Apache-2.0, single-binary (<100MB) Kubernetes distribution for sandboxed AI agent execution; agents connect via the standalone k8e-sandbox-cli and /k8e-sandbox skill. DeepSeek Harness is not documented in the README, so it fits as an ecosystem sandbox tool.
DSH integration
Ecosystem-related
Author-claimed
Safety audit
Unaudited
Last verified
2026-08-21
License
Apache-2.0
01What can it help you accomplish?
Let an AI coding agent execute generated code in isolated Kubernetes sandboxes
Sandboxed runs via `k8e-sandbox-cli run` with auto session management — gVisor (default), Kata Containers or Firecracker isolation, per-session egress policy and ephemeral /workspace
Platform and agent engineers who want zero-trust execution of agent-generated code (README lists claude code, codex and pi as supported agents)
Stand up a production-grade sandbox cluster quickly
A CNCF-conformant Kubernetes cluster from a single binary under 100MB, up in ~60 seconds, with Sandbox Matrix starting automatically
Infra teams that need agent-sandbox infrastructure without a full Kubernetes build-out
02How to install into DeepSeek Harness
Prerequisites
- A sandbox runtime installed BEFORE K8E (recommended: gVisor — no KVM required; Kata Containers or Firecracker for stronger isolation)
- wget available for downloading the gVisor runsc binaries
Installation steps
- 01
Download runsc + containerd-shim-runsc-v1 from the gVisor release bucket, verify with sha512sum, then move both to /usr/local/bin/ (do not run `runsc install` — K8E manages its own containerd config)
- 02
Install K8E: `curl -sfL https://k8e.sh/install.sh | sh -`
$ curl -sfL https://k8e.sh/install.sh | sh -
- 03
Download the platform-specific `k8e-sandbox-cli` binary from GitHub releases, chmod +x, and symlink it to the plain name `k8e-sandbox-cli`
- 04
On the server create an API key: `k8e sandbox-apikey create my-agent`
- 05
Connect and install the agent skill: `./k8e-sandbox-cli --endpoint <server-ip>:50051 --apikey k8e-... connect`
Verify the integration
- export KUBECONFIG=/etc/k8e/k8e.yaml; kubectl get nodes
- kubectl get runtimeclass — should show: gvisor
- kubectl -n sandbox-matrix get pods — Sandbox Matrix starts automatically
03DSH integration and capability boundaries
K8E is a Kubernetes-native agentic sandbox matrix; the README makes no DeepSeek Harness/dsh claim — its /k8e-sandbox skill targets claude code, codex and pi harnesses via the standalone k8e-sandbox-cli
Pluggable hardware isolation
agent sessions / pods→gVisor (default, ~10ms boot), Kata Containers (~500ms) or Firecracker microVM (~125ms) isolation, auto-registered as RuntimeClass
writes the gVisor stanza into its own containerd config at /var/lib/k8e/agent/etc/containerd/config.toml on startupPer-session network egress control
sandbox session with `allowed_hosts`→Cilium eBPF `toFQDNs` egress enforcement per session, no proxy process needed
network access restricted to the allowed host list (default: pypi.org, files.pythonhosted.org, registry.npmjs.org, objects.githubusercontent.com, github.com, raw.githubusercontent.com)Agent skill via standalone CLI
`k8e-sandbox-cli` (~44MB standalone binary) + API key→`/k8e-sandbox` skill installed into the agent harness; run/create/destroy/read/write/session commands over gRPC (TLS)
`connect` symlinks the binary to ~/.local/bin/k8e-sandbox-cli and installs the /k8e-sandbox skill into agent harnessesremote access requires a server-side API key (default TTL 30 days)Ephemeral workspaces & resource governance
agent session lifecycle→auto-cleaned per-session /workspace, CPU/memory caps per agent session, warm pool with sub-500ms session claim latency
04Who is it for? When not to use it?
