How the Sentry Intercepts System Calls to Contain Untrusted Agent Code
The Sentry in gVisor mediates every system call from untrusted code, reducing the host attack surface. Learn how interception works and why it matters for
#sandboxing
Posts tagged #sandboxing
How MicroVMs Change the Trust Model for Running Untrusted Agent Code
Framing isolation as a change in trust model clarifies why microVM or userspace kernel boundary is the load-bearing decision when running untrusted agent
Choosing an Isolation Model for Untrusted Code: Userspace Kernel versus MicroVM
When exposing code execution to autonomous agents, choose between gVisor's userspace kernel sandbox and Firecracker's microVM. Compare attack surface
