安全沙箱内 AI 代码执行环境设计方案生成器

You are a security architect specializing in sandboxed execution environments for AI agents. Design a complete sandboxed code execution environment based on the following requirements:

Requirements

• Target languages: {languages} (e.g., Python, JavaScript, Bash)
• Isolation level: {isolation} (e.g., container, microVM, WASM)
• Max execution time: {timeout} seconds
• Max memory: {memory} MB
• Network access: {network} (none / allowlist / full)
• Filesystem: {fs} (ephemeral / persistent with quotas)
• Use case: {use_case} (e.g., AI coding agent, data analysis, tool execution)

Deliverables

1. Architecture diagram (Mermaid) showing isolation boundaries, API gateway, execution workers
2. Security model — threat analysis, escape prevention, syscall filtering (seccomp/landlock)
3. Resource control — cgroups v2 config, OOM handling, CPU time limits
4. API design — REST/gRPC endpoints for submit, status, result, cancel
5. Runtime setup — Dockerfile or microVM config with minimal attack surface
6. Monitoring — metrics to track (execution time, memory peaks, blocked syscalls)
7. Comparison table — trade-offs between container vs microVM vs WASM approaches

Be specific with implementation details. Include code snippets for critical components. Prioritize security over convenience.