{"uuid": "bb2c6243-c2de-4f3c-8901-8a6ff12a517e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21626", "type": "seen", "source": "https://gist.github.com/danisherror/2b3a74c36955599a919ce8731f06f8f5", "content": "# Docker, MicroVM & Sandbox \u2014 Curated Reading List\n \nA few of the sub-questions (architecture, networking, security, agents) share the same best sources, so those articles are repeated under each relevant question rather than forcing artificially different links.\n \n---\n \n## \ud83d\udc33 Docker\n \n### What is Docker / What is a container?\n- [What is Docker? \u2014 Docker Docs](https://docs.docker.com/get-started/docker-overview/)\n- [What Is Docker? \u2014 IBM](https://www.ibm.com/think/topics/docker)\n- [What is a Container? \u2014 Docker.com](https://www.docker.com/resources/what-container/)\n### Architecture of Docker\n- [Docker Architecture Explained with Diagram \u2014 PlacementPreparation.io](https://www.placementpreparation.io/blog/docker-architecture/)\n- [Docker Architecture Overview: Structure & Components \u2014 Spacelift](https://spacelift.io/blog/docker-architecture)\n- [Docker Architecture Explained: Components, Workflow, Diagram \u2014 PyNetLabs](https://www.pynetlabs.com/docker-architecture/)\n### Restricting outgoing traffic from a Docker container\n- [How to Restrict Outbound Traffic on a Docker Infrastructure \u2014 Medium (F. Ruty)](https://fruty.medium.com/how-to-restrict-outbound-traffic-on-a-docker-infrastructure-7effc45e313d)\n- [How to Set Up Docker Containers with Custom Firewall Rules (DOCKER-USER chain) \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-08-how-to-set-up-docker-containers-with-custom-firewall-rules/view)\n- [Docker: Restricting In- and Outbound Network Traffic \u2014 DEV Community](https://dev.to/andre/docker-restricting-in--and-outbound-network-traffic-67p)\n### Why / when to use Docker\n- [What Is Docker and Why Should You Use It [Containers 101] \u2014 Sematext](https://sematext.com/glossary/docker/)\n- [What is Docker? \u2014 GeeksforGeeks](https://www.geeksforgeeks.org/devops/introduction-to-docker/)\n### Advantages of Docker\n- [What is a Container? \u2014 Docker.com](https://www.docker.com/resources/what-container/) (standard/lightweight/secure benefits)\n- [Docker Architecture Overview \u2014 Spacelift](https://spacelift.io/blog/docker-architecture) (advantages & challenges section)\n### Disadvantages / gray areas of Docker\n- [21 Docker Security Best Practices: Daemon, Image, Containers \u2014 Spacelift](https://spacelift.io/blog/docker-security) (root-by-default, shared kernel, communication defaults)\n- [Docker Architecture and Its Components: Detailed Explanation \u2014 AlmaBetter](https://www.almabetter.com/bytes/articles/docker-architecture)\n- [MicroVM vs. Docker: A Trade-off Between Isolation and Lightness \u2014 InsForge](https://insforge.dev/blog/microvm-vs-docker) (soft kernel-boundary trade-off, i.e. the \"gray area\")\n### Security issues in Docker\n- [Top 7 Docker Security Risks and Best Practices \u2014 Chainguard](https://www.chainguard.dev/supply-chain-security-101/top-7-docker-security-risks-and-best-practices)\n- [9 Common Docker Container Security Vulnerabilities & Fixes \u2014 Aikido](https://www.aikido.dev/blog/docker-container-security-vulnerabilities)\n- [Docker Container Security Best Practices \u2014 Wiz](https://www.wiz.io/academy/container-security/docker-container-security-best-practices)\n### Advantages of running agents/models in Docker\n- [Running LLM Inference Safely with Docker Sandboxes and Model Runner \u2014 Medium (P. Madduri)](https://medium.com/@pavan4devops/running-llm-inference-safely-with-docker-sandboxes-and-model-runner-2dfc0b1f91c4)\n- [Docker Sandboxes: Run Claude Code and More Safely \u2014 