From f19c73f4937711f186fe80b7c097973dd651c198 Mon Sep 17 00:00:00 2001
From: Ben Potter <me@bpmct.net>
Date: Tue, 3 Nov 2026 19:42:38 +0000
Subject: [PATCH 1/4] feat(registry/coder-labs/templates/kubernetes-sandboxed):
 add a plain Pod template with a host name firewall

---
 .../templates/kubernetes-sandboxed/README.md  | 141 +++
 .../kubernetes-sandboxed/build/Dockerfile     |  47 +
 .../build/egress-proxy/Dockerfile             |  10 +
 .../kubernetes-sandboxed/cluster/README.md    |  25 +
 .../kubernetes-sandboxed/cluster/main.tf      | 113 ++
 .../cluster/tests/cluster.tftest.hcl          |  45 +
 .../templates/kubernetes-sandboxed/main.tf    | 997 ++++++++++++++++++
 .../kubernetes-sandboxed/squid.conf.tftpl     |  46 +
 .../kubernetes-sandboxed/start-agent.sh       |  42 +
 .../tests/template.tftest.hcl                 | 725 +++++++++++++
 10 files changed, 2191 insertions(+)
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/README.md
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/build/Dockerfile
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/build/egress-proxy/Dockerfile
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/cluster/README.md
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/cluster/main.tf
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/cluster/tests/cluster.tftest.hcl
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/main.tf
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/squid.conf.tftpl
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/start-agent.sh
 create mode 100644 registry/coder-labs/templates/kubernetes-sandboxed/tests/template.tftest.hcl

diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/README.md b/registry/coder-labs/templates/kubernetes-sandboxed/README.md
new file mode 100644
index 000000000..c0926e368
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/README.md
@@ -0,0 +1,141 @@
+---
+display_name: Kubernetes (sandboxed)
+description: Run each workspace in a plain Kubernetes Pod behind a host name firewall, with optional gVisor or Kata isolation
+icon: ../../../../.icons/kubernetes.svg
+verified: false
+tags: [kubernetes, container, sandbox, gvisor, kata, ai]
+---
+
+# Kubernetes (sandboxed)
+
+Run each workspace in a plain Kubernetes Pod with a persistent home disk. You and your AI agent work in the same Pod, with one Coder agent named `dev`. A NetworkPolicy and a small Squid proxy work as the firewall, so rules can name hosts such as `github.com` or `registry.npmjs.org`. By default the workspace can reach only the Coder server. The template needs no controller and no CRDs, so it works on any cluster with a network plugin that enforces NetworkPolicy.
+
+## Why plain Pods
+
+- **Nothing extra to run:** only Pods, a disk, a Secret, a ConfigMap, a Service, and NetworkPolicies. There is no controller to install or upgrade.
+- **Rules by host name:** the proxy allows a list of host names, so a profile can include package registries. A NetworkPolicy alone can match only IP ranges.
+- **Any node:** by default the workspace uses the node's normal container runtime. If your nodes have gVisor or Kata, list them in `runtimes` to add kernel isolation.
+
+For a cluster-level warm pool, or if cluster administrators must own the runtime and the network rules, use [Kubernetes (agent-sandbox)](https://registry.coder.com/templates/coder-labs/kubernetes-agent-sandbox) instead.
+
+## Startup speed
+
+With a prebuild, workspaces often start in 3 to 7 seconds, which matters for agents that start a new workspace for each task. To see where the time goes, see [Speed tuning](#speed-tuning).
+
+## Prerequisites
+
+Required:
+
+- **A Kubernetes cluster** with a network plugin that enforces NetworkPolicy, including for traffic to a Service address, and a StorageClass for the home disk.
+- **The cluster setup** in [`cluster/`](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-sandboxed/cluster): a Terraform configuration that creates the namespace and the RBAC. See [`cluster/README.md`](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-sandboxed/cluster/README.md).
+- **The workspace image**, built from [`build/Dockerfile`](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-sandboxed/build/Dockerfile).
+- **The proxy image**, built from [`build/egress-proxy/Dockerfile`](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-sandboxed/build/egress-proxy/Dockerfile).
+- **Access to the cluster** for the Coder provisioner. The template uses the in-cluster ServiceAccount, or `~/.kube/config` with `use_kubeconfig = true`. With the AI Gateway on, the provisioner also calls the Coder API at the access URL to create the workspace's token.
+
+Optional:
+
+- **Coder Premium**, for prebuilds and the AI Gateway. Without it, set `prebuild_instances = 0` and `enable_ai_gateway = false`, and give Claude Code another way to sign in.
+- **gVisor or Kata** on the nodes, with a RuntimeClass, for kernel isolation. Use gVisor `release-20261019.0` or later. Older releases block on an empty write to a terminal, so the web terminal takes no input.
+- **A DaemonSet that pulls the images** on every node.
+
+## Quick start
+
+1. Build both images and push them to your registry. See [Build the images](#build-the-images).
+2. Set up the cluster with the Terraform configuration in [`cluster/`](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-sandboxed/cluster).
+3. Write the template variables to a file outside the template directory, and push the template:
+
+   ```sh
+   cat > ~/kubernetes-sandboxed.yaml << 'EOF'
+   namespace: coder-workspaces
+   workspace_image: registry.example.com/coder/workspace:v2.30.0
+   proxy_image: registry.example.com/coder/egress-proxy:v1
+   coder_egress_cidrs: '["203.0.113.10/32"]'
+   EOF
+   coder templates push kubernetes-sandboxed -d . --variables-file ~/kubernetes-sandboxed.yaml
+   ```
+
+Users pick the network profile and, if you set `runtimes`, the runtime when they create a workspace. They cannot change them later. Each profile except Custom is a preset with `prebuild_instances` prebuilds on the node's container runtime.
+
+Workspaces have no DNS. If the access URL uses a host name, also set `coder_host_ip`. A build fails with a clear message if it is missing.
+
+## Build the images
+
+```sh
+docker buildx build --platform linux/amd64 \
+  --build-arg CODER_VERSION=2.30.0 \
+  -t registry.example.com/coder/workspace:v2.30.0 --push build
+docker buildx build --platform linux/amd64 \
+  -t registry.example.com/coder/egress-proxy:v1 --push build/egress-proxy
+```
+
+- Match `CODER_VERSION` to your Coder server, and rebuild when you upgrade Coder. `CODER_BINARY_URL`, such as `https://coder.example.com/bin/coder-linux-amd64`, copies the binary from your server instead of GitHub.
+- `INSTALL_CODE_SERVER=false` and `INSTALL_CLAUDE_CODE=false` leave out the tools. With `INSTALL_CLAUDE_CODE=false`, set `enable_claude_code = false` in the template.
+- Use a fixed tag or a digest. The template rejects `:latest`, because with `imagePullPolicy: IfNotPresent` the nodes keep an old copy.
+
+## Architecture
+
+- **For the life of the workspace:** the home disk, the NetworkPolicies, and, except with Fully isolated, the proxy's config and Service.
+- **While started:** a Secret with the agent token, the workspace Pod, and the proxy Pod. Stop deletes them and keeps the disk. They are bare Pods, so nothing waits on a Deployment.
+- **No DNS:** the workspace resolves no names. The proxy resolves them, and the agent reaches Coder by IP address or by `coder_host_ip`.
+- **Policy check:** before the agent starts, the Pod waits until the Kubernetes API server is unreachable, which shows that its NetworkPolicy is in force. It checks again every 5 s and stops the agent if the API server becomes reachable.
+- **Pod names:** each name ends in `-pod` after a part that is new for every start. VPC CNI shares rules between Pods with the same name prefix, and deleting an old Pod can drop the rules of a new one.
+- **Pods:** run as a non-root user with no capabilities and no ServiceAccount token. The workspace requests 500m CPU and 1 GiB, and the proxy 50m CPU and 64 MiB.
+- **Apps:** code-server, and Claude Code, which continues the last conversation in `/home/coder`.
+
+## Speed tuning
+
+In our Amazon EKS test cluster (`m7i.2xlarge` nodes, VPC CNI), from create to a connected agent:
+
+| Workspace                                 | Ready in   |
+| ----------------------------------------- | ---------- |
+| From a prebuild, any preset               | 3 to 7 s   |
+| No prebuild (Custom), or start after stop | about 15 s |
+| No prebuild, with a coder/coder clone     | 3 to 6 min |
+
+These all add to the speed:
+
+1. **Prebuilds** (Premium). A claim changes no Pod, so the Pods keep running, and the build takes about 1.6 s. The rest is the agent reconnecting as yours and running the startup scripts. GitHub profiles have already cloned `git_repo_url`.
+2. **The image.** [`build/Dockerfile`](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-sandboxed/build/Dockerfile) adds the Coder agent, code-server, and Claude Code, and the code-server module runs with `offline = true`. So a start downloads nothing, and it also works in Fully isolated. The image is about 800 MB compressed, so pull it ahead of time with a DaemonSet, or the first Pod on a node waits for the pull.
+3. **The disk.** Most of a cold start is the EBS volume attaching to the node, 5 to 12 s. A StorageClass with `volumeBindingMode: WaitForFirstConsumer` creates the disk in the node's zone.
+4. **The runtime.** gVisor adds little to the start, but slows file-heavy work such as a large `git clone`. Kata boots a VM for each start, and its RuntimeClass overhead needs free CPU on the Kata nodes.
+5. **Terraform.** Coder caches modules, but downloads providers on every build unless the provisioner has a provider cache or mirror.
+
+## Firewall
+
+There are two layers, so a bug in one does not open the network:
+
+1. **NetworkPolicy:** the workspace can reach only the Coder server and port 3128 of its own proxy. No DNS, no other Pods, and no cloud metadata.
+2. **Squid:** the proxy allows only the profile's host names. It resolves names itself, refuses raw IP addresses and names that resolve to private addresses, and never decrypts HTTPS. Its own NetworkPolicy allows it only public addresses on the profile's ports and DNS.
+
+The proxy is its own Pod, not a sidecar, so nothing in the workspace can change its rules. The workspace gets `HTTPS_PROXY` and `HTTP_PROXY` with the proxy's Service address. curl, git, Go, npm, and pip use them. A program that ignores them cannot connect at all.
+
+Rules by host name work for dynamic, human-driven AI work, where the agent installs packages and reads docs. A rule still allows every path on an allowed host, so an allowed host that stores user content can receive data.
+
+The proxy logs every request, allowed or denied: `kubectl logs <proxy pod>`.
+
+### Network ingress
+
+Every profile blocks all ingress to the workspace. The Coder agent dials out to the Coder server, so the web terminal, code-server, `coder ssh`, port forwarding, and desktop IDEs all relay through Coder. To expose a port to other Pods, add a Service and an ingress rule yourself, and put your own sign-in in front of it.
+
+### Network egress
+
+| Profile                       | Can reach, in addition to Coder                                              |
+| ----------------------------- | ---------------------------------------------------------------------------- |
+| Fully isolated (default)      | Nothing. No proxy and no DNS.                                                |
+| GitHub only                   | GitHub host names on 443                                                     |
+| GitHub and package registries | GitHub, npm, the Go module proxy, and PyPI on 443                            |
+| Public internet               | Any public host name on 443 and 80. No raw IPs, private ranges, or metadata. |
+| Custom                        | The host names and ports that you type. No preset, so a cold start.          |
+
+With Custom, the form shows a list of host names and a choice of ports 443 and 80. `*.example.com` also allows `example.com`. The form rejects IP addresses, names without a dot, `*.com`, and cluster names such as `.svc` or `.local`, and the build checks them again.
+
+## Limits
+
+- No kernel isolation unless you list gVisor or Kata. A kernel bug or container escape reaches the node and the other Pods on it.
+- Only HTTPS on 443 and HTTP on 80 pass the proxy. SSH, database ports, and programs that ignore `HTTPS_PROXY` cannot connect. Use Git over HTTPS.
+- Public internet and Custom wildcards can still send data out, for example to an attacker's site or in a DNS lookup that the proxy makes.
+- Every profile except Fully isolated runs one proxy Pod for each started workspace.
+- Each prebuild is a running Pod, so it costs the same as a running workspace.
+- With the AI Gateway on, each start gives the workspace a new Coder token with only the `user:read_personal` scope, which the AI Gateway accepts. Code in the workspace can use it for AI requests. Coder cannot revoke it on stop, so it stays valid until the default token lifetime ends, and it shows in the owner's token list as `ai-gateway-<workspace>-<time>`.
+- If VPC CNI drops a Pod's rules, the Pod can reach the network for up to 5 s before the check stops it.
+- No root, no Docker, IPv4 only.
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/build/Dockerfile b/registry/coder-labs/templates/kubernetes-sandboxed/build/Dockerfile
new file mode 100644
index 000000000..91569d1be
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/build/Dockerfile
@@ -0,0 +1,47 @@
+FROM codercom/enterprise-base:ubuntu
+
+ARG TARGETARCH=amd64
+ARG CODER_VERSION=
+ARG CODER_BINARY_URL=
+ARG INSTALL_CODE_SERVER=true
+ARG CODE_SERVER_VERSION=4.105.1
+ARG INSTALL_CLAUDE_CODE=true
+
+USER root
+
+# The Coder agent.
+RUN set -eu; \
+	if [ -n "${CODER_BINARY_URL}" ]; then \
+		curl -fsSL --retry 5 -o /usr/local/bin/coder "${CODER_BINARY_URL}"; \
+	elif [ -n "${CODER_VERSION}" ]; then \
+		v="${CODER_VERSION#v}"; \
+		curl -fsSL --retry 5 "https://github.com/coder/coder/releases/download/v${v}/coder_${v}_linux_${TARGETARCH}.tar.gz" \
+			| tar -xz -C /usr/local/bin ./coder; \
+	else \
+		echo "Set CODER_VERSION or CODER_BINARY_URL" >&2; exit 1; \
+	fi; \
+	chmod 755 /usr/local/bin/coder; \
+	/usr/local/bin/coder version
+
+# code-server, outside /home so a home volume does not hide it. The
+# code-server module uses it with offline = true.
+RUN set -eu; \
+	if [ "${INSTALL_CODE_SERVER}" = true ]; then \
+		curl -fsSL https://code-server.dev/install.sh \
+			| sh -s -- --method=standalone --prefix=/opt/code-server --version "${CODE_SERVER_VERSION}"; \
+	fi
+
+# Claude Code, outside /home for the same reason. The template runs
+# /opt/claude/bin/claude.
+RUN set -eu; \
+	if [ "${INSTALL_CLAUDE_CODE}" = true ]; then \
+		export HOME=/opt/claude; \
+		mkdir -p /opt/claude/bin; \
+		curl -fsSL https://claude.ai/install.sh | bash; \
+		ln -sf "$(readlink -f /opt/claude/.local/bin/claude)" /opt/claude/bin/claude; \
+		chmod -R a+rX /opt/claude; \
+		/opt/claude/bin/claude --version; \
+	fi
+
+USER coder
+WORKDIR /home/coder
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/build/egress-proxy/Dockerfile b/registry/coder-labs/templates/kubernetes-sandboxed/build/egress-proxy/Dockerfile
new file mode 100644
index 000000000..8bf20bcae
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/build/egress-proxy/Dockerfile
@@ -0,0 +1,10 @@
+FROM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0
+
+# Squid 7. The template mounts squid.conf from a ConfigMap at
+# /etc/squid-conf.
+RUN apk add --no-cache squid=7.6-r0
+
+# Runs as the squid user. The config logs to stdout and stderr and keeps no
+# pid file and no disk cache, so it needs no writable paths.
+USER squid
+ENTRYPOINT ["squid", "-N", "-f", "/etc/squid-conf/squid.conf"]
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/cluster/README.md b/registry/coder-labs/templates/kubernetes-sandboxed/cluster/README.md
new file mode 100644
index 000000000..ed14b3a64
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/cluster/README.md
@@ -0,0 +1,25 @@
+# Cluster setup for kubernetes-sandboxed
+
+A cluster administrator sets up the cluster once. The Terraform configuration in this directory creates the workspace namespace, and a Role and RoleBinding for the Coder provisioner. The provisioner can manage Pods, disks, Secrets, ConfigMaps, Services, and NetworkPolicies in this namespace only.
+
+## Apply
+
+Run Terraform from this directory with an account that can create namespaces and RBAC:
+
+```sh
+terraform init
+terraform apply -var namespace=coder-workspaces
+```
+
+Set `namespace` to the namespace for workspaces, and use the same value in the template. If the namespace exists already, set `create_namespace = false`. If the Coder provisioner does not run as the `coder` ServiceAccount in the `coder` namespace, set `provisioner_service_account`.
+
+Keep the Terraform state. Terraform needs it to change or remove the setup later.
+
+## Kernel isolation
+
+To offer gVisor or Kata, install them on the nodes with a RuntimeClass named `gvisor`, `kata-qemu`, or `kata-clh`, and list them in the template's `runtimes` variable, for example `gvisor,kata-clh`. See [Install the runtimes](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/kubernetes-agent-sandbox/cluster/README.md#2-install-the-runtimes) in the agent-sandbox template.
+
+## Removal
+
+- Changing `create_namespace` from `true` to `false` deletes the namespace and every workspace in it. To stop managing an existing namespace, run `terraform state rm 'kubernetes_namespace_v1.workspaces[0]'` first.
+- `terraform destroy` removes everything this configuration created, including the namespace if it created it.
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/cluster/main.tf b/registry/coder-labs/templates/kubernetes-sandboxed/cluster/main.tf
new file mode 100644
index 000000000..f292b5af2
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/cluster/main.tf
@@ -0,0 +1,113 @@
