Deploying gVisor on Kubernetes for AI agent sandboxes
What our gVisor rollout tested beyond installation: runtime configuration, real Kubernetes workloads, fresh nodes, and verification after a reboot.
Blog
Notes from building a cloud AI agent.
Engineering writeups from running plori: agents that each get a persistent environment, a real disk over FUSE, and a bill that stops when they sleep. Measured numbers and production incidents, not launch announcements. For what the product does, see the docs.
AI agent retries: avoiding duplicate tool calls
A recovery drill showed why an interrupted agent can have a completed tool call. Check saved results before retrying, and handle uncertain outcomes.
How to test AI agent sandbox persistence
An agent read its new file, but a later reader could not. Test the latest bytes after sleep and replacement, with lessons from a controlled storage drill.
GPT prompt caching: how to improve cache hit rates
A practical GPT prompt-caching guide with real before-and-after numbers: exact prefixes, GPT-5.6 breakpoints, cache keys, metrics, and debugging probes.
How to secure a cloud AI agent that can run arbitrary code
A practical handbook for hosted agents, drawn from a real environment leak: subprocesses, scoped tokens, network policy, /proc, and regression tests.
DeepSeek's agent harness makes everything a plugin, even the approval policy
An early read of DeepSeek's dsh agent harness: an event-sourced session log and deny-only tool guards, with the safety policy in a swappable config layer.
One AI agent used 1.06M tokens and never wrote the patch
A max-turn cap keeps an agent from running forever, but cannot tell work from waste. We catch repeated failures and save partial work before stopping.
Our model router was overpaying 33x for the same results
Our router paid 33x more for every model call. A control run on the cheapest candidate resolved the same 34 of 50 tasks at 44% of the model spend.
What a Kubernetes warm pool cannot prewarm for a stateful AI agent
A stateful AI agent warm pool should prewarm runtimes, then bind the existing disk, tenant identity, and final credentials atomically at claim time.
The workflow engine said OK after a failed step
An RPC acknowledgement can be OK while a workflow step fails. The durable terminal record, not the transport ACK, must define the execution result.
Why we put a server between our AI agents and JuiceFS
JuiceFS CE enforces --subdir, quotas, and ACLs in the client. Our clients are untrusted AI agents, so isolation lives in a server in front.
We let 443 dead FUSE mounts pile up and it wedged kubelet
How 443 dead FUSE mounts wedged kubelet teardown and starved a node, plus the 60-second janitor that fixed it. With the nsenter and /proc/mounts traps.
We moved JuiceFS metadata from Postgres to Redis and file ops got 7x faster
A production JuiceFS migration: metadata moved from Postgres to Redis, create+rename 22ms to 3.2ms (~7x). Durability config, RAM ceiling, dump/load steps.
Every post is also available as plain Markdown: request it with an Accept: text/markdown header, or append .md to the URL. Agents can start from llms.txt.