How secure is your coding agent? Your dev environment?

Shared kernel,
or bring your own

That one line decides whether a break-in stays in the box, or owns your machine. sandboxicon is a field guide to every layer of container and VM isolation, and to what your AI coding agent is actually running with by default.

Start with the two models →Audit your agent

Shared kernel

Containers, process sandboxes

app
agent
one host kernel

Fast, cheap, reasonably secure but one kernel bug (rare but possible) escapes every box.

Own kernel

microVMs and full VMs

app
its own kernel
agent
its own kernel
hardware boundary
hypervisor, KVM / HVF
host kernel

Each box brings its own kernel. The hardware boundary is the CPU's own virtualization (Intel VT-x / AMD-V), driven by the hypervisor, a wall enforced in silicon. A guest-kernel break stays in its box.

Shared kernel

  • Starts in milliseconds with almost no overhead
  • The tooling you already use: Docker, Podman, dev containers
  • One kernel bug from the host, and every box shares that kernel

Own kernel

  • A guest kernel bug stays in the box; reaching the host takes a second exploit
  • microVMs boot in about 125 ms, cheap enough to use per task
  • More friction: guest kernels, mounts, and a VMM that itself needs sandboxing

The ladder

Six rungs, one fault line.

Climb from raw kernel features to a full machine and isolation gets stronger, and slower. But only one rung changes the rules: the kernel line, where a break-in stops being your whole computer.

microvm14 tech

Above the line: shared kernel. Below it: own kernel behind a hardware boundary.

Three ways in

However you got here.

Start hereThe two models→Take a container apart into the kernel features it's actually made of, then watch a microVM reuse them to build a second wall.ReferenceLook up any primitive→Namespaces, seccomp, gVisor, Firecracker, libkrun, 49 entries, filterable by isolation tier, category, and platform.AuditWhat's your agent running?→Claude Code, Cursor, Codex, Devin, what isolation each one actually gives you by default, out of the box.

Why this exists

A labor of curiosity.

I wanted to understand exactly what protects my machine when a coding agent, or a compromised dependency, runs code on it. Supply-chain worms like Shai-Hulud 2.0 were stealing credentials from some 30,000 repositories while most senior engineers I asked had the same vague picture of isolation that I did. So I read the docs and the source, pinned the models down, and wrote them here, so all of us can choose an isolation level on purpose.

The full story →

We show our work.

Isolation is a field full of confident marketing. Every claim on this site carries a label for how well we actually know it, verified-code, documented, inferred, or undisclosed. When a vendor won't say what's under the hood, we say so, and we never guess a tier.

How we know what we know →