Production AI Agents with the OpenAI Agents SDK: Sandboxing, Harnesses, and Subagents Kindle Edition

On April 15, 2026 the OpenAI Agents SDK shipped a new architecture: native sandbox execution, a model-native harness, subagent fan-out across isolated containers, and code mode with apply_patch. This book is built on those APIs from chapter one and treats the sandbox as the trust boundary that production agents need.You build a real production system end to end: an Incident triage agent platform for a SaaS operations team that classifies alerts, inspects logs in parallel sandboxes, applies minimal runbook patches, and produces operator-facing recommendations under guardrails. The same application runs through all 11 chapters, so every new pattern lands on a working system instead of a toy snippet.What you build:- A three-layer architecture that separates harness, sandbox, and externalized state with the trust boundary drawn explicitly- A hardened DockerSandboxClient with mount allowlists, blocked credential patterns, and a leak audit that fails fast before any container starts- SandboxAgent plus Manifest with GitRepo entries, code mode for log aggregation inside the sandbox, and apply_patch for minimal runbook edits- agents.Session for operator continuity (OpenAIConversationsSession for dev, RedisSession in production) and tracing that joins runs across multi-turn investigations- Three subagents (classifier, log analyst, remediation planner) composed through Handoffs and agents-as-tools, each routed to a cost-optimal model via a shared LitellmProvider- Parallel sandbox fan-out with asyncio.gather, per-subagent timeouts, and degraded-report aggregation when a sandbox fails- Composite manifests with patch-delta tracking for snapshot and rehydration after container expiration- Mandatory input and output guardrails with parametrized pytest, FakeSandboxFactory for fast harness tests, and Docker integration tests- Production deployment with concurrency governors, cost budgets enforced before delivery, and a pre-flight health check that audits the trust boundary on every run- A migration framework that audits legacy function-calling agents for credential and filesystem leaks and ports the survivors onto the sandbox boundaryWhat makes this book different:- Built on the new SDK surface. Every code sample uses agents.sandbox, SandboxAgent, Manifest, SandboxRunConfig, and function_tool from openai-agents 0.14.x. API call shapes were checked against the imported module so the code runs as written.- Honest about isolation. UnixLocalSandboxClient is called what it is: a development client with no isolation. Production examples default to DockerSandboxClient or hosted providers, and the trust boundary is non-negotiable.- Real sandbox providers. Side-by-side coverage of Blaxel, Cloudflare, Daytona, E2B, Modal, Runloop, and Vercel with cold-start, egress controls, IAM scoping, and concurrency caps documented per provider.- Real package names and pins. openai-agents on PyPI, the seven sandbox provider extras, the litellm extra for provider-agnostic routing, and a 0.14.x line pin that survives the SDK's rapid patch cadence.Covers the openai-agents Python SDK 0.14.x line, including Sandbox Agents, the model-native harness, subagent orchestration, code mode, apply_patch, externalized state with snapshotting and rehydration, and provider-agnostic LLM routing via LiteLLM. The TypeScript port lives in a separate repo and is out of scope.Prerequisites: Intermediate Python (3.10 or newer). Familiarity with at least one agent framework (OpenAI function calling, LangGraph, Microsoft Agent Framework, Google ADK, CrewAI, or PydanticAI). Basic Docker reading ability for the local sandbox chapters. No prior sandbox or container expertise required.Production agents need real workspaces, real isolation, and real state. Build them the way the SDK was redesigned to support. Read more