Get started with sandboxes

Get started by running your first isolated pod, then move to confidential pods when you need to protect workload data from the node. Use resource isolation to cap the host resources a single sandbox consumes.

Before you benchmark a workload, raise the default network limits so they do not cap request-heavy services. For more information, see Raising network bandwidth.

To learn more about getting started, see Sandboxing blueprints. They are runnable, end-to-end examples for AI coding agents, warm pools, CI/CD runners, storage, network policy, and confidential pods. Each one includes the manifests, scripts, and step-by-step instructions to run it in your own cluster.