8 views
This guide focuses on coding agent sandbox for production systems, with practical trade-offs for reliability, security, and cost.
coding agent sandbox: production guidance
Project day. Build an ephemeral coding-agent sandbox on ECS Fargate: no prod credentials, locked egress, evidence bundle on exit. This is the reference isolation boundary for Implementer agents.
⚡ TL;DR: One task per run. Task role = sandbox only. Block IMDS tricks via hop limit + egress proxy. On stop, upload evidence.tar (events, diffs, junit, image digest).
Architecture
API → enqueue run → ECS RunTask (Fargate)
├─ clone repo at SHA
├─ agent loop (intents only)
├─ unit tests
└─ upload evidence → S3 → stop
Task definition sketch
json
{
"family": "coding-agent-sandbox",
"networkMode": "awsvpc",
"requiresCompatibilities": ["FARGATE"],
"cpu": "1024",
"memory": "2048",
"taskRoleArn": "arn:aws:iam::123:role/agent-sandbox",
"containerDefinitions": [{
"name": "agent",
"image": "123.dkr.ecr.us-east-1.amazonaws.com/agent@sha256:…",
"environment": [
{"name": "RUN_ID", "value": "REPLACE"},
{"name": "AWS_EC2_METADATA_DISABLED", "value": "true"}
]
}]
}
No prod creds
Sandbox may write only to an evidence bucket prefix. Denyiam:*, ssm:*, and prod account resources on the task role.
bash
# launch
aws ecs run-task --cluster agents --task-definition coding-agent-sandbox \
--network-configuration "awsvpcConfiguration={subnets=[subnet-x],securityGroups=[sg-y],assignPublicIp=DISABLED}" \
--overrides '{"containerOverrides":[{"name":"agent","environment":[{"name":"RUN_ID","value":"run_7f3a"}]}]}'
Evidence on exit
bash
tar -czf /tmp/evidence.tgz events.jsonl diff.patch junit.xml image-digest.txt
aws s3 cp /tmp/evidence.tgz s3://agent-evidence/run_7f3a/evidence.tgz
Acceptance criteria
- [ ] Digest-pinned image
- [ ] Task role cannot touch prod data
- [ ] Egress allowlist / proxy in place
- [ ] Evidence bundle uploaded
- [ ] Task stops (no long-lived workers)
Closing checklist
- [ ] Ephemeral Fargate tasks
- [ ] Sandbox IAM only
- [ ] Evidence bundle always
- [ ] Private subnets + controlled egress
- [ ] Correlate CloudTrail with run_id tags
Series navigation
Day 69: Policy as Code for Shell and Apply · Day 71: Token Budgets per PR and per Engineer Last updated September 11, 2026 Related: AWS Lambda Coding Agent Sandbox: Safe Tool Isolation for LLM Agents; Secure AI Sandboxes: Ephemeral ECS Tasks for Agent Tool Execution; Multi-Tenant Coding Assistants: Isolated ECS Fargate Spot Runtimes.Watch: 100 Days of AI on YouTube
Short videos from CheatCoders, one AI engineering topic per day.
Most viewed
- Python Decorators Explained: From Simple Wrappers to Production Patterns
- Claude Code vs Cursor vs GitHub Copilot: Choose by Workflow, and Set Up One Repo That Works With All Three
- AI Agent Frameworks in 2025: LangGraph vs CrewAI vs AutoGen vs Raw API
- Python String Methods: Every str Method With Real Production Examples
- Css Animation Performance: Performance-Optimized Motion for Modern UIs
Newly added
- AWS Systems Manager Parameter Store: Hierarchical Runtime Config for Coding Agents
- Amazon Cognito Identity Pools: Federate Coding-Agent Tool Callers Without Long-Lived Keys
- Amazon Athena for Coding Agents: Query Tool Audit Logs and Eval Traces on S3 Without a Warehouse
- AWS Batch for Coding Agents: Parallel Overnight PR Reviews and Long-Running Jobs Without Lambda Timeouts
- Amazon Bedrock Prompt Management: Version and A/B Test Coding-Agent System Prompts
Deep-dive PDF
Get the expanded guide for this post — extra diagrams-style checklists, failure modes, and a production walkthrough. Free when you subscribe to CheatCoders.
Already subscribed? or open the subscribe page.
Discover more from CheatCoders
Subscribe to get the latest posts sent to your email.
