--- schema: 1 type: video title: >- From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI description: >- Sandboxes unleash agents by giving them secure, fully functional computers where they can tackle diverse tasks with minimal setup. This talk explores the architectural challenges of building an agent sandbox cloud. We compare runtime isolation technologies and their trade-offs, examine persistence and storage as the next major unlock for agent capabilities, and discuss the key decisions involved in orchestrating and scaling sandboxes. Abhishek Bhardwaj works on Agent and Reinforcement Learning Infrastructure at OpenAI. He builds systems that enable large-scale model training in RL environments, as well as secure and scalable cloud sandboxes for OpenAI’s agents. Before joining OpenAI, he created Arrakis, an open-source sandbox for AI agents. Previously, he worked at Google on ChromeOS and foundational microVM technologies, and at Replit on core infrastructure and early versions of Replit Agent. Timestamps 0:00 Introduction and motivation for AI agent sandboxes 1:31 Why AI models need tools and execution environments 3:51 Product-side challenges: Security and the need for sandboxing 6:44 Comparing research vs. product sandbox requirements 8:24 Overview of the three pillars: Runtime, Persistence, and Orchestration 9:05 First principles of Linux execution: System calls and security vectors 11:15 Evaluating fork() and exec models 12:06 Understanding containers: Namespaces and cgroups 16:26 GVisor as an application kernel alternative 18:29 Hardware-level virtualization (Virtual Machines) 20:34 How VMMs (Virtual Machine Monitors) work with KVM 23:16 Evolution of modern VMMs and Rust-based safety 24:32 What defines a "microVM"? 25:43 Orchestrating microVMs via APIs 27:16 Trade-offs of microVMs (performance vs. security) 30:05 The need for persistent storage in agent sandboxes 31:40 Use cases for persistence: Reliability, long-running tasks, and research 34:36 Design choices for disk snapshotting 36:03 First principles of Linux block storage and file systems 37:25 Implementing always-on vs. explicit persistence 41:20 Scaling and orchestrating sandboxes at fleet level --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/OqM67QG_Ikk-from-fork-to-fleet-designing-an-agent-sandbox-cloud-abhishek-bhardwaj-openai Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: 'https://liquidgold.cc/watch/OqM67QG_Ikk' markdown: 'https://liquidgold.cc/watch/OqM67QG_Ikk.md' llms: 'https://liquidgold.cc/watch/OqM67QG_Ikk/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T07:51:45.328Z' language: null children: [] videoId: OqM67QG_Ikk durationSeconds: 2674 publishedAt: '2026-07-13T17:00:06.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 101 endSeconds: 235 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=101' heldReason: rights - ordinal: 1 text: null startSeconds: 101 endSeconds: 235 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=101' heldReason: rights - ordinal: 2 text: null startSeconds: 245 endSeconds: 409 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=245' heldReason: rights - ordinal: 3 text: null startSeconds: 409 endSeconds: 420 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=409' heldReason: rights - ordinal: 4 text: null startSeconds: 520 endSeconds: 545 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=520' heldReason: rights - ordinal: 5 text: null startSeconds: 558 endSeconds: 679 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=558' heldReason: rights - ordinal: 6 text: null startSeconds: 690 endSeconds: 737 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=690' heldReason: rights - ordinal: 7 text: null startSeconds: 750 endSeconds: 988 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=750' heldReason: rights - ordinal: 8 text: null startSeconds: 750 endSeconds: 988 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=750' heldReason: rights - ordinal: 9 text: null startSeconds: 1001 endSeconds: 1109 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1001' heldReason: rights - ordinal: 10 text: null startSeconds: 1119 endSeconds: 1243 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1119' heldReason: rights - ordinal: 11 text: null startSeconds: 1256 endSeconds: 1400 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1256' heldReason: rights - ordinal: 12 text: null startSeconds: 1411 endSeconds: 1481 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1411' heldReason: rights - ordinal: 13 text: null startSeconds: 1493 endSeconds: 1549 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1493' heldReason: rights - ordinal: 14 text: null startSeconds: 1561 endSeconds: 1640 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1561' heldReason: rights - ordinal: 15 text: null startSeconds: 1650 endSeconds: 1811 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1650' heldReason: rights - ordinal: 16 text: null startSeconds: 1911 endSeconds: 2076 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=1911' heldReason: rights - ordinal: 17 text: null startSeconds: 2087 endSeconds: 2164 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=2087' heldReason: rights - ordinal: 18 text: null startSeconds: 2177 endSeconds: 2245 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=2177' heldReason: rights - ordinal: 19 text: null startSeconds: 2256 endSeconds: 2483 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=2256' heldReason: rights - ordinal: 20 text: null startSeconds: 2494 endSeconds: 2674 watch: 'https://liquidgold.cc/watch/OqM67QG_Ikk?t=2494' heldReason: rights --- # From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI Sandboxes unleash agents by giving them secure, fully functional computers where they can tackle diverse tasks with minimal setup. This talk explores the architectural challenges of building an agent sandbox cloud. We compare runtime isolation technologies and their trade-offs, examine persistence and storage as the next major unlock for agent capabilities, and discuss the key decisions involved in orchestrating and scaling sandboxes. Abhishek Bhardwaj works on Agent and Reinforcement Learning Infrastructure at OpenAI. He builds systems that enable large-scale model training in RL environments, as well as secure and scalable cloud sandboxes for OpenAI’s agents. Before joining OpenAI, he created Arrakis, an open-source sandbox for AI agents. Previously, he worked at Google on ChromeOS and foundational microVM technologies, and at Replit on core infrastructure and early versions of Replit Agent. Timestamps 0:00 Introduction and motivation for AI agent sandboxes 1:31 Why AI models need tools and execution environments 3:51 Product-side challenges: Security and the need for sandboxing 6:44 Comparing research vs. product sandbox requirements 8:24 Overview of the three pillars: Runtime, Persistence, and Orchestration 9:05 First principles of Linux execution: System calls and security vectors 11:15 Evaluating fork() and exec models 12:06 Understanding containers: Namespaces and cgroups 16:26 GVisor as an application kernel alternative 18:29 Hardware-level virtualization (Virtual Machines) 20:34 How VMMs (Virtual Machine Monitors) work with KVM 23:16 Evolution of modern VMMs and Rust-based safety 24:32 What defines a "microVM"? 25:43 Orchestrating microVMs via APIs 27:16 Trade-offs of microVMs (performance vs. security) 30:05 The need for persistent storage in agent sandboxes 31:40 Use cases for persistence: Reliability, long-running tasks, and research 34:36 Design choices for disk snapshotting 36:03 First principles of Linux block storage and file systems 37:25 Implementing always-on vs. explicit persistence 41:20 Scaling and orchestrating sandboxes at fleet level --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/OqM67QG_Ikk-from-fork-to-fleet-designing-an-agent-sandbox-cloud-abhishek-bhardwaj-openai Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/watch/OqM67QG_Ikk · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.