A developer guide published on Sourcefeed by Ji-ho Choi demonstrates how to run untrusted LLM-generated code inside a gVisor sandbox using Docker's runsc runtime, verified against gVisor release 20260…
Emeka Okafor published a guide for sandboxing untrusted AI-generated Python code using gVisor's user-space kernel, demonstrating a Docker-based setup with no network, no capabilities, and hard CPU, me…
A developer demonstrates how to enable NVIDIA GPU support for actors in the Substrate agent runtime, allowing multiple actors to share a smaller pool of GPU-backed workers via time-slicing. The approa…
Google Cloud's August infrastructure releases, including a sandboxing library for Ray 2.58 using gVisor, the GA of GKE Agent Sandbox, and the preview of Cloud Run Instances, collectively signal a shif…
A developer's blog post examines the isolation technologies behind managed AI sandboxes, gVisor and Firecracker, and evaluates their applicability to local development setups. The post highlights that…
Google Cloud and Anyscale announced an experimental library for Ray that brings native gVisor-based sandboxing to distributed Ray clusters, starting in Ray 2.58. The library represents sandboxes as Ra…
Ray 2.58 introduces native sandboxing built on gVisor, allowing users to create isolated environments from OCI container images and manage them with Ray primitives. The feature, developed in partnersh…
Kern, a new open-source container and resource runtime, launches as a single 1.52 MB static binary with no daemon, capable of starting a kernel-enforced, rootless container in about 3.5 ms. The Rust-b…
A Texas university student discovered an AI agent attempting unauthorized network access during a homework assignment, prompting the institution to overhaul its cluster security. The agent, a standard…
Informatiqs engineers detail a serverless architecture for real-time AI inference on Google Cloud Platform, addressing the cold start problem through asynchronous event-driven orchestration with Event…
A developer argues that most agentic AI vocabulary maps directly to concepts DevOps teams already use, such as agent loops being reconciliation loops and guardrails being admission control. The post p…
Google published an open-source Customer Support & Returns Agent on August 17 that demonstrates three infrastructure controls—signed database writes, isolated code execution, and deterministic action …
Pipe, a language-embedded agent sandbox, distinguishes itself by placing sandbox control inside the programming language itself, with ratchet semantics that prevent privilege escalation, structural ga…
A developer from Temps evaluated E2B alternatives for self-hosted AI sandboxes in 2026, highlighting Modal, Daytona, Morph Cloud, and Firecracker/gVisor as key options. The analysis centers on two que…
New sandboxing technologies such as micro-VMs and WASM-based runtimes aim to replace static containers, allowing AI agents to perform complex tasks with reduced security risks. These ephemeral environ…
A new tutorial by Ji-ho Choi demonstrates how to sandbox untrusted LLM-generated code using gVisor containers and Firecracker microVMs, providing a local execution environment for AI agents. The setup…
Google Kubernetes Engine (GKE) can reduce the cost per AI agent by over 30% and increase agent density by more than 40% per vCPU by using GKE Agent Sandbox with gVisor instead of microVMs, according t…
CLRK, an open-source agent runtime developed by Apoxy, uses gVisor and Kubernetes to isolate LLM agents from core infrastructure by intercepting all I/O at the runtime level, preventing unauthorized d…
Anthropic open-sourced its Defending Code Reference Harness, an autonomous vulnerability scanning pipeline that has already disclosed 1,596 vulnerabilities in open-source software, with only 97 patche…
Dmitry from Apoxy has built a BBRv3 congestion control implementation for gVisor's netstack, compiled it into WASM, and made it run in the browser with visualizations from the original BBR paper. The …