+# Cluster setup for the kubernetes-sandboxed template. A cluster
+# administrator applies this once. See README.md in this directory.
+
+terraform {
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.23"
+    }
+  }
+}
+
+variable "kubeconfig_path" {
+  description = "The kubeconfig file to use."
+  type        = string
+  default     = "~/.kube/config"
+}
+
+variable "kubeconfig_context" {
+  description = "The kubeconfig context to use. Empty uses the current context."
+  type        = string
+  default     = ""
+}
+
+variable "namespace" {
+  description = "The namespace for workspaces. Use the same value in the template."
+  type        = string
+
+  validation {
+    condition     = can(regex("^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", var.namespace)) && length(var.namespace) <= 63
+    error_message = "namespace must be a valid Kubernetes namespace name."
+  }
+}
+
+variable "create_namespace" {
+  description = "Create the namespace. Set false if it exists already. Changing this from true to false deletes the namespace."
+  type        = bool
+  default     = true
+}
+
+variable "provisioner_service_account" {
+  description = "The ServiceAccount of the Coder provisioner. The Coder Helm chart uses coder in the coder namespace."
+  type = object({
+    name      = string
+    namespace = string
+  })
+  default = {
+    name      = "coder"
+    namespace = "coder"
+  }
+}
+
+provider "kubernetes" {
+  config_path    = var.kubeconfig_path
+  config_context = var.kubeconfig_context == "" ? null : var.kubeconfig_context
+}
+
+locals {
+  namespace = var.create_namespace ? kubernetes_namespace_v1.workspaces[0].metadata[0].name : var.namespace
+}
+
+resource "kubernetes_namespace_v1" "workspaces" {
+  count = var.create_namespace ? 1 : 0
+  metadata {
+    name = var.namespace
+  }
+}
+
+# The provisioner manages workspaces in this namespace only.
+resource "kubernetes_role_v1" "provisioner" {
+  metadata {
+    name      = "coder-kubernetes-sandboxed"
+    namespace = local.namespace
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["pods", "persistentvolumeclaims", "secrets", "configmaps", "services"]
+    verbs      = ["create", "delete", "get", "list", "patch", "update", "watch"]
+  }
+  rule {
+    api_groups = ["networking.k8s.io"]
+    resources  = ["networkpolicies"]
+    verbs      = ["create", "delete", "get", "list", "patch", "update", "watch"]
+  }
+  # Read-only, to debug workspaces with kubectl as the provisioner.
+  rule {
+    api_groups = [""]
+    resources  = ["pods/log", "events"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_role_binding_v1" "provisioner" {
+  metadata {
+    name      = "coder-kubernetes-sandboxed"
+    namespace = local.namespace
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role_v1.provisioner.metadata[0].name
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = var.provisioner_service_account.name
+    namespace = var.provisioner_service_account.namespace
+  }
+}
+
+output "namespace" {
+  description = "The workspace namespace. Set it as the namespace template variable."
+  value       = local.namespace
+}
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/cluster/tests/cluster.tftest.hcl b/registry/coder-labs/templates/kubernetes-sandboxed/cluster/tests/cluster.tftest.hcl
new file mode 100644
index 000000000..4f26586c2
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/cluster/tests/cluster.tftest.hcl
@@ -0,0 +1,45 @@
+mock_provider "kubernetes" {}
+
+variables {
+  namespace = "coder-workspaces"
+}
+
+run "creates_namespace_and_role" {
+  command = plan
+
+  assert {
+    condition     = length(kubernetes_namespace_v1.workspaces) == 1 && kubernetes_namespace_v1.workspaces[0].metadata[0].name == "coder-workspaces"
+    error_message = "The namespace must be created by default."
+  }
+  assert {
+    condition     = kubernetes_role_binding_v1.provisioner.subject[0].name == "coder" && kubernetes_role_binding_v1.provisioner.subject[0].namespace == "coder"
+    error_message = "The Role must be bound to the Coder Helm chart's ServiceAccount by default."
+  }
+  assert {
+    condition     = toset(kubernetes_role_v1.provisioner.rule[0].resources) == toset(["pods", "persistentvolumeclaims", "secrets", "configmaps", "services"])
+    error_message = "The provisioner must manage only the objects that the template creates."
+  }
+}
+
+run "existing_namespace" {
+  command = plan
+
+  variables {
+    create_namespace = false
+  }
+
+  assert {
+    condition     = length(kubernetes_namespace_v1.workspaces) == 0 && kubernetes_role_v1.provisioner.metadata[0].namespace == "coder-workspaces"
+    error_message = "create_namespace = false must use the namespace as is."
+  }
+}
+
+run "rejects_bad_namespace" {
+  command = plan
+
+  variables {
+    namespace = "Coder_Workspaces"
+  }
+
+  expect_failures = [var.namespace]
+}
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/main.tf b/registry/coder-labs/templates/kubernetes-sandboxed/main.tf
new file mode 100644
index 000000000..570a3be92
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/main.tf
@@ -0,0 +1,997 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">= 2.12"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.23"
+    }
+    http = {
+      source  = "hashicorp/http"
+      version = ">= 3.4"
+    }
+  }
+}
+
+provider "coder" {}
+
+variable "use_kubeconfig" {
+  description = <<-EOF
+  Use host kubeconfig? (true/false)
+
+  Set this to false if the Coder host is itself running as a Pod on the same
+  Kubernetes cluster as you are deploying workspaces to.
+
+  Set this to true if the Coder host is running outside the Kubernetes cluster
+  for workspaces. A valid "~/.kube/config" must be present on the Coder host.
+  EOF
+  type        = bool
+  default     = false
+}
+
+variable "namespace" {
+  description = "The Kubernetes namespace for workspaces. cluster/ creates it with the Role."
+  type        = string
+
+  validation {
+    condition     = length(trimspace(var.namespace)) > 0
+    error_message = "namespace must not be empty."
+  }
+}
+
+variable "workspace_image" {
+  description = "The workspace image. Build it from build/Dockerfile, with a Coder agent that matches your Coder server. Use a fixed tag or a digest, not :latest."
+  type        = string
+
+  validation {
+    condition = (
+      length(trimspace(var.workspace_image)) > 0 &&
+      !endswith(var.workspace_image, ":latest") &&
+      can(regex("[:@]", element(split("/", var.workspace_image), length(split("/", var.workspace_image)) - 1)))
+    )
+    error_message = "workspace_image must have a tag other than :latest, or a digest, such as registry.example.com/coder/workspace:v2.30.0."
+  }
+}
+
+variable "proxy_image" {
+  description = "The egress proxy image. Build it from build/egress-proxy/Dockerfile. Use a fixed tag or a digest, not :latest."
+  type        = string
+
+  validation {
+    condition = (
+      length(trimspace(var.proxy_image)) > 0 &&
+      !endswith(var.proxy_image, ":latest") &&
+      can(regex("[:@]", element(split("/", var.proxy_image), length(split("/", var.proxy_image)) - 1)))
+    )
+    error_message = "proxy_image must have a tag other than :latest, or a digest, such as registry.example.com/coder/egress-proxy:v1."
+  }
+}
+
+variable "coder_egress_cidrs" {
+  description = "The IPv4 CIDR ranges of the Coder server, for example [\"203.0.113.10/32\"]. Every workspace can reach these ranges directly. Everything else goes through the proxy."
+  type        = list(string)
+
+  validation {
+    condition     = length(var.coder_egress_cidrs) > 0 && alltrue([for c in var.coder_egress_cidrs : can(cidrhost(c, 0)) && !strcontains(c, ":")])
+    error_message = "coder_egress_cidrs must have at least one valid IPv4 CIDR range, such as 203.0.113.10/32."
+  }
+}
+
+# 0, not null, so that coder templates push does not ask for it.
+variable "coder_egress_port" {
+  description = "The TCP port that workspaces use to reach the Coder server. 0 uses the port of the access URL: its explicit port, or 443 for https and 80 for http."
+  type        = number
+  default     = 0
+
+  validation {
+    condition     = var.coder_egress_port >= 0 && var.coder_egress_port <= 65535 && floor(var.coder_egress_port) == var.coder_egress_port
+    error_message = "coder_egress_port must be 0 or a whole number from 1 to 65535."
+  }
+}
+
+variable "coder_host_ip" {
+  description = "The IPv4 address of the Coder access URL host. Workspaces have no DNS, so if the access URL uses a host name, the template adds this address to /etc/hosts. Leave empty if the access URL uses an IP address."
+  type        = string
+  default     = ""
+
+  validation {
+    condition     = var.coder_host_ip == "" || (can(cidrhost("${var.coder_host_ip}/32", 0)) && !strcontains(var.coder_host_ip, ":"))
+    error_message = "coder_host_ip must be empty or an IPv4 address."
+  }
+}
+
+# A comma-separated string, not a list, because Coder checks presets with
+# every template variable as a string.
+variable "runtimes" {
+  description = "Sandbox runtimes that users can pick in addition to the node's container runtime, comma-separated. Offer only RuntimeClasses that the cluster has: gvisor, kata-qemu, kata-clh. Empty offers none."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = (
+      length(compact(split(",", replace(var.runtimes, " ", "")))) == length(distinct(compact(split(",", replace(var.runtimes, " ", ""))))) &&
+      alltrue([for r in compact(split(",", replace(var.runtimes, " ", ""))) : contains(["gvisor", "kata-qemu", "kata-clh"], r)])
+    )
+    error_message = "runtimes can list only gvisor, kata-qemu, and kata-clh, comma-separated, each once."
+  }
+}
+
+variable "home_disk_size" {
+  description = "The size of the persistent home disk in GiB."
+  type        = number
+  default     = 10
+
+  validation {
+    condition     = var.home_disk_size >= 1
+    error_message = "home_disk_size must be at least 1."
+  }
+}
+
+variable "storage_class_name" {
+  description = "The StorageClass for the persistent home disk. Leave empty to use the cluster default. Use a class with volumeBindingMode WaitForFirstConsumer."
+  type        = string
+  default     = ""
+}
+
+variable "prebuild_instances" {
+  description = "The number of prebuilt workspaces to keep for each preset. Prebuilds need a Coder Premium license. Set 0 to turn them off."
+  type        = number
+  default     = 1
+
+  validation {
+    condition     = var.prebuild_instances >= 0 && floor(var.prebuild_instances) == var.prebuild_instances
+    error_message = "prebuild_instances must be a whole number, 0 or more."
+  }
+}
+
+variable "git_repo_url" {
+  description = "A Git repository to clone into /home/coder over HTTPS, for example https://github.com/coder/coder. Only profiles that allow GitHub clone it. Empty clones nothing."
+  type        = string
+  default     = ""
+}
+
+variable "enable_ai_gateway" {
+  description = "Send Claude Code requests through the Coder AI Gateway (Premium). Claude Code then reaches Anthropic through the Coder server, so it works in Fully isolated."
+  type        = bool
+  default     = true
+}
+
+variable "enable_claude_code" {
+  description = "Add the Claude Code app and its settings. Turn this off if you build the image with INSTALL_CLAUDE_CODE=false."
+  type        = bool
+  default     = true
+}
+
+variable "network_policy_gate" {
+  description = "Start the Coder agent only after the NetworkPolicy blocks the Kubernetes API server. Turn this off only if coder_egress_cidrs includes the API server address."
+  type        = bool
+  default     = true
+}
+
+variable "dns_servers" {
+  description = "The DNS servers that the proxy uses, comma-separated IPv4 addresses. Empty uses 8.8.8.8 and 1.1.1.1. Use servers outside the cluster, because on some network plugins an ipBlock rule does not match cluster DNS. Workspaces have no DNS."
+  type        = string
+  default     = ""
+
+  validation {
+    condition     = alltrue([for d in compact(split(",", replace(var.dns_servers, " ", ""))) : can(cidrhost("${d}/32", 0)) && !strcontains(d, ":")])
+    error_message = "dns_servers must be empty or IPv4 addresses, comma-separated."
+  }
+}
+
+provider "kubernetes" {
+  config_path = var.use_kubeconfig ? "~/.kube/config" : null
+}
+
+data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
+
+# Network profiles: what a workspace can reach in addition to the Coder
+# server. The proxy matches host names. Do not add hosts that store user
+# content, because the workspace can send data to them.
+locals {
+  github_hosts = [
+    "github.com",
+    "api.github.com",
+    "codeload.github.com",
+    "objects.githubusercontent.com",
+    "raw.githubusercontent.com",
+    "release-assets.githubusercontent.com",
+  ]
+
+  profiles = {
+    isolated = {
+      display_name = "Fully isolated"
+      description  = "Coder only. No proxy, no internet, and no DNS."
+      icon         = "/emojis/1f512.png"
+      hosts        = []
+    }
+    github = {
+      display_name = "GitHub only"
+      description  = "Coder and GitHub on port 443."
+      icon         = "/icon/github.svg"
+      hosts        = local.github_hosts
+    }
+    development = {
+      display_name = "GitHub and package registries"
+      description  = "Coder, GitHub, npm, the Go module proxy, and PyPI on port 443."
+      icon         = "/emojis/1f4e6.png"
+      hosts = concat(local.github_hosts, [
+        "registry.npmjs.org",
+        "proxy.golang.org",
+        "sum.golang.org",
+        "storage.googleapis.com",
+        "pypi.org",
+        "files.pythonhosted.org",
+      ])
+    }
+    internet = {
+      display_name = "Public internet"
+      description  = "Coder and any public host name on ports 443 and 80. No raw IP addresses, private ranges, or cloud metadata."
+      icon         = "/emojis/1f310.png"
+      hosts        = []
+    }
+    custom = {
+      display_name = "Custom"
+      description  = "Coder and the host names and ports that you type below."
+      icon         = "/emojis/270f.png"
+      hosts        = []
+    }
+  }
+
+  # Private, shared, and link-local ranges: the VPC, the cluster, other
+  # Pods, and cloud metadata. The proxy cannot reach them.
+  private_cidrs = ["10.0.0.0/8", "100.64.0.0/10", "169.254.0.0/16", "172.16.0.0/12", "192.168.0.0/16"]
+  dns_servers   = var.dns_servers != "" ? compact(split(",", replace(var.dns_servers, " ", ""))) : ["8.8.8.8", "1.1.1.1"]
+
+  # Profiles that can reach GitHub, so they clone git_repo_url.
+  github_profiles = ["github", "development", "internet"]
+
+  runtimes = compact(split(",", replace(var.runtimes, " ", "")))
+  runtime_options = {
+    gvisor = {
+      name        = "gVisor"
+      description = "A kernel that runs in user space. Needs gVisor on the nodes."
+      icon        = "/icon/container.svg"
+    }
+    kata-qemu = {
+      name        = "Kata microVM (QEMU)"
+      description = "A small VM with its own kernel. Needs a node with /dev/kvm."
+      icon        = "/icon/memory.svg"
+    }
+    kata-clh = {
+      name        = "Kata microVM (Cloud Hypervisor)"
+      description = "A small VM with a lighter hypervisor. Needs a node with /dev/kvm."
+      icon        = "/icon/memory.svg"
+    }
+  }
+}
+
+data "coder_parameter" "network_isolation" {
+  name         = "network_isolation"
+  display_name = "Network isolation"
+  description  = "What the workspace can reach in addition to Coder. A proxy allows it by host name, and a NetworkPolicy lets the workspace reach only Coder and that proxy. You cannot change it after create."
+  type         = "string"
+  form_type    = "dropdown"
+  default      = "isolated"
+  mutable      = false
+  order        = 1
+
+  dynamic "option" {
+    for_each = local.profiles
+    content {
+      name        = option.value.display_name
+      description = option.value.description
+      value       = option.key
+      icon        = option.value.icon
+    }
+  }
+}
+
+# The Custom profile. These parameters appear only when you pick Custom.
+locals {
+  custom       = data.coder_parameter.network_isolation.value == "custom"
+  custom_hosts = local.custom ? distinct([for h in jsondecode(data.coder_parameter.custom_hosts[0].value) : lower(trimspace(h)) if trimspace(h) != ""]) : []
+  custom_ports = local.custom ? distinct([for p in jsondecode(data.coder_parameter.custom_ports[0].value) : tonumber(p)]) : []
+
+  # An exact name with a dot, or "*." and at least two more labels. No IP
+  # addresses, and no cluster or internal suffixes.
