Browser-local alpha gate · Source checked August 27, 2026

Is a Ray Sandbox on GKE ready for a controlled pilot?

Check lifecycle, cluster, runsc, images, resources, files, network, untrusted code, cleanup, and recovery without connecting to GKE or running a command.

Sandbox evidence

Check only evidence verified with the exact Ray, gVisor, image, GKE, KubeRay, workload, and policy configuration.

The alpha lifecycle is accepted: exact Ray version is pinned, API compatibility tests exist, upgrades require review, and the system can fall back or migrate if ray.experimental.sandbox changes or disappears.Linux architecture, GKE cluster, KubeRay operator, worker image, containerd, service accounts, security context, node capacity, autoscaling, patching, and rollback are approved.The runsc binary and every Ray and sandbox OCI image have verified origin, digest, signature, scan, inventory, registry, cache, revocation, and offline or outage behavior.CPU, memory, process, disk, output, command time, sandbox TTL, actor concurrency, image cache, cluster quota, cost, and noisy-neighbor limits pass representative stress tests.Read-only root, writable workdir, file transfer, host mounts, overlays, symlinks, archives, Linux capabilities, rootless mode, temporary files, and deletion are explicitly bounded and denial-tested.Network none, public, host, or sandbox mode is chosen deliberately; DNS, egress allowlists, redirects, IP literals, metadata, internal services, node-local access, logging, and exfiltration are tested.Untrusted prompts, commands, code, dependencies, files, outputs, secrets, tool authority, model access, human review, policy, and accepted-result criteria are documented for one workflow.Command, actor, worker, node, registry, network, and control-plane failures plus cancellation, retries, idempotency, logs, alerts, forensic evidence, cleanup, recovery, and incident ownership are exercised.

Local result

Complete the evidence review

Eight gates remain. Begin with the alpha exit path, pinned cluster stack, trusted runsc and images, and one exact workload.

A passing checklist does not certify isolation, security, compatibility, performance, or production suitability. Begin in a non-production cluster with network disabled and no secrets.

Read the deployment decisions

GKE and KubeRayVerify worker nodes, runsc, images, scheduling, validation, and the alpha exit. Actor and OCI lifecycleBound create, exec, files, timeouts, deletion, low-level hooks, and cleanup. Isolation choiceCompare host-kernel exposure, gVisor, network, mounts, capabilities, and operations.

Ray Sandbox readiness questions

No. It runs locally in the browser and does not inspect a cluster, install KubeRay or runsc, pull an image, execute code, change networking, or create a sandbox.

No. Ray labels ray.experimental.sandbox alpha and says it can change or disappear before stability. A passing result only means eight planning gates were checked.

No. It adds a user-space kernel isolation layer and reduces direct host-kernel exposure, but vulnerabilities and surrounding image, network, permission, control-plane, and operational risks remain.

Ray documents network none as the default. Start there, then add only measured egress with surrounding allowlists and denial tests. Host mode has the full host network identity.

No. Test hostile inputs, limits, denied access, concurrency, actor and node loss, registry and network failure, cleanup, recovery, observability, and accepted workload cost.

Official references: Ray Sandboxes, KubeRay deployment, and Google Cloud launch.

Is a Ray Sandbox on GKE ready for a controlled pilot?

Sandbox evidence

Complete the evidence review

Read the deployment decisions

Ray Sandbox readiness questions

Features

Resources

Company