feat(langchain): add LangChain DeepAgents backend adapter by johannhartmann · Pull Request #310 · kubernetes-sigs/agent-sandbox

johannhartmann · 2026-02-11T09:44:28Z

What This Does

This adds a LangChain DeepAgents backend implementation that uses agent-sandbox for isolated code execution. It lets LangChain agents spin up Sandboxes on the fly to run code, read/write files, and clean up after themselves.

We've been using this at Mayflower to run LangChain agents on our clusters and wanted to contribute it back upstream.

Changes

1. SandboxClient enhancements (clients/python/agentic-sandbox-client/)

claim_name parameter for SandboxClaim-based provisioning (warm pool support)
delete_on_exit parameter for automatic cleanup
connect() classmethod for reconnecting to existing sandboxes
delete() method and was_reconnected property

2. New langchain-agent-sandbox package (clients/python/langchain-agent-sandbox/)

Implements BackendProtocol from langchain-deepagents
Factory pattern via SandboxBackendFactory for multi-agent use
Configurable cleanup policies (delete on exit, keep on error, etc.)
Warm pool support via SandboxClaim integration
Unit tests covering backend lifecycle, file operations, and policies

3. Example application (examples/langchain-deepagents/)

Working example with skills, sandbox template, and a kind cluster test script

4. E2E test (test/e2e/clients/python/)

End-to-end test for the backend running against a kind cluster

How to Test

# Unit tests
uv pip install -e clients/python/agentic-sandbox-client
uv pip install -e clients/python/langchain-agent-sandbox[test]
uv run pytest clients/python/langchain-agent-sandbox/tests/test_backend.py -v

# E2E (requires kind cluster with extensions)
make deploy-kind EXTENSIONS=true
uv run pytest test/e2e/clients/python/test_e2e_langchain_backend.py -v

Notes

This depends on the langchain-deepagents package from LangChain
Happy to split this into smaller PRs if that's easier to review
Any feedback on the approach or API design is very welcome!

netlify · 2026-02-11T09:44:35Z

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	`daeb330`
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/69a30ede19a47c00087269ba

linux-foundation-easycla · 2026-02-11T09:44:37Z

❌ - login: @johannhartmann / name: Johann-Peter Hartmann . The commit (2665dee, 35462c3, 3aa91a8, 58d4bc4, 8ae2861, 9fbff0f, d82588f, daeb330, e71a4d4, e83e461, f308788, f7f6921) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

k8s-ci-robot · 2026-02-11T09:44:38Z

Welcome @johannhartmann!

It looks like this is your first PR to kubernetes-sigs/agent-sandbox 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/agent-sandbox has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-02-11T09:44:39Z

Hi @johannhartmann. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

janetkuo · 2026-02-12T01:18:00Z

/ok-to-test

janetkuo · 2026-02-17T23:57:40Z

examples/langchain-deepagents/README.md

+
+## Architecture
+
+```


FYI - in case you find it cumbersome to maintain this diagram, GitHub supports mermaid diagrams via ```mermaid: https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-mermaid-diagrams

janetkuo · 2026-02-18T00:09:52Z

examples/langchain-deepagents/sandbox-template.yaml

@@ -0,0 +1,59 @@
+# Copyright 2025 The Kubernetes Authors.


nit: 2026 (and other places too!)

Suggested change

# Copyright 2025 The Kubernetes Authors.

# Copyright 2026 The Kubernetes Authors.

janetkuo · 2026-02-18T00:10:18Z

examples/langchain-deepagents/sandbox-template.yaml

+# SandboxTemplate for LangChain DeepAgents
+# This template defines the container image and resources for sandbox pods.
+---
+apiVersion: agents.x-k8s.io/v1alpha1


The API group for SandboxTemplate should be:

Suggested change

apiVersion: agents.x-k8s.io/v1alpha1

apiVersion: extensions.agents.x-k8s.io/v1alpha1

janetkuo · 2026-02-18T00:12:15Z

clients/python/agentic-sandbox-client/agentic_sandbox/sandbox_client.py

+        if self._custom_claim_name:
+            self.claim_name = self._custom_claim_name
+            # Check if the claim already exists
+            if self._claim_exists(self.claim_name):


Before reconnecting, should it verify that the existing claim was created from the same template_name? Otherwise, it might be surprising.

janetkuo · 2026-02-18T00:12:38Z

clients/python/agentic-sandbox-client/agentic_sandbox/sandbox_client.py

+            raise
+
    @trace_span("create_claim")
    def _create_claim(self, trace_context_str: str = ""):


Perhaps this needs to be renamed, given that it supports reconnecting as well (something like _setup_claim perhaps?) Reminder to update trace_span as well.

janetkuo · 2026-02-18T00:16:06Z

clients/python/agentic-sandbox-client/k8s_agent_sandbox/sandbox_client.py

+
+        logging.info(f"Explicitly deleting SandboxClaim: {self.claim_name}")
+        try:
+            self.custom_objects_api.delete_namespaced_custom_object(


We should clear self.claim_name as well, so that we don't attempt to delete the same claim again (will result in 404)

janetkuo · 2026-02-18T00:19:34Z

examples/langchain-deepagents/README.md

+    secured = SandboxPolicyWrapper(
+        backend,
+        deny_prefixes=["/etc", "/sys", "/proc"],
+        deny_commands=["rm -rf", "curl", "wget"],