+  host_label       = "[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?"
+  host_pattern     = "^(\\*\\.)?(${local.host_label}\\.)+[a-z][a-z0-9-]*[a-z0-9]$"
+  blocked_suffixes = ["localhost", "local", "internal", "cluster.local", "svc", "localdomain"]
+  custom_bad = [
+    for h in local.custom_hosts : h
+    if !can(regex(local.host_pattern, h)) ||
+    anytrue([for b in local.blocked_suffixes : h == b || endswith(h, ".${b}")])
+  ]
+  custom_problems = local.custom ? length(local.custom_bad) + (length(local.custom_hosts) == 0 ? 1 : 0) + (length(local.custom_ports) == 0 ? 1 : 0) : 0
+}
+
+data "coder_parameter" "custom_hosts" {
+  count        = local.custom ? 1 : 0
+  name         = "custom_hosts"
+  display_name = "Custom: host names"
+  description  = "Type a host name such as api.example.com or *.example.com and press Enter. *.example.com also allows example.com."
+  type         = "list(string)"
+  form_type    = "tag-select"
+  default      = jsonencode(["github.com", "api.github.com", "registry.npmjs.org"])
+  mutable      = false
+  order        = 2
+}
+
+data "coder_parameter" "custom_ports" {
+  count        = local.custom ? 1 : 0
+  name         = "custom_ports"
+  display_name = "Custom: TCP ports"
+  description  = "The ports that the workspace can use on the hosts above. The proxy relays HTTPS without decrypting it."
+  type         = "list(string)"
+  form_type    = "multi-select"
+  default      = jsonencode(["443"])
+  mutable      = false
+  order        = 3
+
+  option {
+    name  = "443 (HTTPS)"
+    value = "443"
+  }
+  option {
+    name  = "80 (HTTP)"
+    value = "80"
+  }
+}
+
+# Shows the problems in the Custom fields while there are any. Its
+# validation blocks Create, so the form reports them before the build.
+data "coder_parameter" "custom_problems" {
+  count        = local.custom_problems > 0 ? 1 : 0
+  name         = "custom_problems"
+  display_name = "Custom: problems to fix"
+  type         = "number"
+  form_type    = "input"
+  default      = local.custom_problems
+  mutable      = true
+  order        = 4
+  styling      = jsonencode({ disabled = true })
+
+  validation {
+    min   = 0
+    max   = 0
+    error = length(local.custom_hosts) == 0 ? "Type at least one host name." : length(local.custom_ports) == 0 ? "Pick at least one port." : "Not a host name that the proxy can allow: ${join(", ", local.custom_bad)}."
+  }
+}
+
+data "coder_parameter" "runtime" {
+  count        = length(local.runtimes) > 0 ? 1 : 0
+  name         = "runtime"
+  display_name = "Kernel isolation"
+  description  = "The RuntimeClass of the workspace Pod. The network rules are the same for every option."
+  type         = "string"
+  form_type    = "dropdown"
+  default      = "none"
+  mutable      = false
+  order        = 5
+
+  option {
+    name        = "None"
+    value       = "none"
+    description = "The node's container runtime. The workspace shares the node kernel. The fastest."
+    icon        = "/icon/kubernetes.svg"
+  }
+  dynamic "option" {
+    for_each = local.runtimes
+    content {
+      name        = local.runtime_options[option.value].name
+      value       = option.value
+      description = local.runtime_options[option.value].description
+      icon        = local.runtime_options[option.value].icon
+    }
+  }
+}
+
+# One preset for each fixed profile, on the node's container runtime. A
+# preset sets every immutable parameter, so a claimed prebuild never
+# changes one.
+data "coder_workspace_preset" "profile" {
+  for_each    = { for k, v in local.profiles : k => v if k != "custom" }
+  name        = each.value.display_name
+  description = each.value.description
+  icon        = each.value.icon
+  default     = each.key == "isolated"
+  parameters = merge(
+    { network_isolation = each.key },
+    length(local.runtimes) > 0 ? { runtime = "none" } : {},
+  )
+
+  dynamic "prebuilds" {
+    for_each = var.prebuild_instances > 0 ? [1] : []
+    content {
+      instances = var.prebuild_instances
+    }
+  }
+}
+
+locals {
+  name    = "coder-${data.coder_workspace.me.id}"
+  runtime = try(data.coder_parameter.runtime[0].value, "none")
+  profile = local.profiles[data.coder_parameter.network_isolation.value]
+
+  # What the proxy allows. Fully isolated has no proxy.
+  any_host    = data.coder_parameter.network_isolation.value == "internet"
+  proxy_hosts = local.custom ? local.custom_hosts : local.profile.hosts
+  proxy       = local.any_host || length(local.proxy_hosts) > 0
+  proxy_ports = local.custom ? local.custom_ports : local.any_host ? [443, 80] : [443]
+  # Squid writes "*.example.com" as ".example.com", which also allows
+  # example.com.
+  squid_conf = templatefile("${path.module}/squid.conf.tftpl", {
+    any_host        = local.any_host
+    allowed_domains = join(" ", [for h in local.proxy_hosts : startswith(h, "*.") ? substr(h, 1, -1) : h])
+    allow_tls       = contains(local.proxy_ports, 443)
+    allow_http      = contains(local.proxy_ports, 80)
+    dns_servers     = join(" ", local.dns_servers)
+  })
+
+  # Labels stay the same when a prebuilt workspace is claimed, so a claim
+  # does not change the Pods.
+  labels = {
+    "app.kubernetes.io/name"    = "coder-workspace"
+    "app.kubernetes.io/part-of" = "coder"
+    "com.coder.resource"        = "true"
+    "com.coder.workspace.id"    = data.coder_workspace.me.id
+  }
+  workspace_labels = merge(local.labels, { "coder.com/role" = "workspace" })
+  proxy_labels     = merge(local.labels, { "coder.com/role" = "proxy" })
+  owner_annotations = {
+    "com.coder.workspace.name" = data.coder_workspace.me.name
+    "com.coder.user.id"        = data.coder_workspace_owner.me.id
+    "com.coder.user.username"  = data.coder_workspace_owner.me.name
+  }
+
+  access_host       = try(regex("^[a-zA-Z][a-zA-Z0-9+.-]*://([^/:]+)", data.coder_workspace.me.access_url)[0], "")
+  access_host_is_ip = can(regex("^[0-9]{1,3}(\\.[0-9]{1,3}){3}$", local.access_host))
+  access_port = try(
+    tonumber(regex("^[a-zA-Z][a-zA-Z0-9+.-]*://[^/:]+:([0-9]+)", data.coder_workspace.me.access_url)[0]),
+    startswith(lower(data.coder_workspace.me.access_url), "http://") ? 80 : 443,
+  )
+  coder_port = var.coder_egress_port > 0 ? var.coder_egress_port : local.access_port
+
+  # Copy the image's dotfiles into a new, empty home.
+  seed_home = "[ -e /home/coder/.bashrc ] || cp -an /etc/skel/. /home/coder/ 2>/dev/null || true"
+
+  agent_command = join("\n", [
+    local.seed_home,
+    "ulimit -n 65536 2>/dev/null || true",
+    var.network_policy_gate ? file("${path.module}/start-agent.sh") : "exec /usr/local/bin/coder agent",
+  ])
+
+  resources = {
+    requests = { cpu = "500m", memory = "1Gi" }
+    limits   = { cpu = "2", memory = "4Gi" }
+  }
+}
+
+resource "coder_agent" "dev" {
+  os   = "linux"
+  arch = "amd64"
+
+  metadata {
+    display_name = "CPU Usage"
+    key          = "0_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+  metadata {
+    display_name = "RAM Usage"
+    key          = "1_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+  metadata {
+    display_name = "Home Disk"
+    key          = "2_home_disk"
+    script       = "coder stat disk --path $${HOME}"
+    interval     = 60
+    timeout      = 1
+  }
+  metadata {
+    display_name = "Kernel"
+    key          = "3_kernel"
+    script       = "uname -r"
+    interval     = 600
+    timeout      = 1
+  }
+}
+
+# The same check as custom_problems, for builds that do not come from the
+# form, such as the API or the CLI.
+resource "terraform_data" "custom_check" {
+  count = local.custom ? 1 : 0
+
+  lifecycle {
+    precondition {
+      condition     = local.custom_problems == 0
+      error_message = "Custom needs at least one valid host name and one port. Not valid: ${join(", ", local.custom_bad)}"
+    }
+  }
+}
+
+# For the life of the workspace: the home disk, the network rules, and the
+# proxy's config and Service.
+resource "kubernetes_persistent_volume_claim_v1" "home" {
+  metadata {
+    name        = "${local.name}-home"
+    namespace   = var.namespace
+    labels      = local.labels
+    annotations = local.owner_annotations
+  }
+  wait_until_bound = false
+  spec {
+    access_modes       = ["ReadWriteOnce"]
+    storage_class_name = var.storage_class_name != "" ? var.storage_class_name : null
+    resources {
+      requests = {
+        storage = "${var.home_disk_size}Gi"
+      }
+    }
+  }
+}
+
+# The workspace Pod: no ingress, and egress only to the Coder server and
+# its own proxy. No DNS, because the proxy resolves names.
+resource "kubernetes_network_policy_v1" "workspace" {
+  metadata {
+    name      = "${local.name}-workspace"
+    namespace = var.namespace
+    labels    = local.labels
+  }
+  spec {
+    pod_selector {
+      match_labels = local.workspace_labels
+    }
+    policy_types = ["Ingress", "Egress"]
+
+    egress {
+      dynamic "to" {
+        for_each = var.coder_egress_cidrs
+        content {
+          ip_block {
+            cidr = to.value
+          }
+        }
+      }
+      ports {
+        protocol = "TCP"
+        port     = tostring(local.coder_port)
+      }
+    }
+
+    dynamic "egress" {
+      for_each = local.proxy ? [1] : []
+      content {
+        to {
+          pod_selector {
+            match_labels = local.proxy_labels
+          }
+        }
+        ports {
+          protocol = "TCP"
+          port     = "3128"
+        }
+      }
+    }
+  }
+}
+
+# The proxy Pod: ingress only from its workspace, and egress only to public
+# addresses on the profile's ports and to DNS. Squid also refuses private
+# addresses itself.
+resource "kubernetes_network_policy_v1" "proxy" {
+  count = local.proxy ? 1 : 0
+  metadata {
+    name      = "${local.name}-proxy"
+    namespace = var.namespace
+    labels    = local.labels
+  }
+  spec {
+    pod_selector {
+      match_labels = local.proxy_labels
+    }
+    policy_types = ["Ingress", "Egress"]
+
+    ingress {
+      from {
+        pod_selector {
+          match_labels = local.workspace_labels
+        }
+      }
+      ports {
+        protocol = "TCP"
+        port     = "3128"
+      }
+    }
+
+    egress {
+      to {
+        ip_block {
+          cidr   = "0.0.0.0/0"
+          except = local.private_cidrs
+        }
+      }
+      dynamic "ports" {
+        for_each = local.proxy_ports
+        content {
+          protocol = "TCP"
+          port     = tostring(ports.value)
+        }
+      }
+    }
+
+    egress {
+      dynamic "to" {
+        for_each = local.dns_servers
+        content {
+          ip_block {
+            cidr = "${to.value}/32"
+          }
+        }
+      }
+      ports {
+        protocol = "UDP"
+        port     = "53"
+      }
+      ports {
+        protocol = "TCP"
+        port     = "53"
+      }
+    }
+  }
+}
+
+resource "kubernetes_config_map_v1" "proxy" {
+  count = local.proxy ? 1 : 0
+  metadata {
+    name      = "${local.name}-proxy"
+    namespace = var.namespace
+    labels    = local.labels
+  }
+  data = {
+    "squid.conf" = local.squid_conf
+  }
+}
+
+# The workspace has no DNS, so it reaches the proxy by the Service's
+# cluster IP. The IP stays the same for the life of the workspace.
+resource "kubernetes_service_v1" "proxy" {
+  count = local.proxy ? 1 : 0
+  metadata {
+    name      = "${local.name}-proxy"
+    namespace = var.namespace
+    labels    = local.labels
+  }
+  spec {
+    selector = local.proxy_labels
+    port {
+      name        = "squid"
+      port        = 3128
+      target_port = 3128
+    }
+  }
+}
+
+# Only while the workspace is started. The Pod reads the agent token from
+# it, so the token is not in the Pod spec.
+resource "kubernetes_secret_v1" "agent_token" {
+  count = data.coder_workspace.me.start_count
+  metadata {
+    name      = "${local.name}-agent-token"
+    namespace = var.namespace
+    labels    = local.labels
+  }
+  data = {
+    token = coder_agent.dev.token
+  }
+}
+
+# A new id on every start. VPC CNI groups Pods by their name without the
+# last "-" part and drops a group's rules when an old Pod of the group is
+# deleted. A fixed "-pod" after this id keeps every Pod in its own group.
+resource "terraform_data" "pod_name" {
+  count = data.coder_workspace.me.start_count
+}
+
+locals {
+  pod_id = try(substr(terraform_data.pod_name[0].id, 0, 8), "")
+  # curl reads only the lowercase names. Go and most other tools read the
+  # uppercase ones.
+  proxy_url = local.proxy ? "http://${kubernetes_service_v1.proxy[0].spec[0].cluster_ip}:3128" : ""
+  proxy_env = local.proxy ? {
+    HTTP_PROXY  = local.proxy_url
+    HTTPS_PROXY = local.proxy_url
+    http_proxy  = local.proxy_url
+    https_proxy = local.proxy_url
+    NO_PROXY    = "localhost,127.0.0.1,::1,${local.access_host}"
+    no_proxy    = "localhost,127.0.0.1,::1,${local.access_host}"
+  } : {}
+}
+
+# Only while the workspace is started, like the workspace Pod. Squid reads
+# its config only at start, so a new config replaces the Pod.
+resource "kubernetes_pod_v1" "proxy" {
+  count      = local.proxy ? data.coder_workspace.me.start_count : 0
+  depends_on = [kubernetes_network_policy_v1.proxy]
+
+  lifecycle {
+    replace_triggered_by = [kubernetes_config_map_v1.proxy]
+  }
+  metadata {
+    name      = "${local.name}-proxy-${local.pod_id}-pod"
+    namespace = var.namespace
+    labels    = local.proxy_labels
+  }
+  spec {
+    automount_service_account_token  = false
+    enable_service_links             = false
+    termination_grace_period_seconds = 1
+    security_context {
+      run_as_non_root = true
+      run_as_user     = 31
+      run_as_group    = 31
+      seccomp_profile {
+        type = "RuntimeDefault"
+      }
+    }
+    container {
+      name              = "squid"
+      image             = var.proxy_image
+      image_pull_policy = "IfNotPresent"
+      security_context {
+        allow_privilege_escalation = false
+        read_only_root_filesystem  = true
+        capabilities {
+          drop = ["ALL"]
+        }
+      }
+      resources {
+        requests = { cpu = "50m", memory = "64Mi" }
+        limits   = { cpu = "500m", memory = "256Mi" }
+      }
+      readiness_probe {
+        tcp_socket {
+          port = 3128
+        }
+        period_seconds = 2
+      }
+      volume_mount {
+        name       = "conf"
+        mount_path = "/etc/squid-conf"
+        read_only  = true
+      }
+    }
+    volume {
+      name = "conf"
+      config_map {
+        name = kubernetes_config_map_v1.proxy[0].metadata[0].name
+      }
+    }
+  }
+}
+
+# A bare Pod, so nothing waits on a controller. Stop deletes it and keeps
+# the home disk.
+resource "kubernetes_pod_v1" "workspace" {
+  count      = data.coder_workspace.me.start_count
+  depends_on = [kubernetes_network_policy_v1.workspace]
+
+  lifecycle {
+    precondition {
+      condition     = local.access_host_is_ip || var.coder_host_ip != ""
+      error_message = "Workspaces have no DNS, so the agent cannot resolve ${local.access_host}. Set the coder_host_ip template variable to the IP address of the Coder server."
+    }
+  }
+
+  metadata {
+    name      = "${local.name}-${local.pod_id}-pod"
+    namespace = var.namespace
+    labels    = local.workspace_labels
+  }
+  spec {
+    runtime_class_name               = local.runtime == "none" ? null : local.runtime
+    automount_service_account_token  = false
+    enable_service_links             = false
+    termination_grace_period_seconds = 2
+    dns_policy                       = "None"
+    # No DNS: lookups go to a closed local port and fail at once. The proxy
+    # resolves names.
+    dns_config {
+      nameservers = ["127.0.0.1"]
+    }
+    dynamic "host_aliases" {
+      for_each = var.coder_host_ip != "" && !local.access_host_is_ip ? [1] : []
+      content {
+        ip        = var.coder_host_ip
+        hostnames = [local.access_host]
+      }
+    }
+    security_context {
+      run_as_non_root        = true
+      run_as_user            = 1000
+      run_as_group           = 1000
+      fs_group               = 1000
+      fs_group_change_policy = "OnRootMismatch"
+      seccomp_profile {
+        type = "RuntimeDefault"
+      }
+    }
+    container {
+      name              = "dev"
+      image             = var.workspace_image
+      image_pull_policy = "IfNotPresent"
+      command           = ["bash", "-c", local.agent_command]
+      working_dir       = "/home/coder"
+      env {
+        name = "CODER_AGENT_TOKEN"
+        value_from {
+          secret_key_ref {
+            name = kubernetes_secret_v1.agent_token[0].metadata[0].name