Docker.com](https://www.docker.com/blog/docker-sandboxes-run-claude-code-and-other-coding-agents-unsupervised-but-safely/)\n- [\ud83d\ude80 Securely executing agent code in sandboxed Docker/E2B \u2014 Hugging Face (smolagents)](https://huggingface.co/posts/albertvillanova/674737128301579)\n### Disadvantages of running agents/models in Docker\n- [Running AI Coding Agents in Docker Sandboxes: Why Containers Are No Longer Enough \u2014 Medium (S. Zhukov)](https://xplicit.medium.com/running-ai-coding-agents-in-docker-sandboxes-why-containers-are-no-longer-enough-76e0f65f2ce5)\n- [Quantifying Frontier LLM Capabilities for Container Sandbox Escape (SandboxEscapeBench) \u2014 arXiv](https://arxiv.org/html/2603.02277)\n---\n \n## \ud83d\udd2c MicroVM\n \n### What is a MicroVM / MicroVM \"container\"\n- [What is AWS Firecracker? The microVM technology, explained \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker)\n- [Understanding Firecracker MicroVMs: The Next Evolution in Virtualization \u2014 Medium (Meziouni Reda)](https://medium.com/@meziounir/understanding-firecracker-microvms-the-next-evolution-in-virtualization-cb9eb8bbeede)\n- [What's the difference between a microVM and a container? \u2014 Northflank](https://northflank.com/blog/microvm-vs-container)\n### Architecture of a MicroVM\n- [firecracker/docs/design.md \u2014 GitHub (official design doc)](https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md)\n- [Firecracker Architecture Overview for Developers \u2014 DevelopNSolve](https://www.developnsolve.com/post/firecracker-architecture-overview)\n- [Architecture \u2014 Firecracker DeepWiki](https://deepwiki.com/firecracker-microvm/firecracker/3-architecture)\n### Restricting outgoing traffic from a MicroVM\n- [firecracker/docs/design.md \u2014 GitHub](https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md) (states Firecracker does no filtering itself \u2014 must be done at host level)\n- [Getting Started: Firecracker Network Setup \u2014 GitHub](https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md) (TAP + iptables NAT/masquerade)\n- [AI Agent Code Execution Sandboxes on GPU Cloud: E2B, Daytona, and Firecracker Setup Guide \u2014 Spheron](https://www.spheron.network/blog/ai-agent-code-execution-sandbox-e2b-daytona-firecracker/) (per-sandbox iptables egress allowlisting)\n### Why / when to use a MicroVM\n- [When to use a micro VM, container or full VM \u2014 TechTarget](https://www.techtarget.com/searchitoperations/answer/When-to-use-a-micro-VM-container-or-full-VM)\n- [MicroVM vs Container: How the Kernel Boundary Changes Everything \u2014 Fly.io](https://fly.io/learn/microvm-vs-container/)\n### Advantages of MicroVMs\n- [What is AWS Firecracker? \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker) (speed, memory overhead, security stats)\n- [MicroVMs vs Containers: How to Isolate AI-Generated Code \u2014 Vercel](https://vercel.com/i/microvm-vs-container) (per-workload kernel, auditable containment)\n### Disadvantages of MicroVMs\n- [What is AWS Firecracker? \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker) (no live migration, Linux-only guests, needs bare-metal/nested virtualization)\n- [MicroVM vs Container: How the Kernel Boundary Changes Everything \u2014 Fly.io](https://fly.io/learn/microvm-vs-container/) (operational complexity, debugging difficulty)\n### Gray areas in MicroVMs\n- [Am I in a container or a microVM? \u2014 Some Natalie's Corner of the Internet](https://some-natalie.dev/blog/microvm-or-container/) (hard to tell from the inside; blurred boundary with \"shim\" runtimes)\n- [MicroVM vs. Docker: A Trade-off Between Isolation and Lightness \u2014 InsForge](https://insforge.dev/blog/microvm-vs-docker) (increasingly common to nest containers inside microVMs)\n### Security