A key advantage of using Cloud Run to host AI agents is that itisolates code using its secure execution environment. By building a code sandbox toolin Cloud Run and running it in your container, you can execute application codeusing any programming language you choose.

Secure two-layer sandboxing

Cloud Run isolates all instances by using a two-layer sandbox thatconsists of a hardware-backed layer equivalent to individual VMs(x86 virtualization) and a software kernel layer. For more information,seeSecurity design overview.

When you deploy your code, Cloud Run confines the code within thesandboxing environment. This isolation lets you run untrusted code, such as code generatedby a large language model (LLM), with greater security.When you execute untrusted code,restrict IAM permissionson your Cloud Run service anduse VPC firewall rulesto prevent your code from making calls to the internet.

Code execution modes

Cloud Run provides the following modes for code execution:

• Asynchronous execution: to avoid disrupting the main application flow, execute tasks asynchronouslyby using aCloud Run job for longer-running or background tasks.For example, execute a Cloud Run job that uploads code to Cloud Storage, installs the requireddependencies, and then processes and stores the results back in Cloud Storage.

• Synchronous execution: for processes that require an immediate response, use aCloud Run service. A Cloud Run servicehas a maximum timeout of one hour, which provides a significant amount of timefor your code to run. To limit instances to process one request at a time,set the concurrency value to1. You can also retrieve the code to executeas part of the request body, return the result in the response, and thenterminate the container instance.

  The following image shows the two modes of code execution:

  

What's next

• Read50% faster merge and 50% fewer bugs: How CodeRabbit built its AI code review agent with Cloud Run.