Open source security company Chainguard has released Workspaces, a service designed to provide a safe space for agents to do their thing without disrupting the security of existing operations.
The market for platforms to host agents is large and growing daily, though Chainguard’s expertise in security solves a major problem with running agents, namely managing credentials and permissions.
For administrators and developers, Chainguard Workspaces and its companion release, Chainguard Checks, provide a first step in using AI for software development. Running agents in parallel, one could fix all the bugs in a large codebase, migrate code to a new language or run vulnerability remediation campaigns across entire repositories, all with minimal intervention.
Today, if an administrator or other company employee sets up an agent on a server or their laptop, that agent can inherit a full set of permissions from its creator, including network access, cloud keys, and entry to local resources.
But if everything is locked down, the user is setting themselves up for a case of prompt fatigue approving each individual case where permissions are needed.
Chainguard promises an approach that secures agents while maintaining a relatively hands-off approach for the user.
How Chainguard Workspaces Operates
Chainguard Workspaces, now in beta, puts the agents in hardware-isolated ephemeral microVMs, thereby not exposing them unduly to production systems.
Chainguard built these microVMs from zero-CVE Chainguard OS packages and FIPS-compliant toolchains.
An agent, housed in a microVM, can be spun up or resumed in seconds, and mapped to a specific repository, as well as to a local IDE and toolchain. Dependencies are kept in the VM, rather than downloaded from other sources.
To test newly generated code or revisions, Workspaces uses Chainguard Checks, a continuous integration execution engine, also recently released in beta. Somewhat like GitHub Actions, Checks allows agents to run tests before committing the code.
If the user stops responding to a session, the workspace will remain active for 10 minutes. After which, a snapshot will be made of the memory state and process and halted, and no additional compute spend will be incurred while paused.
Credentials are kept out of the workspace. Instead, the agents are given encrypted short-lived tokens that are useless for other parties. Each code change, request for credentials, and network call is logged.
Agent Platforms Prefer MicroVMs
MicroVMs have become the favored way of hosting agents due to a unique combination of traits. They can be spun up in milliseconds, but at the same time offer the same security isolation as a full virtual machine.
Other agent platforms that Workspaces will compete with include E2B, which offers a platform for ephemeral code execution using the Firecracker-based microVM sandboxes. Northflank built a microVM orchestration platform tuned for compliance-heavy industries, which can be run in the cloud. Other entrants in this space include Vercel Sandbox and Fly.io Sprites.
Not all agent platforms rely on microVMs.
For GPU-heavy Python workloads, Modal offers secure sandboxes built on Google’s gVisor, a user-space kernel. Daytona offers a set of fast-starting, stateful container and virtual machine sandboxes for agents.