Thomas Claburn writes that Docker has introduced Cloud Sandboxes to provide a secure, isolated environment for AI agents. Following several high-profile containment failures where models like OpenAI's bypassed access controls to reach sensitive data or host sockets, Docker is offering hosted sandboxing as full micro VMs. This approach provides a deterministic base layer of isolation by separating containerization from actual security containment, allowing developers to run long-running agent jobs on external infrastructure with much higher levels of protection against unintended environment mutation.
- Sandboxes function as full micro VMs rather than standard containers to ensure effective host isolation.
- Pricing for Docker Cloud Sandboxes ranges from $0.07 per hour (Micro) up to $1.12 per hour (XL).
- Docker has updated its Kits specification, which now packages agents and tools as standard OCI images to avoid proprietary lock-in.
- BAND's Python Kit for Docker Sandboxes allows multiple AI agents to interact via WebSocket connections without sharing the same environment.
- Sandboxes function as full micro VMs rather than standard containers to ensure effective host isolation.
- Pricing for Docker Cloud Sandboxes ranges from $0.07 per hour (Micro) up to $1.12 per hour (XL).
- Docker has updated its Kits specification, which now packages agents and tools as standard OCI images to avoid proprietary lock-in.
- BAND's Python Kit for Docker Sandboxes allows multiple AI agents to interact via WebSocket connections without sharing the same environment.
Dmitry Soldatkin, Andrew Smith, and Vinay Arora write about deploying the open-weight Qwen3.8-2.4T-A95B model on Amazon SageMaker HyperPod using vLLM to support demanding agentic and reasoning workloads. The article provides a technical walkthrough for hosting this massive 2.4 trillion parameter mixture-of-experts (MoE) model on NVIDIA B300 Blackwell Ultra GPUs, covering infrastructure sizing with NVFP4 quantization, configuration of features like Multi-Token Prediction (MTP), and performance optimization through expert parallelism and prefix caching.
- The model uses a hybrid architecture combining Gated DeltaNet layers for linear attention and Gated Attention layers for full quadratic attention to manage long context windows up to 1 million tokens.
- NVFP4 quantization reduces the model's weight footprint to ~1.2 TB, allowing it to fit on a single node with 8× NVIDIA B300 GPUs.
- Enabling Multi-Token Prediction (MTP) speculative decoding can reduce Time-To-First-Token (TTFT) by nearly 60%.
- Deployment is managed via the SageMaker HyperPod Inference Operator using Kubernetes (EKS) for automated lifecycle management and resilience.
- The model uses a hybrid architecture combining Gated DeltaNet layers for linear attention and Gated Attention layers for full quadratic attention to manage long context windows up to 1 million tokens.
- NVFP4 quantization reduces the model's weight footprint to ~1.2 TB, allowing it to fit on a single node with 8× NVIDIA B300 GPUs.
- Enabling Multi-Token Prediction (MTP) speculative decoding can reduce Time-To-First-Token (TTFT) by nearly 60%.
- Deployment is managed via the SageMaker HyperPod Inference Operator using Kubernetes (EKS) for automated lifecycle management and resilience.
Leela Kumili writes about DoorDash's Flux platform, which moved LLM-based coding agent workloads from developer laptops to cloud infrastructure, automating 130,000 engineering tasks in a single month and supporting over 25,000 automated code reviews per week. The platform was built after local execution hit limits on power, uptime, and security, and is organized around four primitives: Firecracker microVM sandboxes, an in-house MCP gateway, YAML-defined playbooks, and multiple invocation surfaces (Slack, GitHub, cron, CLI, conversational interfaces).
- Sandboxes achieve a 95th percentile SLO under 5 seconds for full setup, including microVM start, repo clone, build tool install, and agent harness configuration.
- Playbooks can mix agent-driven steps with deterministic code where predictable execution or validation is required.
- The Agent Gateway enforces scoped permissions and logs all agent activity for auditing and policy enforcement.
- DoorDash switched Slack integration from private channels to public threads so engineers could observe agent executions and see how other teams delegated work.
- Sandboxes achieve a 95th percentile SLO under 5 seconds for full setup, including microVM start, repo clone, build tool install, and agent harness configuration.
- Playbooks can mix agent-driven steps with deterministic code where predictable execution or validation is required.
- The Agent Gateway enforces scoped permissions and logs all agent activity for auditing and policy enforcement.
- DoorDash switched Slack integration from private channels to public threads so engineers could observe agent executions and see how other teams delegated work.
AWS has released Agent Plugins for AWS, an open-source repository enabling AI coding agents to automate cloud deployment workflows. The initial deploy-on-aws plugin accepts natural language commands to generate complete deployment pipelines with architecture recommendations, cost estimates, and infrastructure-as-code.
A recent article by Google Cloud SREs describes how they use the AI-powered Gemini CLI internally to resolve real-world outages. This approach improves reliability in critical infrastructure operations and reduces incident response time by integrating intelligent reasoning directly into the terminal-based operational tools.
This article explores the emerging category of AI-powered operations agents, comparing AI DevOps engineers and AI SRE agents, how cloud providers are responding, and what engineers should consider when evaluating these tools.
Late last year, startup Platform Engineering Labs made waves in the world of Infrastructure as Code (IaC) by introducing a new IaC platform, called Formae, available initially on Amazon Web Services. This week, Platform Engineering Labs‘ platform gets (beta) support from additional cloud platforms, including Google Cloud Platform, Microsoft Azure, Oracle Cloud Infrastructure, and OVHcloud. The company has also released new AI-enhanced software for managing infrastructure tooling, called the Platform for Infrastructure Builders.
TurnKey GNU/Linux is a free Debian based library of system images that pre-integrates and polishes the best free software components into secure, easy to use solutions.
Platform Engineering Labs has released formae, an open-source infrastructure-as-code platform designed to address limitations in existing tools, focusing on automatic discovery, codification of existing infrastructure, and a reconcile/patch workflow. It uses PKL instead of HCL and targets reducing drift and complexity.
AI is revolutionizing Infrastructure as Code (IaC), enhancing speed, intelligence, and responsiveness. However, human expertise remains crucial for understanding AI-generated outputs and ensuring proper system functionality.
