How the Sentry Intercepts System Calls to Contain Untrusted Agent Code
The Sentry in gVisor mediates every system call from untrusted code, reducing the host attack surface. Learn how interception works and why it matters for
#gvisor
Posts tagged #gvisor
Choosing an Isolation Model for Untrusted Code: Userspace Kernel versus MicroVM
When exposing code execution to autonomous agents, choose between gVisor's userspace kernel sandbox and Firecracker's microVM. Compare attack surface
Isolating Code-Execution MCP Servers: Why the Runtime Sandbox Is the Load-Bearing Control
Isolate code-execution MCP servers with risk of untrusted model-directed code. Runtime sandboxes like gVisor and Firecracker are the load-bearing control
