gVisor

Docker Compose, Nix, devcontainers, microVMs — how automated provisioning works, and where the boundary moves when an agent needs a workspace.

Security boundary or Linux workspace? The word "sandbox" quietly split in two — and the split explains where agents actually run now.