Every autonomous agent you drop on a cluster is a Linux process you agreed to babysit. Cute framing, until the bill lands. On the CNCF blog this week, Solo.io's Lin Sun, a CNCF Ambassador, put a version of that observation into a post called "Why sandboxing your agent is not enough" and pointed at two Kubernetes SIG Apps projects that carve the agent-hosting problem in half.
The provocation in the title is real. The gap it names is not the one you might expect.
What agent-sandbox already gives you
agent-sandbox is a Sandbox Custom Resource Definition and controller for Kubernetes, developed under SIG Apps. It hands each agent a strong identity, persistent storage that survives a restart, and lifecycle management. If you have ever watched a coding agent get pointed at a shell and then be tempted to (as Lin Sun puts it in the post) delete family photos or modify the wrong file, you understand the appeal of a namespace-flavoured cage with rules.
Nothing new underneath. Container primitives are exactly the tool for that job, and Kubernetes ships them by the load. agent-sandbox packages those primitives into a CRD whose knobs fit an agent's shape.