Good for
- Platform and agent engineers who want zero-trust execution of agent-generated code (README lists claude code, codex and pi as supported agents)
- Infra teams that need agent-sandbox infrastructure without a full Kubernetes build-out
Not for
- The README does not document DeepSeek Harness (dsh) support: the /k8e-sandbox skill explicitly targets claude code, codex and pi harnesses, so DSH users should treat K8E as an ecosystem tool until DSH support is published.
- The server-side install flow (install.sh piped to sh, systemd service, /etc/k8e paths) implies a Linux server environment, while the sandbox CLI ships for darwin/linux/windows; Firecracker additionally requires /dev/kvm.
05Compatibility, maintenance and safety notes
- The README does not document DeepSeek Harness (dsh) support: the /k8e-sandbox skill explicitly targets claude code, codex and pi harnesses, so DSH users should treat K8E as an ecosystem tool until DSH support is published.
- The server-side install flow (install.sh piped to sh, systemd service, /etc/k8e paths) implies a Linux server environment, while the sandbox CLI ships for darwin/linux/windows; Firecracker additionally requires /dev/kvm.
- Installation downloads binaries from the network (gVisor release bucket, GitHub releases, k8e.sh install script), and sandbox sessions have restricted egress — default allowlist only, custom hosts require `--allowed-hosts` / `--cilium-dns-proxy`.
Apache-2.0 · actively maintained (latest release v1.35.5-20260820-rc3+k8e1, 2026-08-20)
06Frequently asked questions
Does k8e integrate directly with DeepSeek Harness?
The README does not document DeepSeek Harness (dsh) support. Its /k8e-sandbox skill is installed into agent harnesses via `k8e-sandbox-cli connect`, and the README lists claude code, codex and pi as supported agents. Any harness able to invoke `k8e-sandbox-cli` shell commands can use the sandbox the same way.
How is K8E installed?
A single one-liner: `curl -sfL https://k8e.sh/install.sh | sh -`. K8E is a CNCF-conformant Kubernetes distribution in a single binary under 100MB, up and running in about 60 seconds. Install the gVisor runtime shim beforehand for the recommended default isolation.
What sandbox isolation options are available?
Pluggable runtimes: gVisor (default, syscall interception, ~10ms boot, no KVM needed), Kata Containers (VM-backed, ~500ms) and Firecracker microVM (~125ms, requires /dev/kvm). K8E auto-detects installed runtimes and registers the matching RuntimeClass.
Where does sandbox network traffic go?
Egress is enforced per session via Cilium eBPF `toFQDNs` policies. The default allowlist covers pypi.org, files.pythonhosted.org, registry.npmjs.org, objects.githubusercontent.com, github.com and raw.githubusercontent.com; custom hosts are set with `--allowed-hosts`.
How do I verify the installation?
Run `kubectl get nodes`, `kubectl get runtimeclass` (should show gvisor) and `kubectl -n sandbox-matrix get pods` — the Sandbox Matrix starts automatically. KUBECONFIG lives at /etc/k8e/k8e.yaml.
07Related DSH workflows
dsh-plugin-radar
by adamplatin123
An ecosystem radar for the DeepSeek Harness (dsh) plugin community that auto-discovers thousands of candidate plugins and runs continuous k8s-level validation, publishing the results as a browsable plugin catalog.
picgo-core
by picgo
:zap:The ultimate image uploading engine. Both CLI & API supports.
dsh-infinite-gen-3
by minglink
Armor-breaking plugin for DeepSeek that stabilizes jailbreak behavior ('Infinite Gen 3') — star the repo to support.
helloagents
by hellowind777
Autonomous AI companion that doesn't just analyze problems — it keeps working until the implementation is built and verified.
08Data and sources
Supported agents: **claude code**, **codex**, **pi**.
🔄 **SKILL + CLI** | AI agents (claude code, codex, pi) connect via `k8e-sandbox-cli` CLI commands
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-08-21. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.