gVisor sandboxes for Ray clusters on GKE

Reinforcement learning (RL) frameworks increasingly rely on Ray to manage distributed post-training workloads, including trainers, inference engines, and rollout workers. A new experimental library integrates gVisor sandboxing directly into Ray clusters, enabling secure isolation for dynamic code execution and multi-turn tool interactions without disrupting existing Ray workflows. The sandboxing model uses Ray Actors to handle lifecycle management, resource allocation, and failure recovery, while gVisor provides the isolation layer via an OCI-compatible runtime. Starting with Ray 2.58, developers can create and manage sandboxes using standard Ray APIs, treating them as first-class distributed resources within the cluster.

The integration leverages gVisor, an open-source application kernel developed by Google, to enforce stronger isolation than traditional containers by implementing parts of the Linux system-call interface in userspace. This approach avoids exposing host Docker daemons or sockets to sandboxes, reducing attack surfaces for untrusted code execution. The design prioritizes lightweight, sub-second startup times and minimal memory overhead, making sandboxes practical for fine-grained distributed tasks such as agentic workloads or model-generated code execution. Future updates may expand support to additional runtimes like Agent Substrate or Kata Containers.

For users on Google Kubernetes Engine (GKE), the new sandboxing capabilities are accessible via a dedicated Ray sandboxing user guide, which outlines deployment steps and configuration options. The guide provides examples for creating pools of sandboxes within actors and executing untrusted code in isolated environments, aligning with Ray’s existing programming model. The experimental library is designed to integrate seamlessly with frameworks such as veRL, NeMo-RL, SLIME, MILES, and SkyRL, which already depend on Ray for orchestration.

Google and Anyscale invite feedback on the experimental sandboxing features through a GitHub issue, encouraging collaboration to refine the technology for reinforcement learning workloads. The announcement highlights a shift toward safer, scalable isolation mechanisms for AI workloads, addressing security concerns in dynamic, multi-turn agentic systems. Documentation and community discussions are available to support adoption and experimentation with the new capabilities.