Agentic AI systems have evolved far beyond basic text generation. Modern agent teams generate scripts, perform dynamic data processing, execute database queries, and write ephemeral helper functions to solve complex user requests.
However, allowing LLM-generated code to run within your core application context presents significant security risks. If an agent executes arbitrary code inside a standard container instance or app service host, malicious or buggy code could tamper with host memory, read sensitive environment variables, or hog shared compute resources.
To address this, Squad on ACA now leverages Azure Container Apps (ACA) Sandboxes, providing secure, rapid, and fully isolated execution environments for multi-agent workloads.
The Challenge of Dynamic Code Execution in Agent Teams#
When orchestrating autonomous agents, two primary issues arise when executing dynamic code:
- Security Isolation: Executing untrusted, LLM-written code in a multi-tenant or shared environment risks cross-agent contamination, unauthorized file access, or lateral movement across virtual networks.
- Latency & Provisioning Overhead: Traditional container orchestration (such as spinning up full Kubernetes Pods or separate ACA App instances per request) introduces multi-second cold starts. For interactive multi-agent workflows, waiting 10 to 30 seconds just to run a short script degrades the developer and user experience.
Why Azure Container Apps Sandboxes?#
As an evolution in containerized compute, Azure Container Apps Sandboxes introduce a dedicated, first-class ARM resource (Microsoft.App/SandboxGroups) designed specifically to solve these challenges.
Key Benefits:#
- Sub-Second Provisioning: Sandboxes are provisioned from prewarmed pools, delivering isolated compute environments in milliseconds.
- Strong Boundary Isolation: Each sandbox runs in its own secure, isolated boundary with dedicated CPU, memory, disk, and network controls, ensuring safe execution of untrusted code.
- Suspend & Resume Capabilities: Sandboxes support snapshotting full execution state (including memory and disk) to resume later with sub-second restore times—ideal for asynchronous agent tasks.
- Scale to Zero & Cost Efficiency: Compute resources automatically scale down, ensuring zero CPU or memory fees when sandboxes are stopped.
- OCI Container Image Support: Custom root filesystems can be supplied via custom or public OCI container images.
Why Squad on ACA + ACA Sandboxes is a Game Changer#
Building multi-agent systems on Squad on ACA with sandbox integration changes the architectural equation for enterprise deployments.
- Safe Code Interpreter Capabilities: Agents within the squad can write and run code to analyze datasets, render visual charts, or process complex payloads without risking host application stability.
- State Preservation Across Tasks: Thanks to sandbox suspend and resume features, agents can pause execution during multi-step operations and pick up right where they left off with full context intact.
- Scoped Sandbox Groups: Workloads can be organized logically into Sandbox Groups, isolating team environments, application tiers, or specific user sessions.
- Optimized Compute Costs: Sandboxes automatically suspend or auto-delete based on idle lifecycle policies, keeping operational costs low.
Architectural Thought Process: Design Decisions in Squad on ACA#
When integrating ACA Sandboxes into Squad on ACA, several key operational design choices were made:
1. Direct Abstraction of Sandbox Resource Management#
Rather than forcing agents to deal with raw cloud APIs, Squad on ACA treats sandboxes as an injectable execution provider. The agent requests code execution or file manipulation through standard tool abstractions, while the framework handles the underlying Sandbox Group interactions, security tokens, and data-plane calls.
2. State-Aware Task Execution#
Leveraging the snapshot and lifecycle capabilities of ACA Sandboxes, Squad on ACA maps agent lifecycles directly to sandbox states:
- Interactive Tasks: Keep the sandbox running or auto-suspend it between turns, preserving working disk and memory context for follow-up prompts.
- One-Shot Runs: Execute lightweight tasks in ephemeral sandboxes configured with aggressive auto-delete policies post-execution.
3. Diagnostic Telemetry & Self-Correction Loops#
Squad on ACA captures standard output, standard error, execution status, and timing metrics directly from the sandbox plane. This structured output is surfaced back to the calling agent, allowing LLMs to detect syntax or runtime errors and automatically attempt self-correction.
Resources & Further Reading#
Explore these official Microsoft resources and the project repository to start implementing sandboxed agent execution: