Slides: Arrakis: How To Build An AI Sandbox From Scratch - Abhishek Bhardwaj, OpenAI
Source Video
Arrakis: How To Build An AI Sandbox From Scratch - Abhishek Bhardwaj, OpenAI
Relationship To World's Fair 2026
These slides are extracted from a public AI Engineer YouTube video connected to World's Fair 2026. Speaker-matched clips are supporting context unless later confirmed as exact session recordings; official livestream recordings are day-level/event-level source material.
Related Scheduled Sessions
- No individual scheduled session mapping has been assigned yet; treat this as an event livestream deck.
Extracted Slides
OCR text:
Arrakis
How To Build An Al Sandbox From Scratch
Al Engineer World's Fair 2025
Abhishek Bhardwaj
abshkbh AT gmail.com
X, LinkedIn, Github ©
OCR text:
Background
Carnegie Mellon B
Operating Systems x Distributed Systems
Microsoft
* Windows Subsystem for Linux
Google S * From scratch OS for pre-Apple Watch Smartwatch
* MicroVMs - Rust-based lightweight VMs for Linux dev .
environments on Chrome OS
° ARC- Android apps on Chrome OS in containers bat Replit
¢ Infra - Proxied through my service for your entire session
whenever you code on Replit
Arrakis « RAG based code chat
* Sandboxes for Al Agents - code execution and computer use
© Built during my time at South Park Commons
OCR text:
Why Do We Need Al Sandboxes?
Smarter Models
1 * Ability to call tools during inference
¢ Used in RL training
Smarter Agents \
2 « Can debug actions by running Linux commands “ps", *Isof”
* Backtrack, replan and work towards the goal with a Sandbox at their disposal
Security
3 Agent code is no different that Github or StackOverflow code running on your host or
production server
OCR text:
How to Create a ChatGPT Clone GShere a oy
Manus's Computer Qo
Way ca Teemnal
» Executing command warn po ctatget cicie GA C2 Scatgon cloce A create Clase ap
Create a ChatGPT clone
shell
8 Ubuntussandioar~ $ ed /Rome/ubuntu && akdir -p chatgpt clone && cd chatget
a manus Clone && create_flask_app .
I'll help you create a ChatGPT clone. I'll work on developing a web-based chat Creates! acnew Flaskiapplication
interface that mimics the functionality of ChatGPT. Let me get started right create_flask_app [app_naeel
away. ARGUMENTS :
as tthe mosi web ccaition i te for a ChatGPT a nian Name of the Flask application to create
* Connected to datasource{i) v Creste_flask_app ay_app
bop tutsandtaa rs omatgpt clore ¢
& manus
l'll be creating a ChatGPT clone using Flask, which is the appropriate choice
sance we need both a frontend interface and backend processing for the chat
functionality. Let me set up the project structure and implement the necessary
components.
Create the ChatGPT clone project using the Flask template «
Creating the ChatGPT clone project using the Flask template
Creating the ChatGPT clone Flask project.
@ Usng terminal
OCR text:
Arrakis
e Arrakis provides a secure, fully customizable, and self-
hosted solution to spawn and manage Sandboxes for ae, 7
< _ ex ~ /.-
code execution and computer use. : th wv
t allt a /
¢ It has out-of-the box support for backtracking via - Ae ls
snapshot-and-restore. ae et
¢ Qpen Source tne 4
a a. Oo
OCR text:
Arrakis: Features
MicroVM Based Secure Code Execution :
* Code generated by Al Agents would increase exponentially
This code could be malicious or buggy
« Prevent getting rcot on host or production system
« Attacking user data or other possible tenants
Speed :
ety ee Fe .ooy pi Ae of fe at eb ew ghey pe Mead ay y 5 ~ 1m WOE oP ag wh ees ne pee Fons 3
Auto Port Forwarding -
Easy CUA ©
Banlsden alolven _ a ’
OCR text:
* Boots in less than 7 seconds vs 40 seconds for VirtualBox VMs on MacOS.
* PR to bring this 1 second ongoing.
