Pick the AI sandbox by product shape, not by how untrusted the code is
Last Updated on November 2, 2026 by Editorial Team
Author(s): Hubert Nakielski
Originally published on Towards AI.
On a multi-tenant fleet all code fails the trust test. What it needs from the OS and how long its session lives pick the isolation tier, the cold-start fix and the bill.
If you run model-written or customer-written code for many tenants, “put untrusted code in a microVM” can’t choose your sandbox, because all of it is untrusted. Two questions can: what the code needs from the OS, and how long its session lives.
After the introduction, the article explains that “tier by trust” breaks down on shared fleets, so teams should choose isolation based on two axes: (1) what the code requires from the OS—isolates/Wasm for tightly-scoped method calls, gVisor for a Linux userland, and microVMs for shells, package installation, Docker, or browsers—and (2) the session lifecycle—single-use sandboxes via checkpoint/restore, paused-and-resumed environments with snapshotting for minutes-to-hours, or persistent per-tenant machines for day-long workloads. It maps these choices to four kinds of AI products (code interpreters, cloud coding agents, browser/computer-use agents, and customer plugins) and highlights practical constraints like cold-start latency, snapshot/security pitfalls, and cost models that depend more on how services meter time/CPU than on the nominal isolation type. Finally, it discusses the risk tradeoffs of per-shape defaults on multi-tenant infrastructure (including potential cross-tenant escapes), argues for keeping credentials and egress on allowlists outside the guest, and concludes with a “verdict” framework: use gVisor for short interpreter workflows that need a Linux userland, reserve microVMs for workloads that need a whole machine, and let lifecycle and billing mechanics drive the overall design.
Read the full blog for free on Medium.
Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.
Published via Towards AI
Towards AI Academy
We Build Enterprise-Grade AI. We'll Teach You to Master It Too.
15 engineers. 100,000+ students. Towards AI Academy teaches what actually survives production.
Start free — no commitment:
→ AI Engineering For Production — our new book, coming before the end of 2026. Join the waitlist.
→ Agents Architecture Cheatsheet — 3 years of architecture decisions in 6 pages
Our courses:
→ AI Engineering Certification — 90+ lessons from project selection to deployed product. The most comprehensive practical LLM course out there.
→ Agent Engineering Course — Hands on with production agent architectures, memory, routing, and eval frameworks — built from real enterprise engagements.
→ AI for Work — Understand, evaluate, and apply AI for complex work tasks.
Note: Article content contains the views of the contributing authors and not Towards AI.
Related posts
Recent Posts
![[Day 37/100] Build Your Own Agent Memory Layer with Postgres and pgvector](https://miro.medium.com/v2/resize:fit:700/1*-Doos2nmUT3FPZ-Qxbk3Hw.png "[Day 37/100] Build Your Own Agent Memory Layer with Postgres and pgvector")
