Containers package an agent worker; sandboxes constrain what its tools and subprocesses can reach. Production deployment needs immutable images, non-root execution, minimal mounts, resource and time limits, controlled egress, short-lived workload credentials, separate tenant workspaces, signed artifacts, vulnerability scanning, progressive rollout, and rapid revocation of risky tools or prompt versions.
You will define a hardened worker profile and a deployment pipeline with evidence and rollback.
Provider-managed sandbox tools may supply some controls; still define identity, mounts, network, secrets, lifecycle, and evidence at the harness level.
The worker authenticates through workload identity to a broker/proxy. The broker retrieves or uses credentials on the worker’s behalf, scopes them to tenant/action, and records access. Avoid placing secrets in prompts, files readable by the model, image layers, environment dumps, or trace attributes.
Version image, adapter, model route, prompt, tool registry, policy, schema, and eval suite together in the release manifest.
Failure injection: Attempt metadata-service access, host path traversal, fork bomb, disk fill, and unapproved network upload. Each should be blocked or terminated with an auditable outcome.
After every job, verify processes are gone, workspace is destroyed, credentials are revoked/expired, network session closed, artifacts exported, and final events flushed. Test cleanup after normal completion and forced kill.
Write a deployable worker security profile and a CI policy that rejects root images, unpinned dependencies, missing SBOM/signature, or failed adversarial evals.