A practitioner’s guide to deploying sandbox environments on Kubernetes: namespace-per-sandbox, GitOps per-PR environments, virtual clusters, ephemeral clusters, and hardened runtimes for untrusted AI agent code - with comparison tables of isolation boundary, creation time, cost driver, and cleanup for each.