A silicon wall, not a namespace

Autonomous agents execute code they wrote seconds ago. That is the point — and the problem. You would not run untrusted code next to your other workloads behind nothing but a kernel namespace, so we don't either.

The boundary is hardware, not convention

Containers isolate by agreement: every tenant shares one kernel, and the namespace promises to keep them apart. A microVM isolates by construction — its own guest kernel, its own memory, a boundary enforced by the hypervisor. One agent, one VM — an escape has to defeat that boundary, not talk a namespace into sharing.

The boundary is sealed before the agent executes its first instruction. The filesystem policy and the syscall surface are locked when the sandbox is created — not applied afterwards, and not widenable from inside the guest.

Egress is a decision, not a default

Inside the wall the agent has everything it needs: the repo, its model, scoped secrets. What it doesn't have is the internet. A session starts with no route out, and what it may reach is resolved when the session is created — the repository host, the model endpoint, any configured MCP endpoint. Everything else is dropped, and the set closes again with the session.

That control is its own layer. The hypervisor gives you the wall; it does not filter packets. Deny-by-default egress is enforced separately, on the host datapath outside the guest, which is why it holds even when the workload inside is the thing you distrust.

This is the difference between a sandbox you hope holds and one you can point at. A shared-kernel container asks you to trust the namespace, the seccomp profile, and every CVE that hasn't been found yet. A microVM asks you to trust the hardware boundary — the same one your cloud provider already bets its multi-tenancy on.

Why this beats hardened Docker

You can spend weeks hardening Docker for agent workloads — rootless mode, user namespaces, gVisor, a seccomp allowlist you maintain forever — and still share a kernel. microVM isolation moves the boundary down a layer so that a kernel bug in the guest is contained, not catastrophic. Less to configure, less to get wrong, and a story you can actually explain to a security reviewer.

For agents that write and run their own code, that trade is not close. The wall is the product.

The layer-by-layer architecture — filesystem policy, syscall surface, network boundary, credential handling — is written up on the microVM isolation page. What that boundary means for a running agent session is on the agent sandbox page.