Google Cloud & Anyscale launch Ray sandboxing tool

Google Cloud and Anyscale have introduced an experimental sandboxing library for Ray clusters on Google Kubernetes Engine.

The software uses gVisor to isolate code execution in distributed Ray environments.

The release addresses a growing challenge in reinforcement learning and related post-training work, where model-generated code, dynamic rollouts and tool use must run in segregated environments across large compute clusters. Ray has become a common runtime for these jobs, coordinating trainers, inference engines and rollout workers across distributed systems.

Under the new approach, each sandbox is represented as a Ray Actor, so it fits the same programming model already used for other Ray-managed resources. The Ray scheduler selects the node where the sandbox runs and reserves CPU and memory, while the actor manages lifecycle tasks and gVisor provides the execution boundary on that machine.

Starting with Ray 2.58, users can create sandboxed environments through standard Ray application programming interfaces. These environments can be built from OCI-compatible container images and configured with CPU and memory limits, environment variables, working directories and networking settings.

Users can also execute commands, inspect sandbox state, move files in and out of the environment, and terminate or delete the sandbox. For lower-level use, the software includes SandboxRuntime, which gives direct access to local gVisor sandboxes and allows changes to the OCI specification before it is passed to gVisor.

Security focus

The choice of gVisor reflects concern about running untrusted code generated by models. Google's open-source application kernel implements much of the Linux system-call interface in userspace, adding an extra isolation layer between workloads and the host kernel.

This design avoids exposing a Docker daemon or host Docker socket to the sandbox while still using standard OCI container images. For organisations building agentic AI systems, it is intended to make isolated environments easier to create on demand without relying only on conventional containers.

Ray is already being used for workloads including multimodal data pipelines and frontier reinforcement learning, according to Google Cloud. It also pointed to broader use in frameworks such as veRL, NeMo-RL, SLIME, MILES and SkyRL, which depend on Ray to coordinate distributed tasks.

Cluster integration

A key part of the design is that sandboxing is not presented as a separate execution model. Instead, it sits within Ray's existing resource management structure, where environments can be placed on machines, assigned resources, recovered after failures and scaled alongside the wider workload.

That could matter for teams already using Ray to manage complex post-training pipelines because it reduces the need for a parallel orchestration system for isolated execution. In practice, a sandbox can be called through standard Ray Actor methods even when it is running elsewhere in the cluster, with a proxy actor forwarding operations to gVisor.

The software is being made available for use on Google Kubernetes Engine, a central platform for container-based AI infrastructure in Google Cloud. The tie-up with Anyscale, a key commercial company behind Ray, also shows coordination between the cloud provider and the wider Ray ecosystem around reinforcement learning tools.

Broader trend

The move highlights broader pressure in AI infrastructure as companies experiment with agentic systems that generate code, carry out multi-step reasoning and interact with external tools. These systems can create more operational risk than static model inference, especially when they need to execute commands dynamically as part of training or evaluation.

For some AI workflows, sandboxing has become a practical requirement rather than a secondary feature. By bringing isolated environments into Ray's core programming model, Google Cloud and Anyscale are aiming to make that requirement part of standard cluster operations rather than a separate security layer added afterward.

The initial release is experimental, with gVisor as the first supported runtime. Future Ray versions are expected to add support for other sandboxing runtimes, including Agent Substrate and Kata Containers.