Stop Duct-Taping Your Agent Sandbox. GKE Just Built It Properly.

The Problem Every Agent Builder Knows Your agent just generated some Python. Now what? You need to run it. Somewhere. Safely. Without it touching your prod database, your secrets, your other pods, or anything else it wasn't supposed to touch. So you cobbled something together. Maybe a size-1 StatefulSet with gVisor. Maybe a subprocess with a timeout. Maybe a Docker container you spin up per-request and pray the cold start isn't too painful. It works — mostly . Until it doesn't. The DIY agent san