Breaking Serverless Stateless Limits: How AgentRun Solves Agent Sandbox Engineering Challenges

Why Traditional Serverless Fails AI Agents

Early generative‑AI tools acted as simple copilots, but modern agents (AutoGPT, BabyAGI, OpenAI Code Interpreter) require code execution, state persistence, and tool usage. Running untrusted code directly on servers or user devices introduces severe risks such as system destruction (e.g., rm -rf /), data leakage, resource exhaustion, and network attacks via prompt injection.

Unique Challenges of Agent Sandboxes

State Preservation: Agents need multi‑turn memory; variables like df = load_data() must survive across requests.

Cold‑Start Latency: Users cannot tolerate seconds‑long VM boot times; sub‑second startup is required for a smooth conversational experience.

Dependency Diversity: Different tasks may need distinct libraries (e.g., Pandas, Puppeteer), demanding flexible custom images.

Cost Control: Agent calls are bursty and sparse; keeping dedicated VMs is wasteful, while vanilla FaaS lacks state.

Why Function Compute (FC) Was Chosen

Strong Security Isolation: FC runs each instance in an independent MicroVM using RunD secure containers, providing kernel‑level isolation that prevents code escape.

Extreme Elasticity & Cold‑Start Optimization: FC can scale to tens of thousands of instances within minutes and, combined with RunD, achieves millisecond‑level startup.

Pay‑as‑You‑Go Cost Model: FC charges only for active execution time; idle timeout automatically recovers resources, dramatically lowering costs for bursty workloads.

No‑Ops Management: Developers are freed from OS patches, network configuration, and cluster maintenance.

Session Capability: FC offers session affinity, ensuring that all requests bearing the same SessionID are routed to the same compute instance, preserving context.

AgentRun Core Mechanisms

Sandbox Request Affinity: When a sandbox is created, AgentRun generates a unique SessionID. All subsequent requests with this ID are routed to the same MicroVM, allowing variables such as df to remain in memory across calls.

Multi‑Level Security Isolation:

Compute Isolation: Each sandbox runs in its own MicroVM with concurrency limited to one, preventing cross‑tenant process interference.

Network Isolation: Users can enable or disable public network access or attach the sandbox to a VPC, eliminating internal‑network attacks.

Flexible Lifecycle Control:

Idle timeout (e.g., 5 minutes) automatically destroys inactive sandboxes, stopping billing.

Future support for pause/resume via snapshotting will preserve memory and disk state for long‑running tasks.

Session‑level storage isolation ensures each sandbox mounts a private directory (e.g., /workspace) that cannot access other tenants' files such as ../../tenant-b/secret.txt.

Typical Workflow: Excel Chart Generation

Template Creation: The Agent sends a request to create a Code Interpreter sandbox template.

Sandbox Creation: AgentRun calls FC’s CreateSession to spin up a sandbox with a configured idle timeout.

Task Execution:

Upload the Excel file via the interpreter’s file‑upload API.

Run code import pandas as pd; df = pd.read_excel('data.xlsx') using the run_code endpoint.

Generate a plot with df.plot(); the variable df remains in memory for subsequent calls.

Resulting image is written to a NAS mount and a download link is returned.

Resource Cleanup: After the task, the sandbox becomes idle; FC’s idle timeout destroys the instance, leaving only persisted NAS data.

Design Principles Behind AgentRun

Configuration as Code: Sandbox definitions (env vars, resources, health checks) are versioned templates.

Session = Sandbox: Each session provides on‑demand allocation and state retention.

Programmable Lifecycle: APIs support create, delete, pause, resume, and automatic timeout.

Standardized Network Access: All interactions use HTTP/WebSocket with optional SSE, abstracting underlying network changes.

Fine‑Grained Storage Isolation: Future support for per‑session directory mounts prevents cross‑tenant data leakage.

Conclusion

By combining RunD secure virtualization, FC session affinity, and dynamic NAS mounting, AgentRun delivers a sandbox that is secure, low‑cost, and high‑performance—addressing the core engineering hurdles of AI Agent deployment. Ongoing work focuses on sub‑second snapshot recovery and broader storage options, positioning AgentRun as the premier cloud‑native foundation for production‑grade AI agents.