Skip to main content

4 posts tagged with "Infrastructure"

View All Tags

Sandboxing LLM-generated code execution

· 13 min read
Xavier Blondel
Xavier Blondel
Engineering Manager Lead
Arthur Busser
Arthur Busser
Site Reliability Engineer
Romain Loisel
Romain Loisel
Security Engineer

Pigment provides a central AI platform to organizations for real-time business planning. Pigment AI is based on an agentic architecture that is described in more detail in this blog post.

One of our agents, the Analyst, already had multiple tools to perform simple calculations, such as contribution and variance analysis. In order to add more capabilities, we decided to leverage the code generation feature of LLMs rather than creating a dedicated tool for each capability.

LLM-generated code cannot be trusted by default. It is produced from user-controlled input, which means users may intentionally or accidentally steer the model toward unsafe behavior: reading sensitive data, calling internal services, exfiltrating data, pivoting into internal infrastructure, or exhausting compute resources. From a security perspective, the generated code has to be handled as an untrusted workload.

That requirement led us to build a sandboxed execution environment. In this article, we explain how we went from the initial risk analysis to a proof of concept, and eventually to a production-ready sandbox with support for large datasets.

How We Turbocharged Our Prediction Pipeline Using Dask

· 8 min read
Florian Courtial
Florian Courtial
Software Engineer

At Pigment, we provide a central platform for organizations to model and plan using their most valuable data. As part of that mission, enabling predictive insights is key. Our first implementation of predictions worked well for smaller datasets, but as more users began applying the feature to larger and more complex data models, we quickly hit the limits of a single-machine setup in terms of memory and compute.

To address this, we redesigned our infrastructure around a distributed Dask cluster, allowing us to scale horizontally and support much larger workloads. In this post, we’ll share the architecture of our new solution and key takeaways from adopting Dask in production.

Pure Terraform modules

· 6 min read
Arthur Busser
Arthur Busser
Site Reliability Engineer

As our infrastructure scales, our Terraform codebase grows. To remain productive, we need to keep our code flexible and extendable. A design pattern we find useful is the pure Terraform module. Let's dive into what it is and how it helps us write maintainable Terraform code.