From 273e452049d814f96a935ac86f04ec67619c74f0 Mon Sep 17 00:00:00 2001 From: rkoster Date: Fri, 10 Jul 2026 11:18:09 +0200 Subject: [PATCH 1/2] Add idea: per-session sandboxes with lifecycle states --- ideas/illustration-harness-sandboxes.svg | 236 +++++++++++++++++++++++ ideas/per-session-sandboxes.md | 39 ++++ 2 files changed, 275 insertions(+) create mode 100644 ideas/illustration-harness-sandboxes.svg create mode 100644 ideas/per-session-sandboxes.md diff --git a/ideas/illustration-harness-sandboxes.svg b/ideas/illustration-harness-sandboxes.svg new file mode 100644 index 0000000..4ee37b9 --- /dev/null +++ b/ideas/illustration-harness-sandboxes.svg @@ -0,0 +1,236 @@ + + + + + + + + + + + + + + LLM Provider + (service binding) + gemini-3.5-flash + + + + + + prompt + + context + + + + + tool call + response + + + + + + + + + + RUNNING + + APP + + + user request + app context + + + execute(sandbox, input) + + + + + + + + + User + + + + request + + + + + + + + + + + + + + + + + + tool calls + + + + + + + + + + RUNNING + + + + ./fetch_stats.py + + import requests + data = fetch_api("/stats") + result = analyze(data) + return summary(result) + + + + + + + disk + + Sandbox A — data analysis + + + + + + + + + + + RUNNING + + + + ./scrape_prices.py + + from bs4 import BS + page = scrape(url) + items = extract(page) + return json(items) + + + + + + + disk + + Sandbox B — web scraping + + + + + + + + + + + + SUSPENDED + + + + ./enrich_profile.py + + user = lookup(email) + social = fetch_linkedin(user) + return merge(user, social) + + + + + + + disk + + Sandbox C — profile enrichment (paused) + + + + + + + + + + + DEHYDRATED + + + + ./generate_report.py + + tmpl = load("quarterly.md") + charts = render(metrics) + return format(tmpl, charts) + + + + + + + blob + + Sandbox D — report gen (archived) + + + + + + user session — sandboxes per conversation + + + + + Sandbox States + + + Running (CPU + disk) + + + + Suspended (disk, no CPU) + + + Dehydrated (blob only) + + + + + + + Attached volume + + + + + + + Blobstore snapshot + + + + App + LLM + Sandbox Architecture + User request triggers LLM call; LLM responds with tool calls dispatched to per-session sandboxes + + + Ruben Koster + diff --git a/ideas/per-session-sandboxes.md b/ideas/per-session-sandboxes.md new file mode 100644 index 0000000..e7a1acf --- /dev/null +++ b/ideas/per-session-sandboxes.md @@ -0,0 +1,39 @@ +--- +title: Per-session sandboxes with lifecycle states +author: Ruben Koster (@rkoster) +date: 2026-07-02 +tags: [runtime-lifecycle, sandboxing-isolation] +--- + +## The idea + +An agent app (the "harness") manages a pool of sandboxes scoped to a user session. +Each sandbox runs an isolated workload — a tool, a sub-task, a code execution — and +transitions through a set of lifecycle states: running (CPU + attached volume), suspended +(disk retained, CPU released), and dehydrated (no compute, state serialized to blobstore). +The harness decides which sandboxes are active and when to suspend or dehydrate them. + +![Illustration: harness app with LLM service binding dispatching tool calls to per-session +sandboxes in running, suspended, and dehydrated states](./illustration-harness-sandboxes.svg) + +## Why it might matter + +Agent workloads are bursty and multi-step. A single user session may need several +concurrent sandboxes (parallel tool calls), but most of them are idle most of the time. +A platform that only supports "running" or "stopped" forces a choice between paying for +idle compute or losing state on every stop. Graduated lifecycle states let the platform +recover compute from idle sandboxes without discarding their work. + +## What to research next + +- How do existing sandbox platforms (Daytona, K8s Agent Sandbox) implement + suspend/resume — memory snapshot vs. filesystem checkpoint? +- What is the right storage primitive for the dehydrated state — a volume snapshot, + a tarball in blobstore, or a full container image layer? +- Does CF's existing volume service and blobstore give enough primitives to implement + this, or are new platform APIs needed? + +## Related + +- [research/k8s-agent-sandbox.md](../research/k8s-agent-sandbox.md) — K8s-native sandbox + control plane with warm pools and PVC-backed persistence; gVisor pod snapshots on GKE. From dcc4f4f6a7542f493c6fb024e8c019838d3788fd Mon Sep 17 00:00:00 2001 From: rkoster Date: Fri, 10 Jul 2026 11:49:15 +0200 Subject: [PATCH 2/2] Link to Anthropic managed agents research in related section --- ideas/per-session-sandboxes.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ideas/per-session-sandboxes.md b/ideas/per-session-sandboxes.md index e7a1acf..3c808f9 100644 --- a/ideas/per-session-sandboxes.md +++ b/ideas/per-session-sandboxes.md @@ -37,3 +37,7 @@ recover compute from idle sandboxes without discarding their work. - [research/k8s-agent-sandbox.md](../research/k8s-agent-sandbox.md) — K8s-native sandbox control plane with warm pools and PVC-backed persistence; gVisor pod snapshots on GKE. +- [research/anthropic-managed-agents.md](../research/anthropic-managed-agents.md) — + Anthropic's brain/hands/session decomposition: the "hands" are on-demand sandboxes + provisioned per tool call (`provision({resources}) → execute(name, input) → string`); + the session is an external durable event log separate from the harness and sandboxes.