k8e

项目详情摘要

**k8e.sh** — Open Source Agentic AI Sandbox Matrix. A **single binary under 100MB** that turns any Linux host into a secure, isolated execution platform for AI agents — gVisor, Kata, or Firecracker isolation, warm-pool fast starts, and an E2B-compatible API. Up and running in **60 seconds**. That's it. Your agentic sandbox matrix is ready. 🤖* 📖 Table of Contents # | Section | 1 | 🤖 What is K8E? | 2 | 🏗️ Architecture | 3 | ⚙️ Components | 4 | 🚀 Quick Start | 5 | 🔒 Sandbox Runtime Setup | 6 | 🤖 Sandbox CLI | 7 | 🖥️ Advanced Installation | 8 | 🆚 K8E vs Other Sandbox Platforms | 9 | 🤝 Contributing | 10 | 🙏 Acknowledgments | 🤖 What is K8E? K8E** is the **Open Source Agentic AI Sandbox Matrix** — a self-hosted sandbox platform for running secure, isolated AI agent workloads at scale, packaged as a single binary under 100MB. As autonomous AI agents increasingly generate and execute untrusted code, robust sandboxing infrastructure is no longer optional. K8E ships everything needed to spin up a production-grade cluster in under 60 seconds, with first-class primitives for agent isolation, resource governance, and ephemeral execution environments — purpose-built for the AI era. 🔒 **One cluster. Many agents. Zero trust between them.** Sandbox Capabilities Capability | Description | 🔒 **Hardware Isolation** | Pluggable runtimes: gVisor (default), Kata Containers, Firecracker microVM | 🌐 **Network Policies** | Cilium eBPF `toFQDNs` egress control — per-session, no proxy process needed; `allowed_hosts` enforced via `--cilium-dns-proxy` (KIP-16 M10) | ⚖️ **Resource Quotas** | CPU/memory caps per agent session to prevent runaway costs | 🗑️ **Ephemeral Workspaces** | Auto-cleanup after agent session ends; per-session workspace isolation for sub-agents (KIP-16 M1) | 🧠 **Warm Pool** | Pre-