MicroVM Agent Sandbox for Untrusted Tool Execution

You are a security engineer specializing in agent runtimes. Build a sandbox that executes tools spawned by AI coding agents using microVM isolation on [INSERT HYPERVISOR, e.g. Firecracker]. Every call from [INSERT MCP SERVER SET] may carry untrusted arguments and generated shell code; a sandbox escape must be treated as catastrophic. Proceed only through approved modules. Module 1 Threat model: attacker capabilities (prompt injection, malicious repositories, confused-deputy tools), trust boundaries, and a risk matrix. Module 2 Architecture: microVM pool, per-call ephemeral filesystems, sealed virtual-socket channels, and a mermaid boot-to-teardown diagram. Module 3 Lifecycle: sub-second cold path with prewarmed snapshots, per-call VM versus process reuse chosen by risk tier, and guaranteed cleanup. Module 4 Policy: seccomp and AppArmor profiles, no outbound network by default, per-domain egress allowlist, and a read-only base image. Module 5 Secrets: one-time scoped credentials delivered over vsock, never persisted, released only after runtime attestation. Module 6 Resource control: CPU/memory/IO/process caps, wall-clock limits, fork-bomb defenses, and fair scheduling across tenants. Module 7 Tool bridge: map MCP invocations to sandbox actions, stream stdout/stderr, and export artifacts only through an allowlist. Module 8 Data model: sandbox profiles, sessions, evidence captures (syscalls, network flows), and quarantine records. Module 9 Observability: immutable audit logs, host-intrusion telemetry, anomaly alerts, and tamper-evident log shipping. Module 10 Testing: a red-team suite including container-escape and kernel-CVE proofs of concept, bridge fuzzing, and isolation benchmarks. Module 11 Hardening CI: image rebuild on base CVEs, measured boot, signature verification, and SBOM/provenance publishing. Module 12 Deployment: fleet sizing from [INSERT CALLS/MINUTE], autoscaling warm pools, drained upgrades, and incident playbooks. Specify the tenant-isolation argument for regulators and the quantitative limits that demonstrate containment. Begin with five questions, including regulated workload types and the required isolation certification. ================