LinkKata Containers CommunityTool
Shared-kernel containers introduce isolation risks. Kata Containers offers an alternative for untrusted workloads and multi-tenant environments by applying hardware-level VM isolation without sacrificing container ergonomics.
By bringing together work from Intel and Hyper.sh, Kata Containers addresses the trade-off between standard container agility and traditional VM security. Its support for modern minimal hypervisors such as Firecracker and native containerd integration allows teams to enhance workload security within existing container workflows.
Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.
Similar in content, found by the AI search.
Link:firecracker-microvm.github.io
Firecracker is an open-source virtualisation technology designed for building and managing secure, multi-tenant container and function-based services. It brings together the strong workload isolation of traditional virtual machines with the speed and efficiency of containers.
Article:Wikipedia-Autoren
LXC provides operating system-level virtualisation on Linux by running multiple isolated systems on a single shared kernel. It combines kernel cgroups and namespaces to isolate processes and enforce resource limits.
Repository:agent-substrate/substrate
Agent Substrate is an open-source Go runtime designed to run millions of agent workloads securely and efficiently on Kubernetes. It isolates untrusted code using microVMs or gVisor and snapshots idle agents to save resources.
5.4kstarsGo
Repository:NVIDIA/OpenShell
NVIDIA OpenShell is an open-source runtime written in Rust designed to run autonomous AI agents in secure sandboxes. It enforces declarative policies at the kernel level and guards access to network routes and credentials.
16.6kstarsRust
Repository:anthropics/sandbox-runtime
Anthropic's Sandbox Runtime (srt) is an open-source tool designed to enforce OS-level filesystem and network restrictions on arbitrary processes. Developed as a safety component for Claude Code, it isolates AI agents, MCP servers, and shell commands without requiring containerisation.
5.1kstarsTypeScript
Repository:microsoft/mxc
Microsoft eXecution Container (MXC) is a cross-platform sandboxed code execution framework designed for running untrusted workloads such as AI model output, plugins, and tools across Windows, Linux, and macOS. It wraps native OS containment mechanisms and VMs into a unified policy engine and typed SDKs.
1.8kstarsRust
Parts of this content were created with the assistance of AI.
