#containers
Artwork: Prisoners Exercising by Vincent van Gogh. Wikimedia Commons, Pushkin Museum of Fine Arts · Public domain
AgentsIsolated Execution for Coding Agents: Where the Sandbox Ends
Choose an agent sandbox by its complete boundary, not its runtime label. Kernel isolation, network paths, credentials, lifecycle controls, evidence, and broker privilege can each decide whether containment holds.