AI Agent Sandboxing & Isolation Best Practices 2026
AI agents that execute code, run tools, or access filesystems are running untrusted computation. A single successful prompt injection or jailbreak can pivot to your host system — unless you contain the blast radius. This guide gives you the exact isolation stack.
The Core Problem: Agents Execute Code
When your Moltbot agent runs a code interpreter, executes shell commands, or reads/writes files, it's executing untrusted computation on your infrastructure. If the agent is compromised via prompt injection, the attacker has whatever access the agent has. The only safe default: agents have no access until explicitly granted.
6 Isolation Layers
Process Isolation
Each agent run in its own process with no shared memory with other agents or the host system.
Network Isolation
Agents cannot initiate outbound network connections except to explicitly allowlisted endpoints.
Filesystem Isolation
Read-only root filesystem. Write access only to ephemeral temp directories that are wiped after each run.
Capability Dropping
Drop ALL Linux capabilities. Add back only what is strictly needed (usually nothing for LLM agents).
Resource Limits
Hard CPU, memory, and execution time limits. Agent cannot exhaust host resources or run indefinitely.
User Namespace Isolation
Run agent as non-root user inside container. UID 65534 (nobody) with no capabilities.
Hardened Docker Run Command
# Hardened agent container run command docker run \ --rm \ # auto-remove after run --read-only \ # read-only rootfs --tmpfs /tmp:noexec,nosuid,size=50m \ # limited writable tmp --network=none \ # no network access --cap-drop=ALL \ # drop all capabilities --no-new-privileges \ # prevent privilege escalation --user=65534:65534 \ # run as nobody --memory=512m \ # max 512MB RAM --memory-swap=512m \ # no swap --cpus=0.5 \ # max 50% of one CPU core --pids-limit=100 \ # max 100 processes --security-opt=no-new-privileges \ --security-opt="seccomp=/etc/docker/seccomp-agent.json" \ moltbot-agent:latest \ timeout 30 node agent.js # 30s hard timeout
Kubernetes Pod Security Policy
# Kubernetes PodSecurityContext for AI agents
apiVersion: v1
kind: Pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 65534
runAsGroup: 65534
fsGroup: 65534
seccompProfile:
type: RuntimeDefault
containers:
- name: moltbot-agent
image: moltbot-agent:latest
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
resources:
limits:
memory: "512Mi"
cpu: "500m"
ephemeral-storage: "100Mi"
volumeMounts:
- name: tmp-dir
mountPath: /tmp
volumes:
- name: tmp-dir
emptyDir:
sizeLimit: 50Mi