containers

Sandbox matrix: what isolation do you actually get?

containers security sandboxing agents

What a process, a rootless container, runc, gVisor, Firecracker, and Kata actually separate for an agent: filesystem, network, kernel, and privilege.