---
title: "Slides: Arrakis: How To Build An AI Sandbox From Scratch - Abhishek Bhardwaj, OpenAI"
category: "slides"
video_id: "wsFd22SL1s8"
sourceLabels: ["Public YouTube video frames", "Public YouTube metadata"]
---

# Slides: Arrakis: How To Build An AI Sandbox From Scratch - Abhishek Bhardwaj, OpenAI

## Source Video
[Arrakis: How To Build An AI Sandbox From Scratch - Abhishek Bhardwaj, OpenAI](https://www.youtube.com/watch?v=wsFd22SL1s8)

## Relationship To World's Fair 2026
These slides are extracted from a public AI Engineer YouTube video connected to World's Fair 2026. Speaker-matched clips are supporting context unless later confirmed as exact session recordings; official livestream recordings are day-level/event-level source material.

## Related Scheduled Sessions
- No individual scheduled session mapping has been assigned yet; treat this as an event livestream deck.

## Extracted Slides
![[assets/slides/wsFd22SL1s8/slide-001.jpg]]

OCR text:

> Arrakis
> How To Build An Al Sandbox From Scratch
> Al Engineer World's Fair 2025
> Abhishek Bhardwaj
> abshkbh AT gmail.com
> X, LinkedIn, Github ©

![[assets/slides/wsFd22SL1s8/slide-002.jpg]]

OCR text:

> Background
> Carnegie Mellon B
> Operating Systems x Distributed Systems
> Microsoft
> * Windows Subsystem for Linux
> Google S * From scratch OS for pre-Apple Watch Smartwatch
> * MicroVMs - Rust-based lightweight VMs for Linux dev .
> environments on Chrome OS
> ° ARC- Android apps on Chrome OS in containers bat Replit
> ¢ Infra - Proxied through my service for your entire session
> whenever you code on Replit
> Arrakis « RAG based code chat
> * Sandboxes for Al Agents - code execution and computer use
> © Built during my time at South Park Commons

![[assets/slides/wsFd22SL1s8/slide-003.jpg]]

OCR text:

> Why Do We Need Al Sandboxes?
> 
> Smarter Models
> 
> 1 * Ability to call tools during inference
> ¢ Used in RL training
> Smarter Agents \
> 
> 2 « Can debug actions by running Linux commands “ps", *Isof”
> * Backtrack, replan and work towards the goal with a Sandbox at their disposal
> Security
> 
> 3 Agent code is no different that Github or StackOverflow code running on your host or
> production server

![[assets/slides/wsFd22SL1s8/slide-004.jpg]]

OCR text:

> How to Create a ChatGPT Clone GShere a oy
> Manus's Computer Qo
> Way ca Teemnal
> » Executing command warn po ctatget cicie GA C2 Scatgon cloce A create Clase ap
> Create a ChatGPT clone
> shell
> 8 Ubuntussandioar~ $ ed /Rome/ubuntu && akdir -p chatgpt clone && cd chatget
> a manus Clone && create_flask_app .
> I'll help you create a ChatGPT clone. I'll work on developing a web-based chat Creates! acnew Flaskiapplication
> interface that mimics the functionality of ChatGPT. Let me get started right create_flask_app [app_naeel
> away. ARGUMENTS :
> as tthe mosi web ccaition i te for a ChatGPT a nian Name of the Flask application to create
> * Connected to datasource{i) v Creste_flask_app ay_app
> bop tutsandtaa rs omatgpt clore ¢
> 
> & manus
> l'll be creating a ChatGPT clone using Flask, which is the appropriate choice
> sance we need both a frontend interface and backend processing for the chat
> functionality. Let me set up the project structure and implement the necessary
> components.
> 
> Create the ChatGPT clone project using the Flask template «
> 
> Creating the ChatGPT clone project using the Flask template
> 
> Creating the ChatGPT clone Flask project.
> 
> @ Usng terminal

![[assets/slides/wsFd22SL1s8/slide-005.jpg]]

OCR text:

> Arrakis
> e Arrakis provides a secure, fully customizable, and self-
> 
> hosted solution to spawn and manage Sandboxes for ae, 7
> 
> < _ ex ~ /.-
> code execution and computer use. : th wv
> t allt a /
> 
> ¢ It has out-of-the box support for backtracking via - Ae ls
> 
> snapshot-and-restore. ae et
> ¢ Qpen Source tne 4
> 
> a a. Oo

