Project Lightning Talk: Run Sandbox Securely and Cost-Effectively With OpenKruise Agents - Z. Zhen

Running sandboxes for LLM-generated code in production forces an uncomfortable three-way trade-off between security, latency, and cost. The sandbox executes untrusted model code, so it cannot hold a single outbound credential; a warm pool delivers sub-second creation but burns money at rest; and the agents inside must answer user requests and scheduled jobs instantly, even though they sit idle most of the time. This talk shows how OpenKruise Agents squares that triangle by combining horizontal and vertical elasticity on the warm pool, on-the-fly token injection through an agent gateway, and smart sandbox pause-and-resume. The takeaway: with Envoy and OpenKruise in-place update, production-grade agent sandboxes are already within reach.