How to Choose an Execution Environment and Sandbox: From Namespace and gVisor to Firecracker, E2B, and Lambda MicroVMs
A sandbox is not a single package but a spectrum—Namespace, cgroups, seccomp, gVisor, and Firecracker stacked by trust boundary; local OS sandboxes bound blast radius, cloud microVMs bound multi-tenancy, and the choice hinges on trust and ops cost.