Memory Compression for High-Fanout Agent Sandboxes
Mengming Li, Ceyu XU, Qijun Zhang, Jiangnan Yu, Xiangfeng Sun, Haohui Mai, Zhiyao Xie
cs.AI, cs.OS
2026-09-10
HKUST AgentZip cuts 16-way rollout sandbox memory 88.55% (8.7×) at 1.40× wall time via template deltas, sibling Zstd dictionaries, and LLM-idle scheduling; KSM+zswap saves 51%.
Agents no longer just emit text. Fixing an issue, installing packages, and running tests all happen inside a sandbox that isolates untrusted code. A single task now fans out into many sandboxes at once: RL training samples tens of trajectories in parallel so a reward model can score them; inference-time generate-and-filter runs several candidate sessions concurrently. Cores often sit idle while the sandbox waits for the next LLM command. Memory runs out first.
Those sandboxes are not independent processes. They are copy-on-write clones of one immutable template, they open the same repo, they load the same libraries, and they issue overlapping commands. The paper measures 76–96% of pages as either still close to the template or similar across siblings at the same virtual address. Linux stock tools miss this structure. zswap compresses each page in isolation. KSM only merges byte-identical pages, and exact duplicates were already shared at clone time. Existing systems also refuse to compress warm pages to keep page-fault cost down: only 20–30% of pages are cold, another 50–60% are warm. zswap waits for memory pressure, so a short-lived sandbox can keep compressible pages resident for its entire lifetime.
AgentZip is a sandbox memory compressor from HKUST, built on Zeroboot: KVM plus Firecracker snapshots, cloned with copy-on-write. Compressed pages live in a user-space pool. The original 4 KiB frame is released immediately. Later accesses are trapped with Linux userfaultfd and reconstructed into place.
Each candidate page is encoded three ways; the smallest representation wins.
Overhead control moves from picking cold pages at compress time to prefetching at restore time. Any page with a profitable encoding can be compressed, including warm pages that will be touched again. Four prefetchers cover different restore patterns: stride, per-sandbox temporal, cohort-shared temporal, and a hotset keyed by cohort and tool-call ordinal.
Timing follows the agent loop. During tool execution a lightweight scout scores pages and queues them. Actual encoding and mapping updates run while the sandbox waits on the LLM. A new tool call cancels unfinished compression; an in-flight mapping update is allowed to finish so the guest never sees a half-reclaimed page. A host-side gateway speaks a subset of the E2B API, so existing SDKs do not need new prompts or tools.
Workloads come from ten Python repos in R2E-Gym. Trajectories are generated with DeepSeek-V4 and replayed with recorded think times. Training-side Rollout runs 16 concurrent trajectories per task at different temperatures. Inference-side GAF runs four candidates with different role prompts. The headline metric is time-averaged sandbox-owned physical memory: private pages plus the compression pool.
| Method | Rollout saving | Rollout slowdown | GAF saving | GAF slowdown |
| zswap (Zstd) | 48.66% | 1.436× | 4.86% | 1.118× |
| KSM+zswap | 51.24% | 1.517× | 21.25% | 1.159× |
| AgentZip | 88.55% | 1.403× | 64.29% | 1.468× |
88.55% is about 8.7× capacity. The Linux setup is about 2.1×.
Codecs in isolation on Rollout: RLE 24.74%, template-delta 81.95%, dictionary 88.63%. The portfolio still hits 88.55%, cuts dictionary-encoded pages by about 60%, and drops wall time from 2.703× (dictionary only) to 1.403×. The dictionary carries almost all of the ratio; RLE and delta keep most pages off the expensive path.
With prefetch disabled, Rollout saves 94.22% at 3.052× wall time; GAF saves 75.96% at 2.755×. Stacking the four prefetchers cuts Rollout restore amplification from 0.419 to 0.147 and wall time to 1.403×. Blocking demand restore is 3.47 / 110.52 / 223.27 ms at p50 / p95 / p99. Async prefetch restore is 0.16 / 1.50 / 8.09 ms. Metadata plus dictionaries take 4.31% of the pool on Rollout and 5.64% on GAF.
For a high-fanout agent platform, the practical claim is narrow: do not manage sandboxes as unrelated Linux processes. Approximate similarity after copy-on-write is the remaining mass, and the LLM wait gap is a cheap window for background compression. The E2B compatibility layer is aimed at existing orchestration, not a lab-only ABI.
It is not free. On GAF, AgentZip is slower than zswap (1.468× vs 1.118×) in exchange for 64% memory savings versus 5%. If the host never hits a memory wall and trajectories are short, zswap's lower latency wins. The setting where AgentZip beats KSM+zswap on both memory and latency is 16-way training rollouts.
The paper has no Limitations section. Evaluation is trace replay, not live serving: tool sequences and think times are recorded once, compression cannot feed back into LLM scheduling, and there is no real queueing jitter. All workloads are Python repo-repair tasks from R2E-Gym. Browser sandboxes, GPU tools, and long-lived IDE environments are untested.
The design assumes an immutable template with copy-on-write cloning, implemented on Zeroboot / Firecracker snapshots. Plain Docker containers without a stable virtual page index lose template-delta. userfaultfd pulls faults into user space; a missed prefetch leaves a 223 ms p99 stall on the tool path.
Dictionaries are sensitive to diversity. On GAF, dictionary-only savings drop from 86.26% with two candidates to 71.39% with four. Growing the dictionary to 128 KiB cuts savings to 80.38% (Rollout) and 44.46% (GAF). The more sibling trajectories diverge, the less the cross-sandbox codec is worth. The scheduler also assumes tool calls alternate with LLM waits; a sandbox that burns CPU without returning to the model will contend with the compressor.
The memory metric is sandbox-private pages plus the pool. Shared template pages are excluded. Host density still depends on template size and how many cohorts share a machine. There is no comparison against E2B's own production memory policy.