+            key  = "token"
+          }
+        }
+      }
+      env {
+        name  = "CODER_AGENT_URL"
+        value = data.coder_workspace.me.access_url
+      }
+      env {
+        name  = "CODER_AGENT_AUTH"
+        value = "token"
+      }
+      dynamic "env" {
+        for_each = local.proxy_env
+        content {
+          name  = env.key
+          value = env.value
+        }
+      }
+      security_context {
+        allow_privilege_escalation = false
+        run_as_non_root            = true
+        capabilities {
+          drop = ["ALL"]
+        }
+      }
+      resources {
+        requests = local.resources.requests
+        limits   = local.resources.limits
+      }
+      volume_mount {
+        name       = "home"
+        mount_path = "/home/coder"
+      }
+      volume_mount {
+        name       = "tmp"
+        mount_path = "/tmp"
+      }
+    }
+    volume {
+      name = "home"
+      persistent_volume_claim {
+        claim_name = kubernetes_persistent_volume_claim_v1.home.metadata[0].name
+      }
+    }
+    volume {
+      name = "tmp"
+      empty_dir {}
+    }
+  }
+}
+
+# code-server and Claude Code are in the image, so the modules download
+# nothing and work in Fully isolated.
+module "code-server" {
+  count          = data.coder_workspace.me.start_count
+  source         = "registry.coder.com/coder/code-server/coder"
+  version        = "1.6.0"
+  agent_id       = coder_agent.dev.id
+  folder         = "/home/coder"
+  offline        = true
+  install_prefix = "/opt/code-server"
+  order          = 1
+}
+
+# A prebuild clones the repository before anyone claims it, and the module
+# skips the clone when the folder exists, so a claim does not wait for it.
+module "git-clone" {
+  count    = data.coder_workspace.me.start_count != 0 && var.git_repo_url != "" && contains(local.github_profiles, data.coder_parameter.network_isolation.value) ? 1 : 0
+  source   = "registry.coder.com/coder/git-clone/coder"
+  version  = "2.0.5"
+  agent_id = coder_agent.dev.id
+  url      = var.git_repo_url
+  base_dir = "/home/coder"
+}
+
+# Claude Code is in the image, so the template only sets its environment.
+# The claude-code registry module does the same, but it reads the
+# deprecated coder_task data source, which adds a warning to every build.
+resource "coder_env" "claude_disable_autoupdater" {
+  count    = var.enable_claude_code ? data.coder_workspace.me.start_count : 0
+  agent_id = coder_agent.dev.id
+  name     = "DISABLE_AUTOUPDATER"
+  value    = "1"
+}
+
+# With the AI Gateway, Claude Code reaches Anthropic through the Coder
+# server. It does not get the owner's session token, which has full access
+# to the Coder API. The build uses that token once to create a token with
+# only the user:read_personal scope, which the AI Gateway accepts, and gives
+# the workspace that one. timestamp() defers the request to apply, so a plan
+# creates nothing, and a prebuild gets its token when it is claimed.
+#
+# Coder deletes the session token before a stop build, so Terraform cannot
+# revoke the scoped token on stop. It expires after the deployment's
+# default token lifetime, and each start creates a new one.
+locals {
+  mint_ai_gateway_token = (
+    var.enable_ai_gateway && var.enable_claude_code &&
+    data.coder_workspace.me.start_count > 0 &&
+    !data.coder_workspace.me.is_prebuild &&
+    data.coder_workspace_owner.me.session_token != ""
+  )
+}
+
+data "http" "ai_gateway_token" {
+  count  = local.mint_ai_gateway_token ? 1 : 0
+  url    = "${data.coder_workspace.me.access_url}/api/v2/users/me/keys/tokens"
+  method = "POST"
+  request_headers = {
+    "Coder-Session-Token" = data.coder_workspace_owner.me.session_token
+    "Content-Type"        = "application/json"
+  }
+  request_body = jsonencode({
+    token_name = "ai-gateway-${substr(data.coder_workspace.me.id, 0, 8)}-${formatdate("YYYYMMDDhhmmss", timestamp())}"
+    scopes     = ["user:read_personal"]
+  })
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 201
+      error_message = "Could not create the AI Gateway token: HTTP ${self.status_code}."
+    }
+  }
+}
+
+resource "coder_env" "anthropic_base_url" {
+  count    = var.enable_ai_gateway && var.enable_claude_code ? data.coder_workspace.me.start_count : 0
+  agent_id = coder_agent.dev.id
+  name     = "ANTHROPIC_BASE_URL"
+  value    = "${data.coder_workspace.me.access_url}/api/v2/aibridge/anthropic"
+}
+
+resource "coder_env" "anthropic_auth_token" {
+  count    = local.mint_ai_gateway_token ? 1 : 0
+  agent_id = coder_agent.dev.id
+  name     = "ANTHROPIC_AUTH_TOKEN"
+  value    = sensitive(jsondecode(data.http.ai_gateway_token[0].response_body).key)
+}
+
+# Opens Claude Code in /home/coder. It continues the last conversation in
+# this folder, or starts a new one if there is none. In tmux, if the image
+# has it, the session outlives the browser tab.
+resource "coder_app" "claude" {
+  count        = var.enable_claude_code ? data.coder_workspace.me.start_count : 0
+  agent_id     = coder_agent.dev.id
+  slug         = "claude-code"
+  display_name = "Claude Code"
+  icon         = "/icon/claude.svg"
+  order        = 2
+  command      = <<-EOT
+    cd /home/coder
+    run="/opt/claude/bin/claude --continue || /opt/claude/bin/claude"
+    if command -v tmux >/dev/null 2>&1; then
+      exec tmux new-session -A -s claude "$run"
+    fi
+    eval "$run"
+  EOT
+}
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/squid.conf.tftpl b/registry/coder-labs/templates/kubernetes-sandboxed/squid.conf.tftpl
new file mode 100644
index 000000000..c8fc1dbfd
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/squid.conf.tftpl
@@ -0,0 +1,46 @@
+http_port 3128
+
+# Squid resolves names itself, with public DNS. The workspace has no DNS.
+dns_nameservers ${dns_servers}
+
+%{ if any_host ~}
+# Any public host name. A name must end in a letter, so a raw IPv4 address
+# never matches. -n disables reverse DNS.
+acl allowed dstdom_regex -n -i [a-z]$
+%{ else ~}
+# -n disables reverse DNS, so a raw IP address never matches a name.
+acl allowed dstdomain -n ${allowed_domains}
+%{ endif ~}
+
+# Checked after `allowed`, so Squid resolves only allowed names. Denied names
+# never reach DNS, so they cannot leak data in a lookup.
+acl private_dst dst 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 198.18.0.0/15 224.0.0.0/3 ::/128 ::1 fc00::/7 fe80::/10
+
+acl CONNECT method CONNECT
+acl tls_port port 443
+acl plain_port port 80
+
+# No cache manager, and no IPv6 literals such as [2001:db8::a].
+acl ip6_literal dstdom_regex -n :
+http_access deny manager
+http_access deny ip6_literal
+
+# HTTPS is a CONNECT tunnel to port 443. Plain HTTP goes to port 80 only.
+http_access deny CONNECT !tls_port
+http_access deny !CONNECT !plain_port
+%{ if !allow_tls ~}
+http_access deny CONNECT
+%{ endif ~}
+%{ if !allow_http ~}
+http_access deny !CONNECT
+%{ endif ~}
+http_access allow allowed !private_dst
+http_access deny all
+
+# Relay only: TLS is tunneled, never terminated. No cache, no pid file, and
+# logs to the container output, so Squid needs no writable paths.
+cache deny all
+pid_filename none
+cache_log stdio:/dev/stderr
+access_log stdio:/dev/stdout
+logfile_rotate 0
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/start-agent.sh b/registry/coder-labs/templates/kubernetes-sandboxed/start-agent.sh
new file mode 100644
index 000000000..2895b4a73
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/start-agent.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Starts the Coder agent once the Pod's NetworkPolicy is in force. main.tf
+# runs it inline with bash -c.
+#
+# VPC CNI can apply a new Pod's NetworkPolicy up to 30 s late, and can drop
+# it when another Pod with the same name prefix is deleted. So the agent
+# starts only once a TCP connection to the Kubernetes API server, which the
+# NetworkPolicy does not allow, fails. If it still connects after about
+# 60 s, the script exits and Kubernetes restarts the container. After
+# start, the same check runs every 5 s, and the container stops if the API
+# server becomes reachable. A slow TLS reply still counts as reachable, and
+# so does a check that prints nothing.
+api="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/"
+api_open() {
+  r=$(curl -sk -o /dev/null --noproxy '*' --connect-timeout 0.3 -m 1 -w '%{http_code} %{time_connect}' "$api" 2> /dev/null)
+  [ -z "$r" ] && return 0
+  awk -v t="${r#* }" 'BEGIN { exit !(t + 0 > 0) }'
+}
+i=0
+while api_open; do
+  i=$((i + 1))
+  if [ "$i" -ge 240 ]; then
+    echo "NetworkPolicy is not enforced" >&2
+    exit 1
+  fi
+  sleep 0.25
+done
+echo "NetworkPolicy is in force after $i checks" >&2
+# The agent must be PID 1, or the web terminal gets no input under Kata.
+# So the re-check runs in the background.
+(
+  while sleep 5; do
+    if api_open; then
+      echo "NetworkPolicy is no longer enforced" >&2
+      kill -TERM 1
+      sleep 2
+      kill -KILL -1
+      exit 1
+    fi
+  done
+) &
+exec /usr/local/bin/coder agent
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/tests/template.tftest.hcl b/registry/coder-labs/templates/kubernetes-sandboxed/tests/template.tftest.hcl
new file mode 100644
index 000000000..4e992a48b
--- /dev/null
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/tests/template.tftest.hcl
@@ -0,0 +1,725 @@
+mock_provider "coder" {
+  mock_data "coder_workspace" {
+    defaults = {
+      id          = "0b6b6a5e-0000-4000-8000-000000000001"
+      name        = "test"
+      start_count = 1
+      transition  = "start"
+      access_url  = "https://203.0.113.10"
+    }
+  }
+  mock_data "coder_workspace_owner" {
+    defaults = {
+      id            = "0b6b6a5e-0000-4000-8000-000000000002"
+      name          = "owner"
+      email         = "owner@example.org"
+      session_token = "owner-full-session-token"
+    }
+  }
+}
+
+mock_provider "kubernetes" {}
+
+mock_provider "http" {
+  mock_data "http" {
+    defaults = {
+      status_code   = 201
+      response_body = "{\"key\":\"scoped-id-scoped-secret\"}"
+    }
+  }
+}
+
+override_module {
+  target  = module.code-server
+  outputs = {}
+}
+
+variables {
+  namespace          = "coder-workspaces"
+  workspace_image    = "registry.example.com/coder/workspace:v2.30.0"
+  proxy_image        = "registry.example.com/coder/egress-proxy:v1"
+  coder_egress_cidrs = ["203.0.113.10/32"]
+}
+
+override_data {
+  target = data.coder_parameter.network_isolation
+  values = { value = "isolated" }
+}
+
+override_resource {
+  target          = terraform_data.pod_name
+  override_during = plan
+  values          = { id = "1a2b3c4d-0000-4000-8000-000000000003" }
+}
+
+run "isolated" {
+  command = plan
+
+  assert {
+    condition     = length(kubernetes_pod_v1.workspace) == 1 && length(kubernetes_pod_v1.proxy) == 0 && length(kubernetes_service_v1.proxy) == 0 && length(kubernetes_network_policy_v1.proxy) == 0
+    error_message = "Fully isolated must create the workspace Pod and no proxy."
+  }
+  assert {
+    condition     = kubernetes_persistent_volume_claim_v1.home.spec[0].resources[0].requests.storage == "10Gi"
+    error_message = "The home must be a 10Gi PVC."
+  }
+  assert {
+    condition = alltrue([
+      kubernetes_pod_v1.workspace[0].spec[0].automount_service_account_token == false,
+      kubernetes_pod_v1.workspace[0].spec[0].enable_service_links == false,
+      kubernetes_pod_v1.workspace[0].spec[0].security_context[0].run_as_non_root == true,
+      kubernetes_pod_v1.workspace[0].spec[0].security_context[0].run_as_user == "1000",
+      kubernetes_pod_v1.workspace[0].spec[0].security_context[0].fs_group == "1000",
+      kubernetes_pod_v1.workspace[0].spec[0].security_context[0].fs_group_change_policy == "OnRootMismatch",
+      kubernetes_pod_v1.workspace[0].spec[0].security_context[0].seccomp_profile[0].type == "RuntimeDefault",
+      kubernetes_pod_v1.workspace[0].spec[0].container[0].security_context[0].allow_privilege_escalation == false,
+      kubernetes_pod_v1.workspace[0].spec[0].container[0].security_context[0].capabilities[0].drop[0] == "ALL",
+      kubernetes_pod_v1.workspace[0].spec[0].container[0].image_pull_policy == "IfNotPresent",
+    ])
+    error_message = "The workspace Pod must be hardened."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.workspace[0].spec[0].runtime_class_name == null
+    error_message = "With no runtimes, the Pod must use the node's container runtime."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.workspace[0].spec[0].container[0].env[0].value_from[0].secret_key_ref[0].name == kubernetes_secret_v1.agent_token[0].metadata[0].name
+    error_message = "The agent token must come from the Secret."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.workspace[0].spec[0].container[0].env[1].value == "https://203.0.113.10"
+    error_message = "CODER_AGENT_URL must be the access URL."
+  }
+  assert {
+    condition     = length(kubernetes_pod_v1.workspace[0].spec[0].container[0].env) == 3
+    error_message = "Fully isolated must set no proxy variables."
+  }
+  assert {
+    condition     = strcontains(kubernetes_pod_v1.workspace[0].spec[0].container[0].command[2], "exec /usr/local/bin/coder agent\n") && strcontains(kubernetes_pod_v1.workspace[0].spec[0].container[0].command[2], "kill -TERM 1") && strcontains(kubernetes_pod_v1.workspace[0].spec[0].container[0].command[2], "KUBERNETES_SERVICE_HOST")
+    error_message = "The container must run the policy gate and then the agent from the image."
+  }
+  assert {
+    condition     = startswith(kubernetes_pod_v1.workspace[0].spec[0].container[0].command[2], "[ -e /home/coder/.bashrc ] || cp -an /etc/skel/.")
+    error_message = "A new home must get the image's dotfiles."
+  }
+  assert {
+    condition     = kubernetes_network_policy_v1.workspace.spec[0].pod_selector[0].match_labels == kubernetes_pod_v1.workspace[0].metadata[0].labels
+    error_message = "The workspace NetworkPolicy must select the workspace Pod."
+  }
+  assert {
+    condition     = length(kubernetes_network_policy_v1.workspace.spec[0].egress) == 1 && kubernetes_network_policy_v1.workspace.spec[0].egress[0].to[0].ip_block[0].cidr == "203.0.113.10/32" && kubernetes_network_policy_v1.workspace.spec[0].egress[0].ports[0].port == "443"
+    error_message = "Fully isolated must allow only the Coder server."
+  }
+  assert {
+    condition     = length(kubernetes_network_policy_v1.workspace.spec[0].ingress) == 0
+    error_message = "The workspace must get no ingress."
+  }
+  assert {
+    condition     = length(kubernetes_pod_v1.workspace[0].spec[0].host_aliases) == 0
+    error_message = "An IP access URL needs no host alias."
+  }
+  assert {
+    condition     = tolist(kubernetes_pod_v1.workspace[0].spec[0].dns_config[0].nameservers) == tolist(["127.0.0.1"]) && kubernetes_pod_v1.workspace[0].spec[0].dns_policy == "None"
+    error_message = "The workspace must have no DNS, and lookups must fail at once."
+  }
+  assert {
+    condition     = jsonencode(kubernetes_pod_v1.workspace[0].metadata[0].labels) == jsonencode(local.workspace_labels) && !strcontains(jsonencode(local.workspace_labels), "owner") && !strcontains(jsonencode(local.workspace_labels), "test")
+    error_message = "The Pod must not depend on the owner or the workspace name, so a claim does not replace it."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.workspace[0].metadata[0].name == "coder-0b6b6a5e-0000-4000-8000-000000000001-1a2b3c4d-pod"
+    error_message = "Pod names must end in -pod, after a part that is new for every Pod."
+  }
+}
+
+run "github" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "github" }
+  }
+
+  assert {
+    condition     = length(kubernetes_pod_v1.proxy) == 1 && length(kubernetes_service_v1.proxy) == 1 && length(kubernetes_config_map_v1.proxy) == 1
+    error_message = "GitHub only must create a proxy."
+  }
+  assert {
+    condition     = length(kubernetes_network_policy_v1.workspace.spec[0].egress) == 2 && kubernetes_network_policy_v1.workspace.spec[0].egress[1].to[0].pod_selector[0].match_labels == kubernetes_pod_v1.proxy[0].metadata[0].labels && kubernetes_network_policy_v1.workspace.spec[0].egress[1].ports[0].port == "3128"
+    error_message = "The workspace must reach Coder and its own proxy only."
+  }
+  assert {
+    condition     = kubernetes_network_policy_v1.proxy[0].spec[0].ingress[0].from[0].pod_selector[0].match_labels == kubernetes_pod_v1.workspace[0].metadata[0].labels
+    error_message = "Only the workspace must reach the proxy."
+  }
+  assert {
