Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Because a standard Docker container shares the host Linux kernel, it does not provide a sufficient security boundary for executing untrusted LLM-generated code or third-party agent tools. This course teaches how to architect hardware- and kernel-isolated sandboxes for code interpreters, data analysis pipelines and computer/browser-use agents.

Participants compare gVisor, Firecracker microVMs, Kata Containers, WebAssembly (Wasm) and E2B-style ephemeral runtimes, finishing with a complete sandbox control plan covering cgroups quotas, read-only filesystems and zero-trust egress network policies.

Who Should Attend?

  • AI platform, infrastructure and Kubernetes/cloud engineers
  • Teams building code interpreters and autonomous coding or data agents
  • Cloud and infrastructure security architects
  • Prerequisite: Linux container fundamentals, Docker/Kubernetes and basic network security

Key Takeaways

  • Explain why standard OS-level containers are insufficient for untrusted agent code execution
  • Select between gVisor, Firecracker microVMs and WebAssembly sandboxes based on workload profile
  • Configure isolated agent execution pools on Kubernetes using RuntimeClass
  • Enforce CPU, memory, disk, PID and strict network egress policies around sandboxed tasks
  • Architect fast-booting (warm-pool / snapshot) ephemeral sandbox lifecycles and state teardown

Curriculum

Why Agent Workloads Require Hard Isolation Boundaries
  • Kernel and side-channel risks in code interpreters, file parsers and headless browsers
  • Why language-level restrictions (such as RestrictedPython) fail as a security boundary
Sandboxing Technologies: gVisor, Firecracker, Kata and Wasm
  • Comparing user-space kernels (gVisor) with lightweight microVMs (Firecracker / Kata Containers)
  • WebAssembly (WASI) sandboxes for fast, deterministic tool execution
Filesystem, Resource and Network Isolation
  • Seccomp, AppArmor, read-only root filesystems, ephemeral tmpfs mounts and cgroups v2 quotas
  • Default-deny network egress, DNS filtering, cloud metadata (IMDS) blocking and egress proxies
Ephemeral Lifecycle Management and Performance
  • Sub-second microVM startup using snapshot/restore and pre-warmed execution pools
  • Guaranteed teardown of memory, disk artefacts and ephemeral credentials after each session
Sandboxing Browser and Computer-Use Agents
  • Isolated Playwright/Chromium sessions, credential partitioning and blocking internal (RFC 1918) networks
  • Sandbox telemetry, anomalous syscall detection and automated session termination

Other Courses in This Category

  • Prompt Injection Attacks and Defenses for LLM Applications

    Hands-on training on direct prompt injection, jailbreak techniques and system prompt leakage, showing developers how to detect and defend against them with input classifiers, instruction hierarchy and tools such as garak.

    AI Security & Red Teaming Corporate
    Live Course
    6 modules
    View
  • Indirect Prompt Injection in RAG and Agent Systems

    Covers hidden instructions delivered through web pages, emails, documents, RAG sources and MCP tool outputs, data exfiltration chains, and architectural defences such as spotlighting, the dual-LLM pattern and CaMeL.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Sensitive Data Exposure in LLM Applications

    Teaches how sensitive data leaks from LLM applications through memorisation, secrets in system prompts, unauthorised RAG access, cross-tenant leakage and logs, and how to prevent it with permission-aware retrieval and DLP controls.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Tool Misuse and Excessive Agency in AI Agents

    Shows how to control excessive functionality, permissions and autonomy granted to AI agents using tool design, parameter validation, approval flows and an agent permission matrix, based on OWASP LLM06 and agentic risk guidance.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • RAG Poisoning and Knowledge Base Security

    Explains how poisoned documents planted in a knowledge base manipulate retrieval results and LLM answers, and how to prevent this with ingestion pipeline controls, source trust scoring and retrieval anomaly monitoring.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • AI Model and Supply Chain Security Risks

    Covers pickle-based code execution, backdoors, licensing and provenance risks in models sourced from hubs such as Hugging Face, and how to manage them with safetensors, ModelScan, model signing and an AI-BOM (CycloneDX).

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View

Get in touch