![[assets/slides/wsFd22SL1s8/slide-006.jpg]]

OCR text:

> Arrakis: Features
> MicroVM Based Secure Code Execution :
> * Code generated by Al Agents would increase exponentially
> This code could be malicious or buggy
> « Prevent getting rcot on host or production system
> « Attacking user data or other possible tenants
> Speed :
> ety ee Fe .ooy pi Ae of fe at eb ew ghey pe Mead ay y 5 ~ 1m WOE oP ag wh ees ne pee Fons 3
> Auto Port Forwarding -
> Easy CUA ©
> Banlsden alolven _ a ’

![[assets/slides/wsFd22SL1s8/slide-007.jpg]]

OCR text:

> * Boots in less than 7 seconds vs 40 seconds for VirtualBox VMs on MacOS.
> 
> * PR to bring this 1 second ongoing.
> 
> * Fast snapshot tme - single digit seconds
> 
> Auto Port Forwarding o? Expand
> 
> s
> 
> ACCESS Wen ARES WNC SSH nnn ire Sineasa
> Easy CUA :
> Backtracking ¢
> Simple API ©
> taf Mie ele BME a Be OS pret e an *, # a BEX,

![[assets/slides/wsFd22SL1s8/slide-008.jpg]]

OCR text:

> © PR to bring this 1 second ongoing. ,
> + Fast snapshot time - single digtt seconds
> Auto Port Forwarding
> Access web apps, VNC, SSH into the Sandbox
> Easy CUA ‘ a
> Broa ver | UNC Series gfe itn edd
> Backtracking e
> Simple API a
> Configurable With Docker tooling ©

![[assets/slides/wsFd22SL1s8/slide-009.jpg]]

OCR text:

> helped break I!ndia’s a EEN EN EEE INE © 7
> final jinx
> a zc 2 fe 5
> a
> Backtracking
> Ly
> 
> * Pre-reasoning models - Intuition that a higher order task needs to be broken down by a Planner
> « Agent should be able to snapshot progress and restart from last good snapshot versus starting from scratch
> 
> Simple API -
> 
> Configurable With Docker tooling ©

![[assets/slides/wsFd22SL1s8/slide-010.jpg]]

OCR text:

> be —C“( eC SCC ,
> Backtracking
> « Pre-reasoning models - intuition that a higher order task needs to be broken down by a Planner
> « Agent should be able to snapshot progress and restart from last good snapshot versus starting from scratch
> Simple API
> « Python API
> * Golang CLI
> + MCP Server .
> ¢ opeanapi compatible -~ generate clients in any language
> Configurable With Docker tooling ©

![[assets/slides/wsFd22SL1s8/slide-011.jpg]]

OCR text:

> Backtracking
> 
> « Pre-reasoning models - Intuition that a higher order task needs to be broken down by a Planner
> 
> ¢ Agent should be able to snapshot progress and restart from last good snapshot versus starting from scratch
> 
> Simple API
> 
> « Python API
> 
> * Golang CLI
> 
> « MCP Server
> 
> * oOpeanapi compatible ~ generate clients in any language
> 
> Configurable With Docker tooling
> 
> Dockerfile to configure what runs inside the Sandbox ©

![[assets/slides/wsFd22SL1s8/slide-012.jpg]]

OCR text:

> Arrakis: High Level Architecture
> ee
> (ee N fl
> VNC Client Auto Auto
> Port Fores ort Forwerding
> Arrakis MicroVM Arrakis MicrovM
> Sandbox Sandbox
> Userspace
> re
> iad High level architecture of Arrakis

![[assets/slides/wsFd22SL1s8/slide-013.jpg]]

OCR text:

