Kubernetes Agent Sandbox Provides Kernel-Level Isolation