+    condition     = kubernetes_network_policy_v1.proxy[0].spec[0].egress[0].to[0].ip_block[0].cidr == "0.0.0.0/0" && contains(kubernetes_network_policy_v1.proxy[0].spec[0].egress[0].to[0].ip_block[0].except, "169.254.0.0/16") && [for p in kubernetes_network_policy_v1.proxy[0].spec[0].egress[0].ports : p.port] == ["443"]
+    error_message = "The proxy must reach only public addresses on 443."
+  }
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "acl allowed dstdomain -n github.com api.github.com") && !strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "registry.npmjs.org")
+    error_message = "GitHub only must allow the GitHub hosts only."
+  }
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "http_access deny !CONNECT\n")
+    error_message = "GitHub only must deny plain HTTP."
+  }
+  assert {
+    condition     = [for e in kubernetes_pod_v1.workspace[0].spec[0].container[0].env : e.name] == ["CODER_AGENT_TOKEN", "CODER_AGENT_URL", "CODER_AGENT_AUTH", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"]
+    error_message = "The workspace must get the proxy variables."
+  }
+  assert {
+    condition     = local.proxy_env["no_proxy"] == "localhost,127.0.0.1,::1,203.0.113.10"
+    error_message = "The workspace must reach Coder without the proxy."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.proxy[0].spec[0].container[0].security_context[0].read_only_root_filesystem == true && kubernetes_pod_v1.proxy[0].spec[0].automount_service_account_token == false
+    error_message = "The proxy Pod must be hardened."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.proxy[0].spec[0].security_context[0].run_as_user == "31" && kubernetes_pod_v1.proxy[0].spec[0].security_context[0].run_as_non_root == true && kubernetes_pod_v1.proxy[0].spec[0].container[0].security_context[0].capabilities[0].drop[0] == "ALL" && kubernetes_pod_v1.proxy[0].spec[0].container[0].security_context[0].allow_privilege_escalation == false
+    error_message = "The proxy Pod must run as squid with no capabilities."
+  }
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "http_access deny manager\n") && strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "http_access deny ip6_literal\n")
+    error_message = "The proxy must deny the cache manager and IPv6 literals."
+  }
+  assert {
+    condition     = length(module.git-clone) == 0
+    error_message = "With no git_repo_url, nothing is cloned."
+  }
+}
+
+run "development" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "development" }
+  }
+
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "registry.npmjs.org") && strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "pypi.org") && strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "proxy.golang.org")
+    error_message = "GitHub and package registries must allow npm, PyPI, and Go."
+  }
+}
+
+run "internet" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "internet" }
+  }
+
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "dstdom_regex -n -i [a-z]$")
+    error_message = "Public internet must allow any host name."
+  }
+  assert {
+    condition     = [for p in kubernetes_network_policy_v1.proxy[0].spec[0].egress[0].ports : p.port] == ["443", "80"]
+    error_message = "Public internet must allow 443 and 80."
+  }
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "acl private_dst dst") && strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "http_access allow allowed !private_dst")
+    error_message = "The proxy must refuse private addresses."
+  }
+}
+
+run "custom" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "custom" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_hosts
+    values = { value = "[\"Example.com\", \"*.wikipedia.org\"]" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_ports
+    values = { value = "[\"443\", \"80\"]" }
+  }
+
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "acl allowed dstdomain -n example.com .wikipedia.org")
+    error_message = "Custom must allow the typed hosts, in lowercase, with *. written as a leading dot."
+  }
+  assert {
+    condition     = length(data.coder_parameter.custom_problems) == 0
+    error_message = "Valid Custom fields must show no problems."
+  }
+  assert {
+    condition     = length(data.coder_workspace_preset.profile) == 4 && !contains(keys(data.coder_workspace_preset.profile), "custom")
+    error_message = "Custom must have no preset."
+  }
+}
+
+run "custom_rejects_ip_and_cluster_names" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "custom" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_hosts
+    values = { value = "[\"1.2.3.4\", \"kubernetes.default.svc\", \"*.com\"]" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_ports
+    values = { value = "[\"443\"]" }
+  }
+
+  expect_failures = [terraform_data.custom_check]
+}
+
+run "custom_http_only" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "custom" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_hosts
+    values = { value = "[\"example.com\"]" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_ports
+    values = { value = "[\"80\", \"80\"]" }
+  }
+
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "http_access deny CONNECT\n") && !strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "http_access deny !CONNECT\n")
+    error_message = "Custom with port 80 only must deny HTTPS tunnels and allow plain HTTP."
+  }
+  assert {
+    condition     = [for p in kubernetes_network_policy_v1.proxy[0].spec[0].egress[0].ports : p.port] == ["80"]
+    error_message = "The proxy must reach only port 80, once."
+  }
+}
+
+run "custom_needs_a_port" {
+  command = plan
+
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "custom" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_hosts
+    values = { value = "[\"example.com\"]" }
+  }
+  override_data {
+    target = data.coder_parameter.custom_ports
+    values = { value = "[]" }
+  }
+
+  expect_failures = [terraform_data.custom_check]
+}
+
+run "git_clone" {
+  command = plan
+
+  variables {
+    git_repo_url = "https://github.com/coder/coder"
+  }
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "github" }
+  }
+
+  assert {
+    condition     = length(module.git-clone) == 1
+    error_message = "GitHub only must clone git_repo_url."
+  }
+}
+
+run "git_clone_skips_fully_isolated" {
+  command = plan
+
+  variables {
+    git_repo_url = "https://github.com/coder/coder"
+  }
+
+  assert {
+    condition     = length(module.git-clone) == 0
+    error_message = "Fully isolated cannot reach GitHub, so it must not clone."
+  }
+}
+
+run "stop_keeps_home" {
+  command = plan
+
+  override_data {
+    target = data.coder_workspace.me
+    values = {
+      id          = "0b6b6a5e-0000-4000-8000-000000000001"
+      name        = "test"
+      start_count = 0
+      transition  = "stop"
+      access_url  = "https://203.0.113.10"
+    }
+  }
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "github" }
+  }
+
+  assert {
+    condition     = length(kubernetes_pod_v1.workspace) == 0 && length(kubernetes_pod_v1.proxy) == 0 && length(kubernetes_secret_v1.agent_token) == 0
+    error_message = "Stop must delete the Pods and the token."
+  }
+  assert {
+    condition     = kubernetes_persistent_volume_claim_v1.home.metadata[0].name == "coder-0b6b6a5e-0000-4000-8000-000000000001-home" && length(kubernetes_service_v1.proxy) == 1
+    error_message = "Stop must keep the home disk and the proxy Service."
+  }
+}
+
+run "runtimes" {
+  command = plan
+
+  variables {
+    runtimes = "gvisor, kata-clh"
+  }
+  override_data {
+    target = data.coder_parameter.runtime
+    values = { value = "gvisor" }
+  }
+
+  assert {
+    condition     = [for o in data.coder_parameter.runtime[0].option : o.value] == ["none", "gvisor", "kata-clh"]
+    error_message = "Kernel isolation must offer None and then the listed runtimes."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.workspace[0].spec[0].runtime_class_name == "gvisor"
+    error_message = "The runtime parameter must set the RuntimeClass."
+  }
+  assert {
+    condition     = kubernetes_pod_v1.proxy == []
+    error_message = "Fully isolated must create no proxy with any runtime."
+  }
+  assert {
+    condition     = alltrue([for p in data.coder_workspace_preset.profile : p.parameters.runtime == "none"])
+    error_message = "Presets must set the runtime, so a claim does not change an immutable parameter."
+  }
+}
+
+run "no_runtimes" {
+  command = plan
+
+  assert {
+    condition     = length(data.coder_parameter.runtime) == 0 && alltrue([for p in data.coder_workspace_preset.profile : !contains(keys(p.parameters), "runtime")])
+    error_message = "With no runtimes, Kernel isolation must not show, and presets must not set it."
+  }
+}
+
+run "rejects_unknown_runtime" {
+  command = plan
+
+  variables {
+    runtimes = "runc"
+  }
+
+  expect_failures = [var.runtimes]
+}
+
+run "host_name_needs_ip" {
+  command = plan
+
+  override_data {
+    target = data.coder_workspace.me
+    values = {
+      id          = "0b6b6a5e-0000-4000-8000-000000000001"
+      name        = "test"
+      start_count = 1
+      transition  = "start"
+      access_url  = "https://coder.example.com"
+    }
+  }
+
+  expect_failures = [kubernetes_pod_v1.workspace]
+}
+
+run "host_name_alias" {
+  command = plan
+
+  variables {
+    coder_host_ip = "203.0.113.10"
+  }
+  override_data {
+    target = data.coder_workspace.me
+    values = {
+      id          = "0b6b6a5e-0000-4000-8000-000000000001"
+      name        = "test"
+      start_count = 1
+      transition  = "start"
+      access_url  = "https://coder.example.com"
+    }
+  }
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "github" }
+  }
+
+  assert {
+    condition     = kubernetes_pod_v1.workspace[0].spec[0].host_aliases[0].ip == "203.0.113.10" && tolist(kubernetes_pod_v1.workspace[0].spec[0].host_aliases[0].hostnames) == tolist(["coder.example.com"])
+    error_message = "A host name access URL must map to coder_host_ip."
+  }
+  assert {
+    condition     = local.proxy_env["NO_PROXY"] == "localhost,127.0.0.1,::1,coder.example.com"
+    error_message = "The agent must reach Coder without the proxy."
+  }
+}
+
+run "presets" {
+  command = plan
+
+  assert {
+    condition     = keys(data.coder_workspace_preset.profile) == ["development", "github", "internet", "isolated"]
+    error_message = "Every fixed profile must have a preset."
+  }
+  assert {
+    condition     = data.coder_workspace_preset.profile["isolated"].default == true && data.coder_workspace_preset.profile["github"].default == false
+    error_message = "Fully isolated must be the default preset."
+  }
+  assert {
+    condition     = alltrue([for p in data.coder_workspace_preset.profile : one(p.prebuilds).instances == 1])
+    error_message = "Each preset must have one prebuild by default."
+  }
+}
+
+run "no_prebuilds" {
+  command = plan
+
+  variables {
+    prebuild_instances = 0
+  }
+
+  assert {
+    condition     = length(data.coder_workspace_preset.profile["isolated"].prebuilds) == 0
+    error_message = "prebuild_instances = 0 must turn prebuilds off."
+  }
+}
+
+run "no_policy_gate" {
+  command = plan
+
+  variables {
+    network_policy_gate = false
+  }
+
+  assert {
+    condition     = endswith(kubernetes_pod_v1.workspace[0].spec[0].container[0].command[2], "\nexec /usr/local/bin/coder agent") && !strcontains(kubernetes_pod_v1.workspace[0].spec[0].container[0].command[2], "KUBERNETES_SERVICE_HOST")
+    error_message = "network_policy_gate = false must start the agent at once."
+  }
+}
+
+run "dns_servers" {
+  command = plan
+
+  variables {
+    dns_servers = "10.0.0.2, 10.0.0.3"
+  }
+  override_data {
+    target = data.coder_parameter.network_isolation
+    values = { value = "github" }
+  }
+
+  assert {
+    condition     = strcontains(kubernetes_config_map_v1.proxy[0].data["squid.conf"], "dns_nameservers 10.0.0.2 10.0.0.3\n")
+    error_message = "The proxy must use dns_servers."
+  }
+  assert {
+    condition     = [for t in kubernetes_network_policy_v1.proxy[0].spec[0].egress[1].to : t.ip_block[0].cidr] == ["10.0.0.2/32", "10.0.0.3/32"]
+    error_message = "The proxy must reach only dns_servers for DNS."
+  }
+}
+
+run "port_from_access_url" {
+  command = plan
+
+  override_data {
+    target = data.coder_workspace.me
+    values = {
+      id          = "0b6b6a5e-0000-4000-8000-000000000001"
+      name        = "test"
+      start_count = 1
+      transition  = "start"
+      access_url  = "http://203.0.113.10:8080"
+    }
+  }
+
+  assert {
+    condition     = kubernetes_network_policy_v1.workspace.spec[0].egress[0].ports[0].port == "8080"
+    error_message = "The Coder port must come from the access URL."
+  }
+}
+
+run "port_override" {
+  command = plan
+
+  variables {
+    coder_egress_port = 7080
+  }
+
+  assert {
+    condition     = kubernetes_network_policy_v1.workspace.spec[0].egress[0].ports[0].port == "7080"
+    error_message = "coder_egress_port must override the access URL port."
+  }
+}
+
+run "rejects_bad_port" {
+  command = plan
+
+  variables {
+    coder_egress_port = 70000
+  }
+
+  expect_failures = [var.coder_egress_port]
+}
+
+run "rejects_negative_port" {
+  command = plan
+
+  variables {
+    coder_egress_port = -1
+  }
+
+  expect_failures = [var.coder_egress_port]
+}
+
+run "ai_gateway_scoped_token" {
+  command = apply
+
+  assert {
+    condition     = nonsensitive(coder_env.anthropic_auth_token[0].value) == "scoped-id-scoped-secret" && coder_env.anthropic_base_url[0].value == "https://203.0.113.10/api/v2/aibridge/anthropic"
+    error_message = "Claude Code must get the scoped token and the AI Gateway URL, not the owner's session token."
+  }
+  assert {
+    condition     = jsonencode(jsondecode(data.http.ai_gateway_token[0].request_body).scopes) == jsonencode(["user:read_personal"]) && nonsensitive(data.http.ai_gateway_token[0].request_headers["Coder-Session-Token"]) == "owner-full-session-token"
+    error_message = "The build must create a token with only the user:read_personal scope, using the owner's session token."
+  }
+}
+
+run "ai_gateway_prebuild" {
+  command = plan
+
+  override_data {
+    target = data.coder_workspace.me
+    values = {
+      id          = "0b6b6a5e-0000-4000-8000-000000000001"
+      name        = "test"
+      start_count = 1
+      transition  = "start"
+      access_url  = "https://203.0.113.10"
+      is_prebuild = true
+    }
+  }
+
+  assert {
+    condition     = length(data.http.ai_gateway_token) == 0 && length(coder_env.anthropic_auth_token) == 0
+    error_message = "A prebuild must not create a token. The claim does."
+  }
+}
+
+run "ai_gateway_off" {
+  command = plan
+
+  variables {
+    enable_ai_gateway = false
+  }
+
+  assert {
+    condition     = length(data.http.ai_gateway_token) == 0 && length(coder_env.anthropic_auth_token) == 0 && length(coder_env.anthropic_base_url) == 0
+    error_message = "enable_ai_gateway = false must not create a token."
+  }
+}
+
+run "claude_code_off" {
+  command = plan
+
+  variables {
+    enable_claude_code = false
+  }
+
+  assert {
+    condition     = length(coder_app.claude) == 0 && length(data.http.ai_gateway_token) == 0
+    error_message = "enable_claude_code = false must remove the app and the token."
+  }
+}
+
+run "rejects_latest_image" {
+  command = plan
+
+  variables {
+    workspace_image = "registry.example.com/coder/workspace:latest"
+  }
+
+  expect_failures = [var.workspace_image]
+}
+
+run "rejects_untagged_proxy_image" {
+  command = plan
+
+  variables {
+    proxy_image = "registry.example.com/coder/egress-proxy"
+  }
+
+  expect_failures = [var.proxy_image]
+}
+
+run "accepts_digest_image" {
+  command = plan
+
+  variables {
+    proxy_image = "registry.example.com/coder/egress-proxy@sha256:32e560b86242d4ac65e7a777953ed3ec991d4db8368e24dea7e9ea0817a3410e"
+  }
+
+  assert {
+    condition     = var.proxy_image != ""
+    error_message = "A digest must be accepted."
+  }
+}
+
+run "rejects_empty_namespace" {
+  command = plan
+
+  variables {
+    namespace = " "
+  }
+
+  expect_failures = [var.namespace]
+}
+
+run "rejects_ipv6_cidr" {
+  command = plan
+
+  variables {
+    coder_egress_cidrs = ["2001:db8::/64"]
+  }
+
+  expect_failures = [var.coder_egress_cidrs]
+}
+
+run "rejects_bad_host_ip" {
+  command = plan
+
+  variables {
+    coder_host_ip = "coder.example.com"
+  }
+
+  expect_failures = [var.coder_host_ip]
+}
+
+run "rejects_ipv6_dns" {
+  command = plan
+
+  variables {
+    dns_servers = "2001:4860:4860::8888"
+  }
+
+  expect_failures = [var.dns_servers]
+}

