live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
newsAI

Red Hat previews Agent Sandbox for stateful AI-agent workloads on OpenShift

The Technology Preview adds declarative sandbox lifecycles, warm pools and optional VM-level isolation, but keeps production support off the table.

OpenShift Agent Sandbox: standard containers versus optional VM-isolated sandboxes
Side by side: what changed
By The News Desk· Oct 4, 2026the quick take — two AI hosts go live when you do

Red Hat has documented a Technology Preview of Red Hat build of Agent Sandbox, a Kubernetes-native control layer for long-lived AI-agent runtimes and development environments on OpenShift. The feature appears in the OpenShift Sandboxed Containers 1.12 documentation and installs as a separate Operator from OperatorHub.

The distinction matters for platform teams: this is not another stateless inference endpoint. Red Hat describes Agent Sandbox as a system for singleton workloads that need a stable identity and persistent state, with lifecycle controls that replace hand-built combinations of StatefulSets, Services and persistent-volume claims.

A sandbox lifecycle API

The Agent Sandbox overview exposes a Sandbox custom resource for creating, retaining or deleting environments and scheduling shutdown times. It also documents hibernation for idle sandboxes, preserving state so a session can resume without rebuilding its environment.

Three extension APIs address repeatable and latency-sensitive provisioning. SandboxTemplate stores a reusable pod definition, SandboxWarmPool keeps a configured number of pods ready, and SandboxClaim allocates one of those prewarmed environments. Red Hat says the warm-pool path can avoid image-pull and virtual-machine startup delays, reducing allocation time to milliseconds.

Networking is centralized through a sandbox router. Instead of creating an external route per environment, clients send the target sandbox, namespace and port in request headers to one OpenShift route. The router resolves the sandbox service over cluster DNS and forwards HTTP traffic to the workload.

Isolation is optional — and costs something

Agent Sandbox can run with the standard container runtime or integrate with OpenShift sandboxed containers. In the latter configuration, each workload runs inside a lightweight virtual machine with its own kernel, creating a stronger boundary for multitenant environments and execution of untrusted or LLM-generated code. Red Hat also warns that this mode adds VM startup latency and resource cost; trusted workloads can stay on the default runtime.

The installation guide requires OpenShift 4.19 or later and cluster-admin access. Hardware-level isolation additionally requires the OpenShift sandboxed containers Operator and an appropriate Kata runtime. The compatibility table lists bare metal, Azure, Azure Red Hat OpenShift, AWS and Google Cloud configurations, with RHEL CoreOS worker nodes required for the sandboxed-container path.

The production boundary

The important qualification is support status. Red Hat labels Agent Sandbox a Technology Preview, says it is not covered by production service-level agreements and does not recommend production use. That makes this an evaluation target rather than a supported runtime commitment.

Still, the design makes Red Hat’s platform direction concrete: agent execution gets its own lifecycle primitive, while warm capacity, persistent state, shared routing and optional VM isolation become cluster services. Platform teams testing agent workloads can now evaluate that model directly, but should keep the preview boundary explicit in capacity, security and rollout decisions.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk