Google Cloud and Anyscale announced an experimental library for Ray that brings native gVisor-based sandboxing to distributed Ray clusters, starting in Ray 2.58. The library represents sandboxes as Ra…
Pullrun, a new open-source project, lets users run the same OCI image as either a container or a Firecracker microVM by toggling a single flag, reviving an old capability with improved ergonomics just…
Kata Containers 4.0.0 is now available, introducing a new default runtime built in Rust that offers reduced memory footprint, improved security, and lower latency, while the existing Go runtime is dep…
CNCF Ambassador Lin Sun of Solo.io wrote on July 7, 2026 that sandboxing alone is insufficient for running large-scale AI agent fleets, contrasting the Kubernetes SIG Apps project agent-sandbox with t…
The schedule for KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China, taking place September 7-9 in Shanghai, is now available. The event features sessions on AI agents, GPU virtual…
Microsoft has launched the public preview of Azure Container Apps Sandboxes, a new ARM resource type that runs untrusted AI agent code in hardware-isolated microVMs. The sandboxes start from OCI disk …
Google has introduced GKE Agent Sandbox, a managed node pool configuration that applies gVisor-based kernel-level isolation to secure untrusted, AI-generated code in multi-tenant agentic systems. The …