The more capable an AI is at executing for real, the harder its boundaries and the more reliable its recovery must be.
One job contract covers three execution modes: Python code packages, arbitrary shell commands, and self-provided container images. Large inputs spill to files, so AI applications integrate with zero adaptation.
Each job runs in its own Pod: non-privileged, read-only root filesystem, all capabilities dropped, seccomp by default. User code is treated as untrusted.
Five priority levels, preemptible CRITICAL jobs, global and per-tenant concurrency quotas, and three tiers of host-level backpressure. Critical work never waits in line, and a single department cannot saturate global capacity.
Callbacks optimize, reconciliation is the safety net: every 30 seconds the true state is queried from Kubernetes, so even if a runner crashes or a Pod is evicted, the task still reaches a terminal state instead of hanging.
A directed acyclic graph expresses dependencies and parallelism, failed steps can be re-run in place (incrementally or fully), and an upstream failure quickly cancels downstream steps — complex pipelines stay expressible and debuggable.
Each job Pod is injected with least-privilege MinIO credentials, and callback URLs carry a per-job HMAC token — even if one job is compromised, it is confined to its bucket and cannot overwrite other jobs.
All resources are bound to a tenant; if the tenant cannot be determined, the request is denied rather than allowed. The sandbox owner is the job's tenant, and anything cross-tenant returns 404 — privilege escalation never happens silently.
Every lifecycle operation is audited; business operations and events land in an outbox in the same transaction and CloudEvents are delivered asynchronously to CI, notifications and billing without blocking the business.
Clone → edit → self-test → push, with a passport gate locking down the edit area. Visual self-verification means real browser screenshots judged by a vision model, not jsdom guesswork.
The execution layer is where the four defenses actually take hold and are enforced.
Destructive commands are detected and forced through approval; nothing passes unapproved.
What an AI can execute depends on its growth level.
K8s + unshare keep side effects inside a controlled boundary.
Every execution is recorded, for post-hoc review and accountability.
Book a demo to see AI genuinely execute in a sandbox, always under control.