From 3f7c626ad4e8bbf0b1952df19ec61fd4cd75a65a Mon Sep 17 00:00:00 2001
From: Ben Potter <me@bpmct.net>
Date: Tue, 3 Nov 2026 20:13:49 +0000
Subject: [PATCH 2/4] docs(registry/coder-labs/templates): rename to Plain
 Sandbox (Kubernetes) and agent-sandbox (Kubernetes)

---
 .../coder-labs/templates/kubernetes-agent-sandbox/README.md | 4 ++--
 .../coder-labs/templates/kubernetes-sandboxed/README.md     | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md b/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
index dcbcd2df4..5e23720f7 100644
--- a/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
+++ b/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
@@ -1,12 +1,12 @@
 ---
-display_name: Kubernetes (agent-sandbox)
+display_name: agent-sandbox (Kubernetes)
 description: Run each workspace in an agent-sandbox Sandbox with gVisor or Kata isolation and a NetworkPolicy firewall
 icon: ../../../../.icons/agent-sandbox.svg
 verified: false
 tags: [kubernetes, container, agent-sandbox, gvisor, kata, ai]
 ---
 
-# Kubernetes (agent-sandbox)
+# agent-sandbox (Kubernetes)
 
 Run each workspace in a Sandbox from [agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox), a Kubernetes SIG project. You and your AI agent work in the same sandbox, with one Coder agent named `dev`. The sandbox runs under gVisor or a Kata microVM, so it does not share the node kernel. A Kubernetes NetworkPolicy works as the firewall, and ClusterNetworkPolicy or [Cilium](https://cilium.io/) can add more advanced rules (see [Firewall](#firewall)). By default the workspace can reach only the Coder server.
 
