Installing Sysbox
Faheem Code runs each agent session in a sandbox that uses Sysbox for isolation. This guide covers installing Sysbox.
Node requirements
Sysbox nodes must:
- Run a Sysbox-supported Linux distribution. Ubuntu is the most common and best-supported choice.
- Have at least 4 vCPU and 4 GiB of memory.
- Use containerd (the default on most managed distributions).
- Run a Kubernetes version supported by Sysbox.
Run sandboxes on a dedicated node pool so these requirements (and the Sysbox install below) apply only to sandbox nodes, not the whole cluster.
Install Sysbox
Sysbox installs per node via the sysbox-deploy-k8s DaemonSet. It targets nodes labeled
sysbox-install=yes, installs the runtime, and registers a sysbox-runc RuntimeClass.
kubectl label nodes <node-name> sysbox-install=yes
If your nodes autoscale, set this label on the group so every node it launches is labeled automatically.
kubectl apply -f https://raw.githubusercontent.com/nestybox/sysbox/master/sysbox-k8s-manifests/sysbox-install.yaml
kubectl get runtimeclass sysbox-runc
The sysbox-runc RuntimeClass pins any pod that uses it to Sysbox nodes, so sandboxes only schedule
where the runtime is installed.
Point Faheem Code at Sysbox
Tell the runtime API to launch sandboxes with the Sysbox runtime class, and enable native user namespaces:
runtime-api:
env:
RUNTIME_CLASS: sysbox-runc
SET_HOST_USERS: "true"
Verify
Start a conversation in Faheem Code, then confirm the sandbox pod landed on a Sysbox node with the runtime class applied:
kubectl get pod <sandbox-pod> -n faheemcode \
-o jsonpath='{.spec.runtimeClassName}{"\n"}'
The output should be sysbox-runc.