Skip to content
All tags

#microvm

2 posts
aideep-diveAgent Isolation Boundaries

Containers, gVisor, and microVMs: Who Shares the Kernel, the System Calls, and the Hardware

Containers share the host kernel, gVisor inserts a user-space kernel, and a microVM adds a guest kernel plus a hypervisor; all three still share the same host's CPU caches and storage.

#ai-agent#sandbox#ai-security#microvm#isolation
aideep-diveAgent Isolation Boundaries

Where an Agent's Code Runs: Five Layers of Isolation From Container to Monitoring

A piece of agent code passes through five layers on its way from execution to a network connection: container, kernel boundary, shared host, network perimeter, monitoring. Each layer promises one thing, and the shared host layer promises almost nothing.

#ai-agent#sandbox#ai-security#microvm#isolation