* Fast snapshot tme - single digit seconds
Auto Port Forwarding o? Expand
s
ACCESS Wen ARES WNC SSH nnn ire Sineasa
Easy CUA :
Backtracking ¢
Simple API ©
taf Mie ele BME a Be OS pret e an *, # a BEX,
OCR text:
© PR to bring this 1 second ongoing. ,
+ Fast snapshot time - single digtt seconds
Auto Port Forwarding
Access web apps, VNC, SSH into the Sandbox
Easy CUA ‘ a
Broa ver | UNC Series gfe itn edd
Backtracking e
Simple API a
Configurable With Docker tooling ©
OCR text:
helped break I!ndia’s a EEN EN EEE INE © 7
final jinx
a zc 2 fe 5
a
Backtracking
Ly
* Pre-reasoning models - Intuition that a higher order task needs to be broken down by a Planner
« Agent should be able to snapshot progress and restart from last good snapshot versus starting from scratch
Simple API -
Configurable With Docker tooling ©
OCR text:
be —C“( eC SCC ,
Backtracking
« Pre-reasoning models - intuition that a higher order task needs to be broken down by a Planner
« Agent should be able to snapshot progress and restart from last good snapshot versus starting from scratch
Simple API
« Python API
* Golang CLI
+ MCP Server .
¢ opeanapi compatible -~ generate clients in any language
Configurable With Docker tooling ©
OCR text:
Backtracking
« Pre-reasoning models - Intuition that a higher order task needs to be broken down by a Planner
¢ Agent should be able to snapshot progress and restart from last good snapshot versus starting from scratch
Simple API
« Python API
* Golang CLI
« MCP Server
* oOpeanapi compatible ~ generate clients in any language
Configurable With Docker tooling
Dockerfile to configure what runs inside the Sandbox ©
OCR text:
Arrakis: High Level Architecture
ee
(ee N fl
VNC Client Auto Auto
Port Fores ort Forwerding
Arrakis MicroVM Arrakis MicrovM
Sandbox Sandbox
Userspace
re
iad High level architecture of Arrakis
OCR text:
°
Arrakis: API
Arrakis Restserver exposes the following REST API. This is also available via a Python SOK, MCP Server and an openapi compliant YAML fite
API - Sandboxes, Snapshots, Command Execution, Files
a
ee
rHandlerunc€"/"4&Pl VERS ION+ "/yms", s.startve) Methods ("POST")
rtandlefurc€"/"+API VERSION* "/vais/{name}", s.updateviState).Methads(" PATCH” )
r.Handleburc("/"+APL_VERSION**/vas/{name?", s.destroyys), Methods(" DELETE”)
r HandleFunc("/"+APl VERSION* /vais", s.destroyAllyas ) MutiodsC DELETE” )
r.Handlerunc("/"*#APT VERSION® "/vms", Ss listallvas ) Mothads( GET" )
r.HandleFunc€"/"+APT_VERSTON® 7 /vs/fnames 7, s.listvil) Metnods("GET" )
Handlefunc€"/"+APL_VERSTONS” /vas/{name}/snapshots”, s.sqapshotvl) MethodsC "POST" )
vdlebunc€"/"+APL VERSION* “/ems/finame}/omnd", s.vmCorrand) Methods(" POST")
dleFunc€"/"*APL VERSTON+ "/yus/{name}/tiles”, s.virkileupload).Methods( "POST )
dleFunc("/"+4APL VERSION+ /vas/{name}/tiles”, s.vrtiledownload). Met hods( "GET" )
end Lerkanc€"/"+APL VERSIONS "/health”, s health neck). Metnods ("GET")
OCR text:
Arrakis: Upaateda Arcnitecture .
Arrakis - API
Linux Server
REST API
Kernel a
OCR text:
Arrakis:A Quick Tour Of LinuxSandboxing
LinuxExecutionModel
A“Thread is the smallest unit ofexecution.EachThread
Containers:Why?AndWhat?
Why?-My appneedsPython3.8,foo lbversion1.2,your serverhasPython3.9,3.6,3.12and doesnhav
Containers:SecurityStory
After allContainersrunasnative proc
Containers:Sandboxing
Jail containers by restricting CAPabiities and syscall
Containers→Virtualization
Virtualizationprovides another primitive torunarbitrar
LinuxVirtualization
Kvm-Hypervisor in the formofakernelmodule
OCR text:
mov eax, 1
xor ebx, ebx
int 0x80
Process 1 Process 2
\ hread j Thread
a
ioctl syscall
Userspace
Kernel (OS)
Execution model of a typical Linux System
« A ‘Thread” is the smasbest unt of execution. Each “Thread” has a “task_struct” that’s in the Scheduéer run queue.
* “Process” consists of mutuple threads “Threads” in a process have different TIDs but same PID, share page table ang other things Bound by shared resources
* Kernel prowses “pnvieged’ access to hardware If not gated, buggy of maicious Code can wreak havoc
© Special instrucbons to switch to kernel mode / supervitar mode and invoke a syscall for privileged access
OCR text:
Containers: Why? And What?