issues in MicroVMs\n- [Firecracker vs gVisor: Which isolation technology should you use? \u2014 Northflank](https://northflank.com/blog/firecracker-vs-gvisor)\n- [Kata, gVisor, or Firecracker? Container Isolation Guide \u2014 Edera](https://edera.dev/stories/kata-vs-firecracker-vs-gvisor-isolation-compared)\n- [Firecracker, gVisor, and Micro-VMs: The Building Blocks \u2014 StealthCloud](https://stealthcloud.ai/cloud-paradigms/firecracker-gvisor-micro-vms/)\n### Advantages of running agents/models in a MicroVM\n- [Firecracker, gVisor, Containers, and WebAssembly \u2014 Comparing Isolation Technologies for AI Agents \u2014 SoftwareSeni](https://www.softwareseni.com/firecracker-gvisor-containers-and-webassembly-comparing-isolation-technologies-for-ai-agents/)\n- [Running AI agents safely in a microVM using docker sandbox \u2014 Andrew Lock](https://andrewlock.net/running-ai-agents-safely-in-a-microvm-using-docker-sandbox/)\n- [Secure CI/CD Isolation with Firecracker and WireGuard \u2014 Medium (acarlini)](https://medium.com/@antonvkrylov/secure-ci-cd-isolation-with-firecracker-and-wireguard-2df3aef6c64a)\n### Disadvantages of running agents/models in a MicroVM\n- [Kata Containers vs Firecracker vs gVisor \u2014 Northflank](https://northflank.com/blog/kata-containers-vs-firecracker-vs-gvisor) (orchestration/engineering overhead, startup-latency tradeoffs)\n- [The Serverless Computing Survey: A Technical Primer \u2014 arXiv](https://arxiv.org/pdf/2112.12921) (startup latency >1000ms in heavier VM-based isolation, limited flexibility)\n---\n \n## \ud83d\udce6 Sandbox\n \n### What is a Sandbox\n- [Sandbox (computer security) \u2014 Wikipedia](https://en.wikipedia.org/wiki/Sandbox_(computer_security))\n- [Fundamentals of Sandboxing \u2014 Baeldung on Computer Science](https://www.baeldung.com/cs/sandboxing-fundamentals)\n- [What Is a Sandbox in Cybersecurity? Sandboxing Explained for Security Teams \u2014 Appsecure](https://www.appsecure.security/blog/what-is-sandbox-cybersecurity)\n### Architecture of a Sandbox\n- [What Is Sandboxing? What Are the Principles of Sandboxing? \u2014 Huawei](https://info.support.huawei.com/info-finder/encyclopedia/en/Sandboxing.html) (system-level vs. container-level sandbox architecture)\n- [Sandboxing \u2014 Virtualization glossary \u2014 FS.com](https://www.fs.com/glossary/sandboxing-g350.html) (virtualization + access control + anti-evasion components)\n- [Fundamentals of Sandboxing \u2014 Baeldung](https://www.baeldung.com/cs/sandboxing-fundamentals) (surveys different sandbox architectures)\n### Restricting outgoing traffic from a Sandbox\n- [AI Agent Code Execution Sandboxes on GPU Cloud: E2B, Daytona, and Firecracker Setup Guide \u2014 Spheron](https://www.spheron.network/blog/ai-agent-code-execution-sandbox-e2b-daytona-firecracker/) (per-sandbox NAT + iptables egress allowlist)\n- [AI Agent Sandboxing in 2026: Docker, E2B, Firecracker, gVisor, Modal & Daytona Compared \u2014 amux](https://amux.io/guides/ai-agent-sandboxing/) (disabling outbound networking / allowlisting as mitigation)\n### Why / when to use a Sandbox\n- [What Is Sandboxing? \u2014 Palo Alto Networks](https://www.paloaltonetworks.com/cyberpedia/sandboxing)\n- [What is Sandboxing? Understand Sandboxing in Cyber Security \u2014 OPSWAT](https://www.opswat.com/blog/what-is-sandboxing)\n### Advantages of a Sandbox\n- [What Is Sandboxing? \u2014 Palo Alto Networks](https://www.paloaltonetworks.com/cyberpedia/sandboxing) (supports zero trust, reduces patch urgency, protects BYOD)\n- [What is Sandboxing? \u2014 OPSWAT](https://www.opswat.com/blog/what-is-sandboxing) (dynamic/behavioral detection beyond signatures)\n### Disadvantages of a Sandbox\n- [What Is Sandboxing in Cybersecurity? Detecting Threats \u2014 