> °
> Arrakis: API
> Arrakis Restserver exposes the following REST API. This is also available via a Python SOK, MCP Server and an openapi compliant YAML fite
> API - Sandboxes, Snapshots, Command Execution, Files
> a
> ee
> rHandlerunc€"/"4&Pl VERS ION+ "/yms", s.startve) Methods ("POST")
> rtandlefurc€"/"+API VERSION* "/vais/{name}", s.updateviState).Methads(" PATCH” )
> r.Handleburc("/"+APL_VERSION**/vas/{name?", s.destroyys), Methods(" DELETE”)
> r HandleFunc("/"+APl VERSION*  /vais", s.destroyAllyas ) MutiodsC DELETE” )
> r.Handlerunc("/"*#APT VERSION® "/vms", Ss listallvas ) Mothads( GET" )
> r.HandleFunc€"/"+APT_VERSTON® 7 /vs/fnames 7, s.listvil) Metnods("GET" )
> Handlefunc€"/"+APL_VERSTONS” /vas/{name}/snapshots”, s.sqapshotvl) MethodsC "POST" )
> vdlebunc€"/"+APL VERSION* “/ems/finame}/omnd", s.vmCorrand) Methods(" POST")
> dleFunc€"/"*APL VERSTON+ "/yus/{name}/tiles”, s.virkileupload).Methods( "POST )
> dleFunc("/"+4APL VERSION+  /vas/{name}/tiles”, s.vrtiledownload). Met hods( "GET" )
> end Lerkanc€"/"+APL VERSIONS "/health”, s health neck). Metnods ("GET")

![[assets/slides/wsFd22SL1s8/slide-014.jpg]]

OCR text:

> Arrakis:UpdatedArchitecture
> Arrakis-API
> LinuxServer
> RESTAPI
> arrakis-py-sdk
> ArrakisRestserver
> arrakis-client
> RESTAPI
> Userspace
> Kernel

![[assets/slides/wsFd22SL1s8/slide-015.jpg]]

OCR text:

> Arrakis:A Quick Tour Of LinuxSandboxing
> LinuxExecutionModel
> A“Thread is the smallest unit ofexecution.EachThread
> Containers:Why?AndWhat?
> Why?-My appneedsPython3.8,foo lbversion1.2,your serverhasPython3.9,3.6,3.12and doesnhav
> Containers:SecurityStory
> After allContainersrunasnative proc
> Containers:Sandboxing
> Jail containers by restricting CAPabiities and syscall
> Containers→Virtualization
> Virtualizationprovides another primitive torunarbitrar
> LinuxVirtualization
> Kvm-Hypervisor in the formofakernelmodule

![[assets/slides/wsFd22SL1s8/slide-016.jpg]]

OCR text:

> mov eax, 1
> xor ebx, ebx
> int 0x80
> Process 1 Process 2
> \ hread j Thread
> a
> ioctl syscall
> Userspace
> Kernel (OS)
> Execution model of a typical Linux System
> « A ‘Thread” is the smasbest unt of execution. Each “Thread” has a “task_struct” that’s in the Scheduéer run queue.
> * “Process” consists of mutuple threads “Threads” in a process have different TIDs but same PID, share page table ang other things Bound by shared resources
> * Kernel prowses “pnvieged’ access to hardware If not gated, buggy of maicious Code can wreak havoc
> © Special instrucbons to switch to kernel mode / supervitar mode and invoke a syscall for privileged access

![[assets/slides/wsFd22SL1s8/slide-017.jpg]]

OCR text:

> Containers: Why? And What?
> . Parent
> Container Pid 1 Root
> Pid Namespace Nomespaces
> I pid 1 Pid
> ee 100
> o oar 7 Te ~
> : Pid 21 t Pid 31 Pid Pid
> =e ST Te 101 102
> Mount Namespace “f+. --
> {7 wor
> 1 /
> ' = ‘
> Userspace
> Kernel

![[assets/slides/wsFd22SL1s8/slide-018.jpg]]

OCR text:

> Pia vamespace a 7
> fone eee eee
> , Pid! Pid
>  --e! 100
> ¢ Neer T Tee
> 7 “*<\ ~
> (77 te 17 oe wy
> Pid 2!) | Pid 3! Pid Pid
> Vee ew Sarma 101 102
> ~
> Mount Namespace ~~. OsSsee 7
> sere] ow
> f '
> ,/
> —-—— = = «
> ' |
> '
> aanipare
> Kernel
> Linux Container with Pid and Mount Namespace
> « Why? - My app needs Python? §, foo bb version 1.2, your server has Python 3 9, 3.6, 3.12 and doesn't have foo hb:
> + Package an app’s dependencies along with fs Core business logic
> « Run arbitrary user code on your machine
> © On Linux 8 Contameris » Codecton of Namespaces of dfferent resources (Process, Mount. Net etc.)
> « Insade 8 container you Only see resources mh your NEmespace snd Not ouside.
> *« Qutude the contamer you see everything inside your chddren namespaces
> « Resource atocaton happens via CGroups (“How much memory o¢ CPU to allocate this namespace”)