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/README.md b/registry/coder-labs/templates/kubernetes-sandboxed/README.md
index c0926e368..7b83b9946 100644
--- a/registry/coder-labs/templates/kubernetes-sandboxed/README.md
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/README.md
@@ -1,12 +1,12 @@
 ---
-display_name: Kubernetes (sandboxed)
+display_name: Plain Sandbox (Kubernetes)
 description: Run each workspace in a plain Kubernetes Pod behind a host name firewall, with optional gVisor or Kata isolation
 icon: ../../../../.icons/kubernetes.svg
 verified: false
 tags: [kubernetes, container, sandbox, gvisor, kata, ai]
 ---
 
-# Kubernetes (sandboxed)
+# Plain Sandbox (Kubernetes)
 
 Run each workspace in a plain Kubernetes Pod with a persistent home disk. You and your AI agent work in the same Pod, with one Coder agent named `dev`. A NetworkPolicy and a small Squid proxy work as the firewall, so rules can name hosts such as `github.com` or `registry.npmjs.org`. By default the workspace can reach only the Coder server. The template needs no controller and no CRDs, so it works on any cluster with a network plugin that enforces NetworkPolicy.
 
@@ -16,7 +16,7 @@ Run each workspace in a plain Kubernetes Pod with a persistent home disk. You an
 - **Rules by host name:** the proxy allows a list of host names, so a profile can include package registries. A NetworkPolicy alone can match only IP ranges.
 - **Any node:** by default the workspace uses the node's normal container runtime. If your nodes have gVisor or Kata, list them in `runtimes` to add kernel isolation.
 
-For a cluster-level warm pool, or if cluster administrators must own the runtime and the network rules, use [Kubernetes (agent-sandbox)](https://registry.coder.com/templates/coder-labs/kubernetes-agent-sandbox) instead.
+For a cluster-level warm pool, or if cluster administrators must own the runtime and the network rules, use [agent-sandbox (Kubernetes)](https://registry.coder.com/templates/coder-labs/kubernetes-agent-sandbox) instead.
 
 ## Startup speed
 

From eecaeba4e86dd1ec039a91436bb16c7072c4bb66 Mon Sep 17 00:00:00 2001
From: Ben Potter <me@bpmct.net>
Date: Tue, 3 Nov 2026 20:14:48 +0000
Subject: [PATCH 3/4] docs(registry/coder-labs/templates): add the sandbox and
 firewall tags

---
 .../coder-labs/templates/kubernetes-agent-sandbox/README.md     | 2 +-
 registry/coder-labs/templates/kubernetes-sandboxed/README.md    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md b/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
index 5e23720f7..5e10f061d 100644
--- a/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
+++ b/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
@@ -3,7 +3,7 @@ display_name: agent-sandbox (Kubernetes)
 description: Run each workspace in an agent-sandbox Sandbox with gVisor or Kata isolation and a NetworkPolicy firewall
 icon: ../../../../.icons/agent-sandbox.svg
 verified: false
-tags: [kubernetes, container, agent-sandbox, gvisor, kata, ai]
+tags: [kubernetes, sandbox, firewall, agent-sandbox, gvisor, kata, ai]
 ---
 
 # agent-sandbox (Kubernetes)
diff --git a/registry/coder-labs/templates/kubernetes-sandboxed/README.md b/registry/coder-labs/templates/kubernetes-sandboxed/README.md
index 7b83b9946..1f63b2d52 100644
--- a/registry/coder-labs/templates/kubernetes-sandboxed/README.md
+++ b/registry/coder-labs/templates/kubernetes-sandboxed/README.md
@@ -3,7 +3,7 @@ display_name: Plain Sandbox (Kubernetes)
 description: Run each workspace in a plain Kubernetes Pod behind a host name firewall, with optional gVisor or Kata isolation
 icon: ../../../../.icons/kubernetes.svg
 verified: false
-tags: [kubernetes, container, sandbox, gvisor, kata, ai]
+tags: [kubernetes, container, sandbox, firewall, gvisor, kata, ai]
 ---
 
 # Plain Sandbox (Kubernetes)

From cd6875273b4912cb17ca2c71b0bf1fc58cedb7da Mon Sep 17 00:00:00 2001
From: Ben Potter <me@bpmct.net>
Date: Tue, 3 Nov 2026 20:15:48 +0000
Subject: [PATCH 4/4] 
 docs(registry/coder-labs/templates/kubernetes-agent-sandbox): link to Plain
 Sandbox (Kubernetes)

---
 .../coder-labs/templates/kubernetes-agent-sandbox/README.md     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md b/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
index 5e10f061d..ffd5a5af9 100644
--- a/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
+++ b/registry/coder-labs/templates/kubernetes-agent-sandbox/README.md
@@ -43,7 +43,7 @@ Coder already manages most of the workspace lifecycle. It creates and deletes Po
 | IDE and AI agents | No                                 | Coder agent, apps, AI Gateway        | Coder agent, apps, AI Gateway                                                         |
 | Extra components  | None                               | None                                 | The agent-sandbox controller                                                          |
 
-Use the [Kubernetes template](https://registry.coder.com/templates/coder/kubernetes) with a `runtimeClassName` and a NetworkPolicy if only Coder uses the cluster, you have Premium for prebuilds, and template authors can set the runtime. Prebuilds start about as fast as warm pools.
+Use [Plain Sandbox (Kubernetes)](https://registry.coder.com/templates/coder-labs/kubernetes-sandboxed) if only Coder uses the cluster, you have Premium for prebuilds, and template authors can set the runtime. It runs plain Pods with an optional gVisor or Kata runtime and a firewall by host name. Prebuilds start about as fast as warm pools.
 
 Use agent-sandbox if: