all posts
blog · topic

Code execution sandboxes

Executing code you did not write — from an LLM, a user, or a pull request — is a sandboxing problem first and a runtime problem second. These posts cover code interpreter architecture, Python and notebook execution, timeouts and resource limits, and why the isolation boundary matters more than the language runtime.

Code interpreter sandboxes on PandaStack

212 posts

·12 min read

What FedRAMP Asks of a Platform That Runs Untrusted Code

An ephemeral-by-design fleet is hostile to a control set that assumes a stable, enumerable inventory — and a snapshot memory image is an asset class nobody wrote a control for.

fedrampcompliancenist-800-53
Ajay Kumar
·11 min read

Answering a Security Questionnaire When You Run Customer Code

The spreadsheet was written for a CRM. You run code a customer's model wrote ninety seconds ago. About a dozen rows carry the entire review, and the most important one is not on the sheet at all.

securitycomplianceenterprise
Ajay Kumar
·11 min read

Giving a MicroVM Access to a Customer's Private Network

The customer's database is in their VPC and your sandbox is not. The naive answer is to hand them your egress IPs and ask them to open a hole; the answer that survives a security review is a WireGuard peer per sandbox, minted after restore, revoked on teardown, and never, ever baked into a snapshot.

networkingsecuritywireguard
Ajay Kumar
·10 min read

Vendor Lock-In in Code Execution Infrastructure

Interface lock-in is an adapter and a bad afternoon. Data lock-in is a project. Semantic lock-in — you built on a behaviour nobody else sells — has no exit at all, which is why nobody sells you a mitigation for it. Written by a vendor, so I owe you the same audit of my own product.

vendor-lock-inportabilitybuyers-guide
Ajay Kumar
·11 min read

What "persistent" actually means in a sandbox

You wrote the file. You ran cat and saw it. Neither of those facts says the bytes are on a disk. Here is every layer a write passes through inside a microVM, which of them a crash erases, and why the honest answer for an ephemeral rootfs is not "fsync harder" but "get the artifact out".

durabilitystoragesandboxes
Ajay Kumar
·22 min read

A plain-English glossary of sandbox and microVM terms

This vocabulary is genuinely confusing, and a lot of it is vendors using one word for three things. Here is the glossary I wish someone had handed me: 48 terms, each with the distinction that actually matters and the specific way people get it wrong.

glossarymicrovmfirecracker
Ajay Kumar
·10 min read

Running Customer Trading Strategies in Isolated microVMs

Your customers write strategies. Your infrastructure runs them, next to each other, holding credentials that place orders. This is the untrusted-code problem with a P&L attached.

fintechmulti-tenantisolation
Ajay Kumar
·8 min read

How to add human approval to agent code execution

The gate that asks about everything gets clicked through by Thursday. The useful design asks about almost nothing, because isolation earns you the right not to ask.

ai-agentshuman-in-the-loopsandbox
Ajay Kumar
·8 min read

How to run SWE-agent in a sandbox

SWE-agent hands a language model a shell over your repository. On a laptop, that shell also reaches your SSH keys. Here is the isolated version.

swe-agentcoding-agentsai-agents
Ajay Kumar

More posts in this topic