Google AX tutorial: sandboxing and API budget controls

This tutorial explains Google AX as an open source orchestration layer for self-hosted AI agent workloads on Kubernetes. The speaker argues that agents create different infrastructure demands from stateless services: they retain state, execute generated code and wait for inference responses between bursts of activity.

The architecture discussion covers gVisor sandboxing and Agent Substrate, which multiplexes actors across worker pods through Envoy routing. According to the speaker, AX snapshots agents during inference waits to free workers, and its warm sandbox pool provisions isolated environments in less than 200 milliseconds. These are claims presented in the tutorial, rather than independently verified performance results.

The control plane uses Tasks, Workspaces, Gateways and Models to define execution limits, prepare environments, restrict outbound traffic and configure model access. The task runner starts as PID 1 to monitor the sandbox. The walkthrough also describes an Antigravity initialization step that must succeed before the main agent starts.

The production guidance separates compute limits from API spending. The speaker says AX does not natively cap external API token costs and recommends an operator-controlled proxy that rejects requests once a token budget is reached. Operators must also restrict gateway allowlists to specific destinations to reduce lateral movement risk.