{"slug": "response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-8764", "title": "Response to 'gVisor vs Firecracker for AI Agent Sandboxing' — what we learned auditing 8,764 MCP servers", "summary": "A developer building MarketNow, a marketplace for MCP servers, shares findings from auditing 8,764 MCP servers using gVisor for sandboxing. They found that about 50% of MCP servers fail to start under gVisor due to unsupported syscalls, which they consider a feature, and they use a strict seccomp profile as a fallback. The team plans to eventually adopt Firecracker for sandboxing once KVM access is available.", "body_md": "I read [@chunxiaoxx](https://dev.to/chunxiaoxx)'s excellent post [MCP Security Patterns 2026: gVisor vs Firecracker for AI Agent Sandboxing](https://dev.to/chunxiaoxx/mcp-security-patterns-2026-gvisor-vs-firecracker-for-ai-agent-sandboxing-3hp7) and wanted to share what we actually found running gVisor in production.\n\nWe built [MarketNow](https://marketnow.site) — a marketplace for MCP servers where every server gets audited. Our L2.5 layer uses gVisor (runsc) exactly as the article describes.\n\nThe article correctly identifies the key tradeoff:\n\nThe runner user can't write to `/etc/docker/daemon.json`\n\nwithout sudo:\n\n```\nsudo wget -q https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc -O /usr/local/bin/runsc\nsudo chmod +x /usr/local/bin/runsc\necho '{\"runtimes\":{\"runsc\":{\"path\":\"/usr/local/bin/runsc\"}}}' | sudo tee /etc/docker/daemon.json\nsudo systemctl restart docker\n```\n\nDon't put `--network none`\n\non `docker build`\n\n— it blocks `npm install`\n\nfrom reaching `registry.npmjs.org`\n\n. Runtime isolation (`docker run --network none`\n\n) is what matters.\n\nWe found:\n\n`ptrace()`\n\n— gVisor returned EPERM`bpf()`\n\n— gVisor returned ENOSYS (it doesn't implement BPF)About 50% of MCP servers fail to start under gVisor because they use syscalls gVisor doesn't implement. This is a feature, not a bug — but it means you need a fallback (we use enhanced seccomp).\n\nWhen gVisor isn't available, we use a strict seccomp profile that blocks:\n\n`ptrace`\n\n, `bpf`\n\n, `mount`\n\n, `umount2`\n\n, `reboot`\n\n`kexec_load`\n\n, `kexec_file_load`\n\n`clone3`\n\n, `unshare`\n\n, `setns`\n\n`init_module`\n\n, `finit_module`\n\n, `delete_module`\n\n`perf_event_open`\n\n`name_to_handle_at`\n\n, `open_by_handle_at`\n\n`process_vm_readv`\n\n, `process_vm_writev`\n\nThe article suggests gVisor now, Firecracker later. That's exactly our plan:\n\nWhy Firecracker later? Because it needs KVM access, which GitHub Actions runners don't provide. We'd need to self-host runners on AWS (Firecracker is what powers Lambda and Fargate).\n\nFor context, our full audit:\n\n8,764 MCP servers audited. 206 went through L2.5 gVisor sandbox:\n\nFull methodology: [marketnow.site/security](https://marketnow.site/security)\n\nExample audit (Anthropic's filesystem MCP, 10/10): [GitHub](https://github.com/edgarfloresguerra2011-a11y/marketnow/blob/master/_data/l2_results/mn-mcp-filesystem.json)\n\nIf you want your MCP server audited: [open an issue](https://github.com/edgarfloresguerra2011-a11y/marketnow/issues)\n\n*Thanks to @chunxiaoxx for the original analysis — it's a great primer on the sandboxing landscape.*", "url": "https://wpnews.pro/news/response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-8764", "canonical_source": "https://dev.to/edison_flores_6d2cd381b13/response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-auditing-8764-mcp-4p05", "published_at": "2026-07-07 23:44:38+00:00", "updated_at": "2026-07-07 23:58:10.517811+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-infrastructure"], "entities": ["MarketNow", "gVisor", "Firecracker", "Anthropic", "GitHub Actions", "AWS"], "alternates": {"html": "https://wpnews.pro/news/response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-8764", "markdown": "https://wpnews.pro/news/response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-8764.md", "text": "https://wpnews.pro/news/response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-8764.txt", "jsonld": "https://wpnews.pro/news/response-to-gvisor-vs-firecracker-for-ai-agent-sandboxing-what-we-learned-8764.jsonld"}}