SentinelOne](https://www.sentinelone.com/cybersecurity-101/endpoint-security/what-is-sandboxing/) (time-window limits, can't simulate human interaction)\n- [Sandbox Evasion: How Attackers Use It to Bypass Malware Detection \u2014 Group-IB](https://www.group-ib.com/resources/knowledge-hub/sandbox-evasion/) (ineffective vs. novel/zero-day exploits, resource/time constraints)\n### Gray areas in Sandboxing\n- [Malware Dynamic Analysis Evasion Techniques: A Survey \u2014 arXiv](https://arxiv.org/pdf/1811.01190) (malware simply \"behaves nicely\" inside the sandbox \u2014 detection blind spot)\n- [Navigating the Vast Ocean of Sandbox Evasions \u2014 Unit 42 (Palo Alto)](https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection/) (in-guest vs. out-of-guest instrumentation trade-offs)\n### Security issues in a Sandbox\n- [Malware Sandbox Evasion Techniques \u2014 Apriorit](https://www.apriorit.com/dev-blog/545-sandbox-evading-malware)\n- [Malware Sandbox Evasion Techniques: How Threats Slip Past Detection \u2014 VMRay](https://www.vmray.com/sandbox-evasion-techniques/)\n- [What Is Sandboxing in Cybersecurity? Detecting Threats \u2014 SentinelOne](https://www.sentinelone.com/cybersecurity-101/endpoint-security/what-is-sandboxing/) (MITRE ATT&CK T1497 sandbox-evasion techniques)\n### Advantages of running agents/models in a Sandbox\n- [AI Agent Sandbox: How to Safely Run Autonomous Agents in 2026 \u2014 Firecrawl](https://www.firecrawl.dev/blog/ai-agent-sandbox)\n- [Coding Agent Sandbox: Secure Environments for AI-Generated Code \u2014 Bunnyshell](https://www.bunnyshell.com/guides/coding-agent-sandbox/)\n- [Where Should Your AI Agent Run Code: E2B vs Daytona vs Modal vs Cloudflare vs Vercel Sandbox \u2014 Developers Digest](https://www.developersdigest.tech/blog/ai-agent-code-sandbox-comparison-2026)\n### Disadvantages of running agents/models in a Sandbox\n- [Modal vs E2B vs Daytona vs Vercel Sandbox: AI Code Execution \u2014 Particula](https://particula.tech/blog/modal-vs-e2b-vs-daytona-vs-vercel-sandbox-ai-code-execution) (isolation vs. cold-start latency trade-offs; \"capability-permissions layer everyone forgets\" \u2014 sandboxing the process isn't the same as scoping what damage a compromised agent can do)\n- [AI Agent Sandboxing in 2026 \u2014 amux](https://amux.io/guides/ai-agent-sandboxing/) (container escapes like CVE-2024-21626 still possible if isolation tech is chosen poorly)\n---\n \n*Note: Several sources (e.g., Northflank's blog, Firecracker's own docs, and Spheron's guide) are reused across multiple questions because they directly and thoroughly address more than one sub-topic \u2014 this was intentional rather than a lack of variety.*\n \n---\n---\n \n# Part 2 \u2014 Deeper Dives & Related Topics\n \n## \u2696\ufe0f Comparative / Decision-Making\n \n### Docker vs MicroVM vs Sandbox vs Full VM comparison\n- [Containers vs Virtual Machines: Key Differences and When to Use Each (2026) \u2014 Northflank](https://northflank.com/blog/containers-vs-virtual-machines)\n- [Comparing Sandboxing Approaches for AI Agents \u2014 Docker](https://www.docker.com/blog/comparing-sandboxing-approaches-ai-agents/)\n- [MicroVMs vs Containers: How to Isolate AI-Generated Code \u2014 Vercel](https://vercel.com/i/microvm-vs-container)\n### How to choose the right isolation layer (cost vs security vs latency)\n- [Docker Sandboxes and microVMs, Explained \u2014 InfoWorld](https://www.infoworld.com/article/4177309/docker-sandboxes-and-microvms-explained.html)\n- [MicroVM vs Container: How the Kernel Boundary Changes Everything \u2014 Fly.io](https://fly.io/learn/microvm-vs-container/)\n- [microsandbox vs Docker: MicroVMs vs Containers for Agents \u2014 microsandbox.dev](https://microsandbox.dev/compare/docker)\n### Kata Containers vs gVisor