. Parent
Container Pid 1 Root
Pid Namespace Nomespaces
I pid 1 Pid
ee 100
o oar 7 Te ~
: Pid 21 t Pid 31 Pid Pid
=e ST Te 101 102
Mount Namespace “f+. --
{7 wor
1 /
' = ‘
Userspace
Kernel
OCR text:
Pia vamespace a 7
fone eee eee
, Pid! Pid
--e! 100
¢ Neer T Tee
7 “*<\ ~
(77 te 17 oe wy
Pid 2!) | Pid 3! Pid Pid
Vee ew Sarma 101 102
~
Mount Namespace ~~. OsSsee 7
sere] ow
f '
,/
—-—— = = «
' |
'
aanipare
Kernel
Linux Container with Pid and Mount Namespace
« Why? - My app needs Python? §, foo bb version 1.2, your server has Python 3 9, 3.6, 3.12 and doesn't have foo hb:
+ Package an app’s dependencies along with fs Core business logic
« Run arbitrary user code on your machine
© On Linux 8 Contameris » Codecton of Namespaces of dfferent resources (Process, Mount. Net etc.)
« Insade 8 container you Only see resources mh your NEmespace snd Not ouside.
*« Qutude the contamer you see everything inside your chddren namespaces
« Resource atocaton happens via CGroups (“How much memory o¢ CPU to allocate this namespace”)
OCR text:
Containers: Why? And What?
. Parent
Container Pid 1 Root
Pid Namespace Namespaces
(Pid 1 | Pid
yee 100
Pa Neott.
ane ne tek 7“ 6
| Pid 2 ' | Pid 3 ' Pid Pid
“oc wT Te 101 102
Mount Namespace “P.M see?
(7 “r=
1/
1 —= =
Kernel
Linux Container with Pid and Mount Mamespace
OCR text:
yee) wy .
? x. -=
, oN ys Pe
se
; Pid 2 ; 1 Pid 3 } Pid Pid
— = oe oe — = = =
x 101 102
~
Mount Namespace +. SSeee =
mae e ne
‘ '
,/
' |
1
«
[foo Userspace
Kernel
Linux Container with Pid and Mount Namespace
«© Wihy? - My app needs Python 8, foo kb version 1.2, your server has Python 3.9, 3.6, 312 and dorsn’t have foo lb
© Package an apps dependencies along with fs Core business logic
+ Run arbitrary user code on your machine
« On Linux a Container is « Collection of Namespaces of aterent resources (Process, Mount, Net etc. ).
* Inssde a container you only see resources mn your Namespace and Not outside.
«© Qutude the contamer you see everything inside your Chédren namespaces
« Resource afocation happens via CGroups (“How much memory of CPU to allocate thes namespace?*)
OCR text:
Containers: Security Story
Root Namespace Userspace
Container
Molicious or Buggy Process ‘
. Trusted Process
Pid Namespace
( .. rT Tp Pid Pid
(Pat; | it 00 200
fi\
syscall ioctl syscall ioctl
Attack Surface
Container processes can attack the kernel
« After al Contaners run as native processes on top of the kernel
«© Any Malicious of Duggy process can attack the kernel and gan root. _ —
OCR text:
Containers: Security Story
Root Namespace Userspace
Container
Malicious or Buggy Process 4
Pid Namespace Trusted Process
(maalt [7777 Pid Pid )*
pPidt, | t00 200
fi\
syscall | ioctl syscall | ioctl
Attack Surface
Container processes can attack the kernel
© After a8 Contaners run as native processes on op of the kernel
¢ Ary malicious of buggy process can attack the kerne’ and gam root.
+ Once it becomes roo! ft Can do anything ft wants
OCR text:
Arrakis: A Quick Tour Of Linux Sandboxing
comnenyl sae °
Containers: Sandboxing . os
Containers ~ Vietusszation | .
OCR text:
Containers: Sandboxing
© Jail” contamers by restncting CAP aduibes and syscails they Can can
Reduce attack surface
Userspace
Root Namespace
Container # minijail0 -S /usr/: share/minijail0/$(uname -m)/eat.policy — \
Molicious or Buggy Process /bin/cat /proc/self/seccomp_filter
a
Pid Namespace .
Cm # open with O_LARGEFILE|O_RDOWLY|O_NONBLOCK or some combination.
( Pid | open: argl == 32768 || arg1 == 0 |{ arg? == 34816 || arg? == 2048
it mmap2: arg2 22 Ox0
A\ wmunmap: 1
sys call | ioctl close: 1
a
Reduce attack surface by using seccomp Filters
© Can restrict the attack surface by restricting the Linux CAP abdibes alowed to a process such as CAP_NET, CAP_SYS_ADMIN ate
Slide-Derived Subjects To Review
Subject extraction uses video title, related session titles/descriptions, transcript context, and OCR text when available. OCR is best-effort and should be reviewed against the embedded slide images.