Q: Your Autonomous AI Agent platform allows LLMs to write and execute arbitrary Python, Node.js, and Bash scripts generated on behalf of customers. Malicious prompts or hallucinated code could execute kernel privilege escalation exploits, access the host cloud metadata server, or attack other tenants. How do you design an ultra-secure, multi-tenant untrusted code sandbox that boots in < 100ms, enforces strict network egress, and isolates tenants completely?

Provide complete hardware boundary isolation with minimal boot overhead:

• Firecracker MicroVMs: Untrusted agent code executes inside dedicated, single-tenant Firecracker microVMs running on Linux KVM (Kernel-based Virtual Machine).
• Sub-100ms Spin-Up: Firecracker strips legacy BIOS/PCI devices, booting a minimal uncompressed Linux kernel with memory footprint < 5 MB in 35 milliseconds.
• Hardware Boundary: Even if code exploits a Linux kernel vulnerability, it is trapped inside the guest kernel and cannot access the host KVM hypervisor.

Intercept and sandbox system calls before they reach virtualization drivers:

• gVisor Sandboxing: For lightweight non-root scripts, executed processes under gVisor (runsc), which intercepts and handles all system calls in a sandboxed user-space Go kernel.
• Syscall Whitelisting: Blocks dangerous system calls (ptrace, bpf, reboot, raw socket creation) by default using strict Linux seccomp-bpf profiles.

Prevent untrusted agent scripts from participating in botnets or stealing cloud credentials:

• Air-Gapped Network Namespace: Sandboxes boot with zero internet routing by default (isolated veth pair / bridge).
• Cloud Metadata Blocking: Hardware iptables rules drop all packets destined for 169.254.169.254 (IMDS), preventing stolen IAM credentials.
• Egress Domain Proxy: If the agent explicitly requires internet access, outbound HTTP calls route through a strict egress proxy enforcing domain whitelists.

Prevent denial-of-service resource exhaustion and achieve instant response times:

• cgroups v2 Hard Quotas: Enforced hard boundaries per sandbox: 1 vCPU, 512 MB RAM, 1 GB read-only rootfs + 100 MB tmpfs scratchpad, and 15-second execution timeout.
• Pre-Warmed Pool: Daemon maintains a warm pool of 50 pre-booted paused MicroVM snapshots; claiming an execution environment takes < 8 milliseconds.
• Instant Teardown: Upon execution completion or timeout, the MicroVM is instantly terminated and its memory wiped, guaranteeing zero residual tenant contamination.