The Action Capsule.

A Kosmoy Action Capsule is a Docker container plus an in-container sandbox, deployed inside a standard Kubernetes pod. The Capsule runs one model, one agent task or one MCP server. The only egress is the paired Kosmoy AI Gateway.

Application-level isolation built on standard Linux primitives — namespaces, cgroups v2, Seccomp-BPF, Linux capabilities, Landlock and AppArmor / SELinux profiles. No node patches, no custom container runtime.

Two layers. At L3 / L4 a Kubernetes NetworkPolicy applies default-deny egress and the netns is pinned. At L7 an in-pod forward proxy enforces an HTTP host + path allow-list, TLS pinning, method rules and pinned DNS. The only egress is the paired Kosmoy AI Gateway.

Containment without controlled egress is just a wall with no door. The Gateway is the door — it logs, authorizes and policy-checks every step out.

CPU, memory, GPU, timeout and concurrency limits are defined at Capsule creation. cgroups v2 enforce CPU / memory; the Action Plane enforces timeout and concurrency.

Containment has to hold even when the agent's own logic is compromised, so it is enforced at the runtime boundary, not in the prompt. Inside a Capsule the agent keeps its productivity but cannot reach systems outside its authorized scope; the paired Gateway is the only egress; credentials are just-in-time and per task; and the kill switch stops the process itself — no cooperation from the agent required.