Corey James- 10image definitions for native workers, coding-CLI seats and infrastructure services
- 4loader modes on one generic image: job, capability, agent, infrastructure
- 2per-GPU images, one for each NVIDIA Blackwell GPU
A sandbox an agent cannot loosen
In Agent Swarm, agents that run code need a sandbox they cannot loosen. The launcher drives the Docker Engine API from Rust to create, inspect, pause and kill agent containers.
Hardening is the default profile, and an agent has no switch to turn it off.
AgentOS needed seats isolated from each other, so every managed seat is its own container started through that launcher, with provider state copied into a private per-seat directory. See A coding agent that never holds the keys.
A function's location as configuration
In FAFO Core and Function Forge I wanted a function's location to be configuration, so Core injects its runtime into generic containers. One image, a bind-mounted runtime binary and a loader script let any function run anywhere the image runs, with no image rebuild, and agent mode applies the same hardening.
One GPU, one container, one engine
In the Inference Fabric I wanted a broken GPU node fixed by replacing its container, so each node is one GPU, one container and one engine, with a fast exit on any fatal error. The per-GPU images sit on a TensorRT-LLM base.
Proving a release from inside the image
In ActiveKV, a kernel patch built against the wrong toolchain breaks the ABI vLLM loads, so I rebuild patches inside a container of the exact vendor image. A release counts as promoted only after its hashes are read back from inside that image.
Containers with nothing to escalate with
In Helix, a server that acts as a digital employee in meetings should have nothing to escalate with. In FAFOHive, agents ask for GPU renders, and an agent-supplied Docker option is an escape hatch. In the Auth and access plane I wanted the weather MCP server to install like a product.