vs Firecracker (deep technical comparison)\n- [Kata, gVisor, or Firecracker? Container Isolation Guide \u2014 Edera](https://edera.dev/stories/kata-vs-firecracker-vs-gvisor-isolation-compared)\n- [Kata Containers vs Firecracker vs gVisor \u2014 Northflank](https://northflank.com/blog/kata-containers-vs-firecracker-vs-gvisor)\n- [Firecracker vs gVisor: Which Sandbox in 2026? \u2014 Aleksei Aleinikov](https://www.alekseialeinikov.com/en/blog/topics/devops/microvms-firecracker-vs-gvisor-secure-workloads-2026)\n### Cost of running each at scale\n- [microVM vs. Docker: A Trade-off Between Isolation and Lightness \u2014 InsForge](https://insforge.dev/blog/microvm-vs-docker)\n- [Firecracker, gVisor, Containers, and WebAssembly \u2014 Comparing Isolation Technologies for AI Agents \u2014 SoftwareSeni](https://www.softwareseni.com/firecracker-gvisor-containers-and-webassembly-comparing-isolation-technologies-for-ai-agents/) (10\u201320% cost premium for microVMs at scale)\n---\n \n## \ud83d\udc33 Docker \u2014 Deeper Dives\n \n### Docker networking modes (bridge, host, overlay, macvlan)\n- [Docker Networking Explained: Overlay & Macvlan Networks \u2014 Eduonix](https://blog.eduonix.com/2026/07/docker-networking-explained-bridge-host-overlay-macvlan/)\n- [Docker Networking \u2014 Bridge, Host, Overlay & Macvlan Drivers \u2014 NetworkersHome](https://www.networkershome.com/fundamentals/kubernetes-networking/docker-networking/)\n- [Docker Networking Deep Dive: Bridge, Host, Overlay, and Macvlan Explained \u2014 usulnet](https://articles.usulnet.com/articles/docker-networking-explained)\n### Docker volumes & persistent storage strategies\n- [Docker Volumes vs. Docker Layers: Understanding Persistent Storage and Image Optimization \u2014 What's in the Cloud](https://whatsinthecloud.substack.com/p/docker-volumes-vs-docker-layers-understanding)\n- [Docker for Developers: Essential Guide to Portable Environments and Multi-Stage Builds \u2014 Dev|Journal](https://earezki.com/ai-news/2026-03-28-docker-for-developers-the-practical-guide-you-actually-need/)\n### Multi-stage builds & image size optimization\n- [How to Optimize Docker Images with Multi-Stage Builds \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-20-docker-multi-stage-builds/view)\n- [Docker Multi-Stage Builds for Production-Optimized Images \u2014 dasroot.net](https://dasroot.net/posts/2026/04/docker-multi-stage-builds-production-optimized-images/)\n- [6 Proven Ways to Shrink Your Docker Image Size \u2014 BestHub](https://www.besthub.dev/articles/6-proven-ways-to-shrink-your-docker-image-size-9a060eb748d6)\n### Rootless Docker \u2014 how it works and its limitations\n- [Docker Rootless: High Security and High Performance \u2014 DEV Community](https://dev.to/jiisanda/docker-rootless-high-security-and-high-performance-2ji8)\n- [Rootless Docker and Its Hidden Security Trade-Offs \u2014 Ken Muse](https://www.kenmuse.com/blog/rootless-docker-and-its-hidden-security-trade-offs/)\n- [How to Run Docker Without Root (Rootless Mode) \u2014 OneUptime](https://oneuptime.com/blog/post/2026-01-06-docker-rootless-mode/view)\n### Docker Compose vs Kubernetes \u2014 when you've outgrown Compose\n- [Docker Compose vs Kubernetes: When to Use Each in 2026 \u2014 DEV Community](https://dev.to/_d7eb1c1703182e3ce1782/docker-compose-vs-kubernetes-when-to-use-each-in-2026-1hji)\n- [When to Use Docker Compose vs. Kubernetes \u2014 Earthly Blog](https://earthly.dev/blog/dockercompose-vs-k8s/)\n- [Docker Compose vs Kubernetes \u2014 Spacelift](https://spacelift.io/blog/docker-compose-vs-kubernetes)\n### Container orchestration basics (Kubernetes, Swarm, Nomad)\n- [Kubernetes vs Docker Explained: Container Orchestration Basics \u2014 Wiz](https://www.wiz.io/academy/container-security/kubernetes-and-docker)\n- [Docker