Pick your agent sandbox primitive by threat model: Firecracker microVM vs gVisor vs V8 isolate

Northflank·medium signal

Because agent code is generated at runtime and can't be reviewed before it executes, the 2026 model treats it as arbitrary adversarial code and converges on three primitives — Firecracker microVMs (strongest, for regulated data), gVisor user-space kernels (syscall-level, for compute-heavy multi-tenant), and V8 isolates (JS-only, for latency-critical lightweight tasks). No single layer suffices; defense-in-depth (compute isolation + filesystem restrictions + network egress controls + resource limits) reportedly cuts incidents ~90% versus unrestricted host access. Choose the primitive by data sensitivity and workload shape rather than defaulting to a plain container.