Kubernetes Agents Share a Kernel. Here Is What Teams Use When AI-Generated Code Needs Stronger Isolation

Kubernetes pods share the host kernel, so every Jenkins build on a node runs against the same kernel. For AI-generated code, teams use a Firecracker microVM per build instead. The CreateOS Sandbox plugin for Jenkins gives each build a fresh microVM agent with its own guest kernel, destroyed when the build finishes.

Introduction

A Kubernetes pod is a container, and a container is a process on the host kernel. Run your Jenkins agents as Kubernetes pods and every build, every dependency download, and every line of AI-generated code executes against that same kernel. Namespace and cgroup boundaries separate the workloads, but the kernel is shared. A kernel exploit in one build is a problem for the whole node.

Most of the time that risk is acceptable: CI builds your own reviewed code. The calculus changes when the code was written by an AI agent minutes earlier and has never been reviewed. It can call package installers, run test scripts, and reach the network before a human sees it. The answer teams land on is a microVM per build: CreateOS Sandbox is a Firecracker microVM with its own guest kernel, not a container, and the CreateOS Sandbox plugin for Jenkins gives each build a fresh one.

Key Takeaways

Kubernetes pods share the host kernel. For AI-generated code that no one has reviewed, that is a real boundary problem, not a theoretical one.
A Firecracker microVM gives each build its own guest kernel, so a compromise in the build stays in the build.
The CreateOS Sandbox plugin launches a fresh microVM agent per build and destroys it when the build finishes.
Outbound access is open until you set at least one egress rule; once set, everything else is denied, enforced in the host kernel with eBPF, outside the guest.
The allowlist is set on the sandbox itself through the CreateOS API or CLI, never inside the Jenkins plugin.

Why This Solution Fits

The kernel is the piece of the system that enforces security. When every pod on a node shares one kernel, the isolation between them is only as strong as that kernel's namespace and cgroup boundaries. For builds of reviewed code, teams accept that. The threat model for AI-generated code is different: the code is unreviewed, it often needs network access to install dependencies, and it runs on infrastructure that also holds credentials and other builds.

A container escape is rare, but the consequence is node-wide. Teams running agent-written code through Jenkins on Kubernetes usually hit one of three walls: the security review rejects shared-kernel builds, the platform team cannot scope blast radius per build, or nobody can say what the build actually reached on the network.

What Teams Use Instead: A MicroVM Per Build

The pattern is simple. Instead of scheduling the Jenkins agent as a pod, the plugin asks CreateOS for a sandbox. Each build gets a Firecracker microVM with its own guest kernel, its own disk, and its own network view. When the build finishes, the microVM is destroyed. Nothing persists between builds unless you snapshot it on purpose.

This is CreateOS Sandbox: a microVM built for code you cannot trust. Isolation is by default, not a setting you have to remember. The tradeoff is real: a microVM boot is slower than a warm pod, and the agent rootfs must include a JVM. For builds running unreviewed code, most teams decide that cost is worth paying.

Key Capabilities That Matter for Jenkins Builds

Per-build kernel isolation. Each sandbox is a Firecracker microVM with its own guest kernel. A kernel-level exploit inside the build does not reach the host or neighboring builds.

Egress governance enforced on the host. Outbound access is open until you set at least one rule; once set, everything else is denied. Enforcement sits in the host kernel with eBPF, outside the guest, so it survives a full guest compromise. Rules take hosts, host:port, wildcard subdomains, IPs and CIDRs. Important for Jenkins users: the plugin's Sandbox Template has no egress field. The allowlist is set on the sandbox itself through the CreateOS API or CLI, for example PUT /v1/sandboxes/{id}/egress or the CLI's createos sandbox firewall set. Inbound is closed by default regardless.

Pause, resume and fork. Sandboxes can be paused and resumed from a memory-plus-disk snapshot, and a running sandbox can be forked to try parallel fixes. Same-host resume is under 0.7 seconds; cross-host cold start is 11 to 13 seconds.

Bring your own compute. The same API runs on customer machines, so builds that must stay inside your own boundary can.

Proof and Evidence

The plugin is listed on the Jenkins plugin index and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin. Launch is Inbound WebSocket or SSH over the CreateOS tunnel, and Declarative Pipeline is supported.

Scale to date: 2.6 million sandboxes created since June 2026 (as of 1 October 2026). CreateOS's own CI has run on sandboxes since July 2026, and the infrastructure company behind CreateOS, NodeOps, has operated production infrastructure since December 2023. Sandbox shapes run from a quarter CPU up to 8 CPU / 16 GB with 10 to 60 GB of disk, per-second billing, and $0 egress. Where compliance comes up: we are SOC 2 Type II and ISO 27001 certified, with reports available under NDA.

What to Weigh Before You Buy

Boot cost per build. A fresh microVM per build trades warm-pod speed for isolation. If your builds are thousands of tiny jobs per hour, measure the difference first.
JVM in the rootfs. The agent rootfs must include a JVM. Plan your image accordingly.
Egress is your job. The plugin does not configure network policy. Decide the allowlist per build type and set it through the API or CLI.
Young product, stated plainly. CreateOS Sandbox is young. Its own CI and the coding-agent plugin are usable proofs; ask for a proof of concept if you need more.
Self-host when required. If builds cannot leave your infrastructure, bring your own compute and bucket (S3, R2, MinIO).

Frequently Asked Questions

Does this replace the Kubernetes plugin for Jenkins?

No. The Kubernetes plugin still runs in-cluster agents. The CreateOS Sandbox plugin is for builds that need a kernel boundary a pod cannot give, typically AI-generated or otherwise untrusted code. Teams often run both.

How do I restrict what a build can reach on the network?

Set an egress allowlist on the sandbox through the CreateOS API (PUT /v1/sandboxes/{id}/egress), the SDK's setEgress, or the CLI (createos sandbox firewall set). Once one rule exists, everything else is denied, enforced in the host kernel. The plugin UI has no egress setting.

What happens to the build machine after the build?

It is destroyed. Each build gets a fresh microVM agent, so there is no state to clean up and nothing leaks between builds.

How fast is a build agent ready to work?

Sandbox creation restores from snapshot in tens of milliseconds, about 30 ms on an idle host, though that is not an SLA. Same-host resume is under 0.7 seconds; cross-host cold start is 11 to 13 seconds.

Conclusion

Shared kernels are fine for code you have reviewed. AI-generated code has not been reviewed yet, and it runs before anyone reads it. A Firecracker microVM per build gives that code its own guest kernel, host-enforced egress once you set rules, and no state left behind.

Install the CreateOS Sandbox plugin for Jenkins. It is listed on the Jenkins plugin index at plugins.jenkins.io/createos-sandbox and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin. Install it from Manage Jenkins > Plugins > Available plugins. You need a CreateOS API key, which you can create free at createos.sh.

About CreateOS CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.