![[assets/slides/wsFd22SL1s8/slide-019.jpg]]

OCR text:

> Containers: Why? And What?
> . Parent
> Container Pid 1 Root
> Pid Namespace Namespaces
> (Pid 1 | Pid
> yee 100
> Pa Neott.
> ane ne tek 7“ 6
> | Pid 2 ' | Pid 3 ' Pid Pid
> “oc wT Te 101 102
> Mount Namespace “P.M see?
> (7 “r=
> 1/
> 1 —= =
> Kernel
> Linux Container with Pid and Mount Mamespace

![[assets/slides/wsFd22SL1s8/slide-020.jpg]]

OCR text:

> yee) wy .
> ? x. -=
> , oN ys Pe
> se
> ; Pid 2 ; 1 Pid 3 } Pid Pid
> — = oe oe — = = =
> x 101 102
> ~
> Mount Namespace +. SSeee =
> mae e ne
> ‘ '
> ,/
> ' |
> 1
> «
> [foo Userspace
> Kernel
> Linux Container with Pid and Mount Namespace
> «© Wihy? - My app needs Python 8, foo kb version 1.2, your server has Python 3.9, 3.6, 312 and dorsn’t have foo lb
> © Package an apps dependencies along with fs Core business logic
> + Run arbitrary user code on your machine
> « On Linux a Container is « Collection of Namespaces of aterent resources (Process, Mount, Net etc. ).
> * Inssde a container you only see resources mn your Namespace and Not outside.
> «© Qutude the contamer you see everything inside your Chédren namespaces
> « Resource afocation happens via CGroups (“How much memory of CPU to allocate thes namespace?*)

![[assets/slides/wsFd22SL1s8/slide-021.jpg]]

OCR text:

> Containers: Security Story
> Root Namespace Userspace
> Container
> Molicious or Buggy Process ‘
> . Trusted Process
> Pid Namespace
> ( .. rT Tp Pid Pid
> (Pat; | it 00 200
> fi\
> syscall ioctl syscall ioctl
> Attack Surface
> Container processes can attack the kernel
> « After al Contaners run as native processes on top of the kernel
> «© Any Malicious of Duggy process can attack the kernel and gan root. _ —

![[assets/slides/wsFd22SL1s8/slide-022.jpg]]

OCR text:

> Containers: Security Story
> Root Namespace Userspace
> Container
> Malicious or Buggy Process 4
> Pid Namespace Trusted Process
> (maalt [7777 Pid Pid )*
> pPidt, | t00 200
> fi\
> syscall | ioctl syscall | ioctl
> Attack Surface
> Container processes can attack the kernel
> © After a8 Contaners run as native processes on op of the kernel
> ¢ Ary malicious of buggy process can attack the kerne’ and gam root.
> + Once it becomes roo! ft Can do anything ft wants

![[assets/slides/wsFd22SL1s8/slide-023.jpg]]

OCR text:

> Arrakis: A Quick Tour Of Linux Sandboxing
> Linux Execution Model
> Containers: Why? And What?
> Containers: Security Story
> Containers: Sandboxing
> Containers → Virtualization
> Linux Virtualization
> MicroVMs vs Traditional VMs

![[assets/slides/wsFd22SL1s8/slide-024.jpg]]

OCR text:

> Containers: Sandboxing
> © Jail” contamers by restncting CAP aduibes and syscails they Can can
> Reduce attack surface
> Userspace
> Root Namespace
> Container # minijail0 -S /usr/: share/minijail0/$(uname -m)/eat.policy — \
> Molicious or Buggy Process /bin/cat /proc/self/seccomp_filter
> a
> Pid Namespace .
> Cm # open with O_LARGEFILE|O_RDOWLY|O_NONBLOCK or some combination.
> ( Pid | open: argl == 32768 || arg1 == 0 |{ arg? == 34816 || arg? == 2048
> it mmap2: arg2 22 Ox0
> A\ wmunmap: 1
> sys call | ioctl close: 1
> a
> Reduce attack surface by using seccomp Filters
> © Can restrict the attack surface by restricting the Linux CAP abdibes alowed to a process such as CAP_NET, CAP_SYS_ADMIN ate

## Slide-Derived Subjects To Review
Subject extraction uses video title, related session titles/descriptions, transcript context, and OCR text when available. OCR is best-effort and should be reviewed against the embedded slide images.