Sandboxes are ~difficult~ to run at scale as a reliable service. There is no free lunch. Tradeoffs are very real and providers excel at different things. They're a ways away from being completely commoditized
Highly recommend for anyone who’s ever tried making a video with an agent. This works 10x better than anything you’ve tried.
Bonus is add remotion skills along with the https://t.co/QcbNf1ajGk diffusion skills
Persistent sandboxes & durable shared storage feel like the right primitives for autonomous engineering.
The magical part, at least for me, is when an agent can test its changes against real infrastructure. The tedious parts of our stack isn't the actual coding, its the devops loop around it. How does this k8s change impact sandbox deployment rollouts? Does adding a new protocol message type for our shared filesystem break existing filesystems? Does the new image actually boot correctly with nested-virt?
These are scenarios the codex/claude code/whatever can test without my input now. I attach the required creds to the sandbox, and just spin up codex (with --dangerously-bypass-approvals-and-sandbox of course) and let it get to work. I can do that by making sure the sandboxes the agents start up with have an appropriate gcp service account, letting claude/gpt create the resources it needs to test.
So now the question is how to scale that. Can development become deploying a fleet of agents on durable, credential-scoped computers that can build, deploy, observe, debug, and iterate against real infrastructure in parallel? I think it can, we just need the right primitives.
Working on getting our shared filesystem that we use for sandboxes working on mac.
The question is could we make sharing agentic workloads between your laptop and the cloud feasible by just sharing the filesystem across those locations?
Our filesystem ('basin') is a FUSE filesystem that stores deduplicated "blocks" in object storage. Fortunately, it also supports a local mode where it just writes the blocks to disk. Unfortunately, it is FUSE, which mac doesn't support natively. I could have gone with macFUSE, or I could just write my own adapter utilizing Apple's FSKit which maps FSKit operations to FUSE. I went with the latter, building 'fusekit' which allows mounting any FUSE filesystem on mac, as long as it supports communicating with a file descriptor.
Still some work to do, but I'm excited to spin up a bunch of agentic coding session remotely, and still work with them as if they were local.