Qualify GKE Agent Sandbox as the standard cloud computer provider #8

Project

Cloud computer platform

Source: Cloud computer scale architecture audit

Outcome

Implement and qualify GKE Agent Sandbox behind cloud_computer.v1 as a candidate standard provider. Use the same workspace, lease, command, event, security, metering, and cleanup contract as the Firecracker provider.

Constraints to preserve

• Current Google documentation requires GKE 1.35.2 or later for Agent Sandbox.
• The current enablement path uses gcloud beta, and the sandbox custom resources use v1alpha1.
• The snapshot documentation describes a manual controller installation as a temporary step until the add-on owns that path.
• GKE Sandbox forbids privileged containers, host namespaces, host paths, host ports, projected service-account tokens, and other host-level capabilities.
• A new provider must not become the only production path before it passes exact-candidate qualification.

Scope

• Create a private qualification cluster or isolated node pool on an admitted GKE version.
• Implement SandboxTemplate, SandboxWarmPool, SandboxClaim, and Sandbox lifecycle mapping behind the provider trait.
• Run as non-root, drop all Linux capabilities, disable service-account token mounts, use gVisor, and set hard resource limits.
• Apply default-deny network policy and route admitted egress through the same policy broker used by other providers.
• Restore and checkpoint workspaces through the common GCS contract.
• Bind runtime identity, events, commands, and cleanup to the exact sandbox and workspace generation.
• Implement warm-pool replenishment, claim timeout, cancellation, drain, replacement, and leak reconciliation.
• Measure startup, warm claim, repository checkout, dependency installation, command streaming, checkpoint, restore, density, and cost.
• Record unsupported tools or kernel behaviors as typed capability refusals.

Deliverables

• GKE Agent Sandbox provider adapter and infrastructure.
• Security and network policy configuration.
• Workspace restore and checkpoint integration.
• Compatibility, lifecycle, density, and failure benchmark report.
• Promotion or rejection decision against the standard runtime acceptance thresholds.

Acceptance criteria

• The provider passes the same stale-generation, unsafe-replay, cross-tenant, egress, cleanup, and metering tests as Firecracker.
• A claimed sandbox cannot mount host paths, receive ambient Google credentials, or observe another sandbox.
• Warm-pool reuse does not retain owner data, command state, or credentials.
• A failed or replaced sandbox cannot emit accepted events for the current generation.
• The benchmark compares GKE and Firecracker on one pinned workload corpus and reports operator work as well as runtime cost.
• Production routing retains an explicit fallback until the Google API and snapshot path meet the documented maturity gate.

Dependencies

Depends on #3, #4, #5, and #6.