This can be bypassed by variations like rm -r -f or using aliases. Suggest adding a warning in the doc that this is a best-effort guardrail and not a substitute for kernel-level isolation (like gVisor).

janetkuo · 2026-02-18T00:22:49Z

examples/langchain-deepagents/README.md

+    # Wrap with security policies
+    secured = SandboxPolicyWrapper(
+        backend,
+        deny_prefixes=["/etc", "/sys", "/proc"],


A malicious agent could bypass /etc using a path like /app/../etc. Does SandboxPolicyWrapper use something like os.path.abspath() or os.path.realpath()?

janetkuo · 2026-02-18T00:30:11Z

@johannhartmann thanks for the PR! Reminder to sign the CLA following #310 (comment)

…upport Add claim_name parameter for SandboxClaim-based provisioning, delete_on_exit parameter for automatic cleanup, connect() classmethod for reconnecting to existing sandboxes, delete() method for explicit teardown, and was_reconnected property for detecting reconnection state.

Implement BackendProtocol from langchain-deepagents providing sandbox lifecycle management, file I/O, and code execution. Includes factory pattern with SandboxBackendFactory, configurable cleanup policies, and warm pool support via SandboxClaim integration. Comprehensive test suite covers backend lifecycle, file operations, and policy configurations.

Add end-to-end test for the LangChain DeepAgents backend running against a kind cluster with sandbox templates and warm pools.

Add example application demonstrating the LangChain DeepAgents backend with sandbox templates, skills support, and a kind cluster test script.

ls -a -p on Linux outputs ./ and ../ with trailing slashes, but the filter only checked for . and .. (without slash), letting dot entries leak into results. Also handles empty lines from trailing newlines.

… root_dir=/ - AgentSandboxBackend now inherits from SandboxBackendProtocol so isinstance checks in DeepAgents FilesystemMiddleware pass without needing ABC.register(). - Fix _to_internal path validation when root_dir='/': the check startswith(root_dir + '/') became startswith('//') which rejected every valid absolute path. Now handles the root case separately.

k8s-ci-robot · 2026-02-19T18:11:01Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: johannhartmann
Once this PR has been reviewed and has the lgtm label, please ask for approval from janetkuo. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

janetkuo · 2026-02-19T18:39:19Z

From the test failure test/e2e/clients/python/test_e2e_langchain_backend.py: ModuleNotFoundError: No module named 'langchain_agent_sandbox' the langchain-agent-sandbox package needs to be installed first

k8s-ci-robot · 2026-02-28T16:10:09Z

@johannhartmann: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
presubmit-agent-sandbox-e2e-test	`daeb330`	link	true	`/test presubmit-agent-sandbox-e2e-test`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-ci-robot requested review from janetkuo and justinsb February 11, 2026 09:44

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Feb 11, 2026

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Feb 11, 2026

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 12, 2026

janetkuo reviewed Feb 18, 2026

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 18, 2026

janetkuo self-assigned this Feb 18, 2026

johannhartmann added 11 commits February 19, 2026 19:05

test(langchain): add e2e tests for LangChain backend adapter

e83e461

Add end-to-end test for the LangChain DeepAgents backend running against a kind cluster with sandbox templates and warm pools.

feat(examples): add LangChain DeepAgents example

e71a4d4

Add example application demonstrating the LangChain DeepAgents backend with sandbox templates, skills support, and a kind cluster test script.

fix(langchain): filter ./ and ../ entries in ls_info

f308788

ls -a -p on Linux outputs ./ and ../ with trailing slashes, but the filter only checked for . and .. (without slash), letting dot entries leak into results. Also handles empty lines from trailing newlines.

fix(sandbox-client): harden reconnect and claim cleanup

8ae2861

feat(langchain): support direct uploads and path policy hardening

2665dee

fix(langchain): migrate to k8s-agent-sandbox package name

58d4bc4

docs(langchain): address policy guidance and example manifest comments

35462c3

fix(langchain): tighten policy resolution and upload timeout

f7f6921

johannhartmann force-pushed the feat-langchain-deepagents-backend branch from f202be6 to f7f6921 Compare February 19, 2026 18:10

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 19, 2026

fix(agent-sandbox): wait for sandbox api reachability after ready

daeb330

	# Copyright 2025 The Kubernetes Authors.
	# Copyright 2026 The Kubernetes Authors.

	apiVersion: agents.x-k8s.io/v1alpha1
	apiVersion: extensions.agents.x-k8s.io/v1alpha1


		## Architecture

		```

Conversation

johannhartmann commented Feb 11, 2026

What This Does

Changes

How to Test

Notes

Uh oh!

netlify bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for agent-sandbox canceled.

Uh oh!

linux-foundation-easycla bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Feb 11, 2026

Uh oh!

k8s-ci-robot commented Feb 11, 2026

Uh oh!

janetkuo commented Feb 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

janetkuo commented Feb 18, 2026

Uh oh!

k8s-ci-robot commented Feb 19, 2026

Uh oh!

janetkuo commented Feb 19, 2026

Uh oh!

k8s-ci-robot commented Feb 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Feb 11, 2026 •

edited

Loading

linux-foundation-easycla bot commented Feb 11, 2026 •

edited

Loading