Compose vs Kubernetes: Which in 2026? \u2014 DeployWise](https://deploywise.dev/blog/docker-compose-vs-kubernetes) (covers Swarm's decline vs. Kubernetes standardization)\n### Image signing, SBOMs, and supply chain security (Sigstore, cosign)\n- [\ud83d\udd0f SBOM and Container Signing for Cloud Supply Chain \u2014 ServerMall Cloud](https://cloud.servermall.com/blog/sbom-and-container-image-signing-cosign-sigstore-and-supply-chain-security-in-the-cloud/)\n- [How to Implement Supply Chain Security for Kubernetes \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-20-supply-chain-security-kubernetes/view)\n- [Sign Container Images with Sigstore Cosign \u2014 Kubezilla](https://kubezilla.io/sign-container-images-with-sigstore-cosign/)\n### cgroups and resource limiting in depth (CPU/memory/pids-limit)\n- [How to Understand Docker Container Cgroups in Depth \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-08-how-to-understand-docker-container-cgroups-in-depth/view)\n- [Linux cgroups: Resource Limits for Processes \u2014 Abhik Sarkar](https://www.abhik.ai/concepts/systems/cgroups)\n- [cgroups Explained \u2014 How Linux Limits Container Resources \u2014 Tuteworld](https://www.tuteworld.com/linux/containers/cgroups/)\n---\n \n## \ud83d\udd2c MicroVM \u2014 Deeper Dives\n \n### Kata Containers architecture & Kubernetes integration\n- [Kata Containers Architecture \u2014 Official Docs](https://kata-containers.github.io/kata-containers/design/architecture/)\n- [Kubernetes Integration \u2014 Kata Containers DeepWiki](https://deepwiki.com/kata-containers/kata-containers/4.2-kubernetes-integration)\n- [Kata Containers on Kubernetes and Kata Firecracker VMM Support \u2014 Medium (Gokul Chandra)](https://gokulchandrapr.medium.com/kata-containers-on-kubernetes-and-kata-firecracker-vmm-support-28abb3a196e7)\n### Snapshot/resume & \"warm pool\" strategies for cold-start latency\n- [Restoring Uniqueness in MicroVM Snapshots \u2014 arXiv](https://arxiv.org/pdf/2102.12892)\n- [firecracker/docs/snapshotting/snapshot-support.md \u2014 GitHub](https://github.com/firecracker-microvm/firecracker/blob/main/docs/snapshotting/snapshot-support.md)\n- [Building an AWS Lambda-like Runtime with Firecracker MicroVMs \u2014 Medium (Vivek Jadhav)](https://medium.com/@vivek1502/building-an-aws-lambda-like-runtime-with-firecracker-microvms-42a418c6e3d7)\n### Confidential computing / TEEs (AMD SEV, Intel TDX) with microVMs\n- [How to Sandbox AI Agents in 2026: Firecracker, gVisor, Runtimes & Isolation Strategies \u2014 Manveer Chawla](https://manveerc.substack.com/p/ai-agent-sandboxing-guide) (covers confidential-computing \"Level 5\" isolation)\n- [AMD SEV vs Intel TDX vs NVIDIA GPU TEE \u2014 Phala](https://phala.com/learn/AMD-SEV-vs-Intel-TDX-vs-NVIDIA-GPU-TEE)\n- [Confidential VMs Explained: An Empirical Analysis of AMD SEV-SNP and Intel TDX \u2014 ACM](https://dl.acm.org/doi/10.1145/3700418)\n### Unikernels as an alternative/complement to microVMs\n- [Unikernels vs. Containers: See the Lightweight Championship Fight \u2014 TechTarget](https://www.techtarget.com/searchitoperations/tip/Unikernels-vs-containers-See-the-lightweight-championship-fight)\n- [Containers vs. Unikernels: An Apples-to-Oranges Comparison \u2014 Container Journal](https://containerjournal.com/topics/container-ecosystems/containers-vs-unikernels-an-apples-to-oranges-comparison/)\n- [Hands-On Introduction to Unikernels \u2014 Ivan Velichko (X thread)](https://x.com/iximiuz/status/2012214348672844149)\n### How AWS Lambda/Fargate use Firecracker under the hood\n- [What is AWS Firecracker? The microVM Technology, Explained \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker)\n- [Firecracker microVMs: The Power Behind AWS Lambda \u2014 Antho's