboxes
spec:
  securityContext:
    # Seccomp profile for syscall filtering
    seccompProfile:
      type: Localhost
      localhostProfile: agent-sandbox-seccomp.json

  containers:
  - name: sandbox
    image: python:3.12-slim
    securityContext:
      # Drop dangerous capabilities
      capabilities:
        drop:
        - SYS_ADMIN
        - SYS_PTRACE
        - NET_RAW
        - SYS_MODULE
        - MKNOD
        - SETUID
        - SETGID
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      runAsUser: 1000

    volumeMounts:
    - name: workspace
      mountPath: /sandbox
    - name: tmp
      mountPath: /tmp

  volumes:
  - name: workspace
    emptyDir:
      sizeLimit: 10Gi
  - name: tmp
    emptyDir:
      sizeLimit: 1Gi

NetworkPolicy for Egress Control

# network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sandbox-egress
  namespace: sandboxes
spec:
  podSelector:
    matchLabels:
      app: agent-sandbox
  policyTypes:
  - Egress
  egress:
  # Allow only specific destinations
  - to:
    - ipBlock:
        cidr: 10.0.0.0/8  # Internal services only
    ports:
    - protocol: TCP
      port: 5432  # PostgreSQL

What You Get

When to Use

• You already have Kubernetes infrastructure
• You need more control than cloud providers offer
• Basic K8s security primitives are sufficient
• You can build credential injection yourself

4. Option C: Self-Hosted OpenShell on Kubernetes

Architecture

OpenShell Security Layers

From the OpenShell documentation:

Helm Installation

# 1. Install Agent Sandbox CRDs (prerequisite)
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml

# 2. Create namespace
kubectl create namespace openshell

# 3. Install OpenShell from OCI registry
helm upgrade --install openshell \
  oci://ghcr.io/nvidia/openshell/helm-chart \
  --version "0.1.0" \
  --namespace openshell \
  --set server.sandboxNamespace=sandboxes \
  --set server.oidc.issuer="https://your-idp.example.com/realms/openshell"

# 4. Wait for rollout
kubectl -n openshell rollout status statefulset/openshell

# 5. Port-forward for local access
kubectl -n openshell port-forward svc/openshell 8080:8080

Key Helm Values

# values.yaml for production
replicaCount: 2  # HA requires external PostgreSQL

workload:
  kind: deployment  # Use deployment with external DB

server:
  logLevel: "info"
  sandboxNamespace: "sandboxes"
  sandboxImage: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"

  # External PostgreSQL for multi-replica
  externalDbSecret: "openshell-pg-credentials"

  # OIDC authentication
  oidc:
    issuer: "https://your-idp.example.com/realms/openshell"
    audience: "openshell-cli"
    adminRole: "openshell-admin"
    userRole: "openshell-user"

  # AppArmor profile for sandbox containers
  appArmorProfile: "runtime/default"

# Supervisor topology
supervisor:
  topology: "sidecar"  # or "combined"
  sidecar:
    processBinaryAwareNetworkPolicy: true
    proxyUid: 1337

# Network policy for sandbox pods
networkPolicy:
  enabled: true

Compute Drivers

OpenShell supports four compute drivers for provisioning sandboxes:

Supervisor Topologies

Combined: Agent container has Linux capabilities for network namespace, Landlock, privilege changes.

Sidecar: Agent runs with no added capabilities; root init container does nftables; sidecar handles binary-aware network policy.

What You Get

When to Use

• You need binary-scoped network policies
• You need credential isolation via inference.local
• You need kernel-level enforcement (Landlock, seccomp)
• You're running on Linux 5.13+ and control the kernel
• You want OPA policies for fine-grained control

5. Option D: Hybrid — OpenShell + DeepAgents

Architecture

Code Example

# Using OpenShell as DeepAgents backend
import openshell
from deepagents import create_deep_agent
from langchain_nvidia_openshell import OpenShellSandbox

# Create OpenShell sandbox
with openshell.Sandbox(delete_on_exit=True) as sandbox:
    backend = OpenShellSandbox(sandbox=sandbox)

    # Create DeepAgent with OpenShell backend
    agent = create_deep_agent(
        model="anthropic:claude-sonnet-4-20250514",
        system_prompt=load_skill("coding.md") + load_agents_md("client_a"),
        backend=backend,
    )

    result = agent.invoke({
        "messages": [{"role": "user", "content": "..."}]
    })

    # Policy Gateway (outside sandbox)
    decision = policy_gateway(result, client_rules)

Why This Combination Works

From the LangChain blog:

"Deep agents connect to real data sources (Linear, Slack, Salesforce). You want the agent to learn new things on the fly, but you don't want to rely on prompt instructions alone to prevent misuse — something external to the agent has to enforce security, which is what OpenShell does."

6. Comprehensive Comparison

7. Decision Framework

Quick Decision Table

8. Kubernetes-Specific Considerations

Node Requirements for OpenShell

# Label nodes that support Landlock (kernel 5.13+)
kubectl label nodes node-1 openshell.nvidia.com/landlock=true

# Check kernel version
kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.kernelVersion}{"\n"}{end}'

Multi-Tenancy

Production Checklist

Knowledge Check

Summary

Sources

• LangChain DeepAgents Sandboxes Documentation
• OpenShell Kubernetes Setup Guide
• OpenShell Helm Chart README
• OpenShell Sandbox Compute Drivers
• How OpenShell Works
• LangChain OpenShell DeepAgent Integration
• OpenShell CLI Container Image Feature Request