Blog](https://www.anthony-balitrand.fr/2025/08/12/firecracker-microvms-the-power-behind-aws-lambda/)\n- [AWS Lambda MicroVMs: Sandbox Agent Code Without the Infra \u2014 AgentConn](https://agentconn.com/blog/sandbox-agent-code-aws-lambda-firecracker-microvms-2026/)\n### GPU passthrough into microVMs (for AI inference workloads)\n- [Best Self-Hosted MicroVM Platforms 2026: Firecracker vs Cloud-Hypervisor vs crosvm \u2014 Pi Stack](https://www.pistack.xyz/posts/2026-05-09-microvm-platforms-firecracker-cloud-hypervisor-crosvm-guide/)\n- [A Field Guide to Sandboxes for AI \u2014 Luis Cardoso](https://www.luiscardoso.dev/blog/sandboxes-for-ai) (VFIO passthrough trade-offs)\n- [A Journey to Support vGPU in Firecracker \u2014 SlideShare](https://www.slideshare.net/slideshow/ajournneytosupportvgpuinfirecrackerpdf/252009037)\n---\n \n## \ud83d\udce6 Sandbox \u2014 Deeper Dives\n \n### OS-level sandboxing primitives: seccomp, AppArmor, SELinux, Landlock\n- [Securing Linux with SELinux (or AppArmor) \u2014 LinuxBlog.io](https://linuxblog.io/securing-linux-selinux-apparmor/)\n- [Landlock LSM: Toward Unprivileged Sandboxing \u2014 LWN.net](https://lwn.net/Articles/731478/)\n- [Locking Down Science Gateways with Landlock and Seccomp \u2014 arXiv](https://arxiv.org/html/2509.18548v2) (direct comparison of all four primitives)\n### Browser sandboxing (site isolation, Chrome's multi-process model)\n- [Chromium Docs \u2014 Process Model and Site Isolation](https://chromium.googlesource.com/chromium/src/+/main/docs/process_model_and_site_isolation.md)\n- [Site Isolation \u2014 Chromium.org](https://www.chromium.org/Home/chromium-security/site-isolation/)\n- [Chrome Sandbox Mode Explained \u2014 ChromeThemer](https://www.chromethemer.com/chrome-sandbox-mode-explained/)\n### WebAssembly (Wasm) as a sandboxing technology \u2014 strengths/limits vs containers\n- [Wasm vs. Containers: A Security and Performance Comparison \u2014 Medium (Enrico Piovesan)](https://medium.com/wasm-radar/wasm-vs-containers-a-security-and-performance-comparison-bbb0bd35c3fb)\n- [WebAssembly (Wasm) in the Cloud: The Next Stage After Containers? \u2014 ayedo](https://ayedo.de/en/posts/webassembly-wasm-in-der-cloud-die-nachste-stufe-nach-dem-container/)\n- [WebAssembly vs Containers: Stateless Compute Boundary \u2014 candede.com](https://www.candede.com/articles/wasm-vs-docker/) (honest take on where Wasm's sandbox model still needs defense-in-depth)\n### Language-level sandboxes (Python, JS vm2/isolated-vm)\n- [vm2 Sandbox Escape | AI Agent RCE Risk and IOCs \u2014 Kodem](https://www.kodemsecurity.com/resources/vm2-sandbox-escape-vulnerabilities-the-2026-cve-wave-turning-ai-agents-into-host-rce-vectors)\n- [Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat \u2014 DevOps.com](https://devops.com/critical-flaw-in-isolated-vm-can-lead-to-sandbox-escape-rce-threat/)\n- [New Sandbox Escape Affecting Popular Node.js Sandbox Library vm2 \u2014 Semgrep](https://semgrep.dev/blog/2026/calling-back-to-vm2-and-escaping-sandbox/) (also recommends alternatives: isolated-vm, Deno, containers)\n### Persistent vs ephemeral sandboxes for long-running AI agents\n- [AI Agent Sandboxing in 2026: Docker, E2B, Firecracker, gVisor, Modal & Daytona Compared \u2014 amux](https://amux.io/guides/ai-agent-sandboxing/) (Daytona's persistent workspaces vs. E2B's short-lived execution)\n- [Where Should Your AI Agent Run Code: E2B vs Daytona vs Modal vs Cloudflare vs Vercel Sandbox \u2014 Developers Digest](https://www.developersdigest.tech/blog/ai-agent-code-sandbox-comparison-2026)\n### Sandbox escape write-ups (real-world breakouts)\n- [Critical Sandbox Escape in vm2 Enables RCE \u2014 Endor Labs](https://www.endorlabs.com/learn/cve-2026-22709-critical-sandbox-escape-in-vm2-enables-arbitrary-code-execution)\n- [Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE \u2014 The Hacker News](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html)\n- [Quantifying Frontier LLM Capabilities for Container Sandbox Escape (SandboxEscapeBench) \u2014 arXiv](https://arxiv.org/html/2603.02277)\n---\n \n## \ud83e\udd16 AI-Agent-Specific Topics\n \n### Permission/capability models for agentic tool-calling\n- [Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk \u2014 NVIDIA Technical Blog](https://developer.nvidia.com/blog/practical-security-guidance-for-sandboxing-agentic-workflows-and-managing-execution-risk/)\n- [AI Agent Security \u2014 OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html)\n- [Small Language Models for Agentic Systems: A Survey (Section XV \u2014 Security, Governance & Compliance for Tool-Using Agents) \u2014 arXiv](https://arxiv.org/pdf/2510.03847)\n### Prompt-injection-driven sandbox escape \u2014 is isolation alone enough?\n- [When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks \u2014 Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/)\n- [Agent Security Boundaries: From Prompt Injection to Tool Misuse \u2014 Medium (Tao An)](https://tao-hpu.medium.com/agent-security-boundaries-from-prompt-injection-to-tool-misuse-d25b6dbaad60)\n- [AI Agent Code Execution Security Explained: Why It Happens and How to Fix It \u2014 PredictionGuard](https://predictionguard.com/blog/ai-agent-code-execution-security-explained)\n### Comparing built-in agent sandboxes: Claude Code, Codex CLI, Cursor, Gemini CLI\n- [Claude Code vs Codex CLI vs Gemini CLI (2026) \u2014 CodeAnt](https://codeant.ai/blogs/claude-code-cli-vs-codex-cli-vs-gemini-cli-best-ai-cli-tool-for-developers-in-2025)\n- [Claude Code vs Gemini CLI vs Codex CLI: Which One Should You Pick in 2026? \u2014 ShareUHack](https://www.shareuhack.com/en/posts/claude-code-vs-gemini-cli-vs-codex-cli-decision-guide-2026)\n- [Coding Agent Sandbox: Secure Environments for AI-Generated Code \u2014 Bunnyshell](https://www.bunnyshell.com/guides/coding-agent-sandbox/) (Bubblewrap/Seatbelt/Landlock+seccomp comparison across agents)\n### Multi-agent isolation \u2014 should each agent get its own sandbox/microVM?\n- [The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems \u2014 arXiv](https://arxiv.org/pdf/2605.29178) (per-agent Linux users sharing one sandbox vs. full isolation)\n- [What Is an Agent Execution Sandbox? \u2014 Augment Code](https://www.augmentcode.com/guides/agent-execution-sandbox)\n- [Multi-Agent Penetration Testing AI for the Web \u2014 arXiv](https://arxiv.org/pdf/2508.20816) (shared-container vs. per-agent isolation trade-offs)\n### Observability/auditing inside a sandboxed agent run\n- [7 Best AI Agent Observability Tools for Coding Teams in 2026 \u2014 Augment Code](https://www.augmentcode.com/tools/best-ai-agent-observability-tools)\n- [AI Agent Sandbox Environment - Setup Guide 2026 \u2014 Fastio](https://fast.io/resources/ai-agent-sandbox-environment/)\n- [AI Sandboxes & Volumes: Isolated Environments for Coding Agents \u2014 Windmill](https://www.windmill.dev/blog/launch-week-ai-sandboxes)\n### Data exfiltration risks for agents with file + network access\n- [How to Sandbox AI Agents in 2026: MicroVMs, gVisor & Isolation Strategies \u2014 Northflank](https://northflank.com/blog/how-to-sandbox-ai-agents)\n- [Exploiting Web Search Tools of AI Agents for Data Exfiltration \u2014 arXiv](https://arxiv.org/pdf/2510.09093)\n- [Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk \u2014 NVIDIA Technical Blog](https://developer.nvidia.com/blog/practical-security-guidance-for-sandboxing-agentic-workflows-and-managing-execution-risk/) (egress controls as the #1 mitigation)\n ", "creation_timestamp": "2026-08-31T03:55:42.368224Z"}